There is no standard HubSpot portal. So there's no standard audit.
Intro
Most people hear "audit" and picture a sales call with a PDF attached. Somebody pokes around your portal for twenty minutes, tells you your data is messy, and produces a proposal. That's not an audit. That's prospecting.
A real audit answers a specific question: is this portal costing you money, and where?
Sometimes the answer takes an hour. Sometimes we need to get under the hood for a few days. Either way, you walk away with a plain-English list of what's working, what's quietly bleeding, and what to fix first — whether or not you ever hire us to fix it.
Here's what we actually look at.
First, what do you even own?
Before we log in, we ask two questions. Which Hubs do you have, and on what tiers?
This sounds like paperwork but it’s not. It's the single most important input to the entire audit, because it determines what "good" looks like for your portal specifically.
A company on Marketing Enterprise, Sales Professional, Service Starter, for example, gets audited completely differently than one on Marketing Professional, Sales Enterprise, Service Enterprise. In the first, the marketing team has custom objects, advanced workflow logic, and multi-touch attribution available — and the service team has almost nothing. In the second, it's inverted.
The number of possible portals is 3,072
Most people assume HubSpot has 4 versions - Free, Starter, Professional, and Enterprise. In reality, when you consider that 5 of the 6 Hubs (Marketing, Sales, Service, Content, Data) have 4 tiers - and 1 (Revenue) has 3.
Therefore, that’s 4 × 4 × 4 × 4 × 4 × 3 = 3,072 possible tier combinations.
3,071 of them mean you're paying HubSpot for something, and 1,024 of them include at least one Enterprise Hub.
And that's before add-ons: transactional email, SMS, dedicated IP, additional marketing contact tiers, extra core seats, sales and service seats, API limit increases, and Breeze credits for AI features. Two companies can both say "we're on HubSpot Professional" and be running fundamentally different software.
If someone offers to audit your portal without asking what you own, they're auditing a portal they imagined.
Then we look under the hood
Once we know what we're working with, we go looking for the gap between what you're paying for and what you're using.
It usually lives in three places: users, teams and seats.
Users, teams, and seats you're paying for twice
We start with the org chart, as HubSpot understands it. How many users, in what teams, structured how?
Then the uncomfortable part: who's actually logging in?
Not just "who has an account." But who opens HubSpot on a Tuesday at 4:45pm. We pull login activity and last-active dates, and it's common to find seats assigned to people who left, people who never onboarded, and people who quietly went back to running their pipeline out of a spreadsheet. Every one of those is a line item on your invoice.
This is one of the fastest ROI findings in any audit. A handful of dormant seats at Professional or Enterprise pricing adds up to real money over a year, and reclaiming them takes about ten minutes.
Team structure matters too. Teams drive record visibility, routing, and reporting. If your teams don't reflect how the business actually works — or if everyone got dumped into one team at implementation and nobody revisited it — your reports are aggregating things that shouldn't be aggregated, and reps are seeing records they shouldn't see.
What we pull: user list and team structure, login activity, last-active dates, seat type by user, record visibility settings.
Permissions, and the Super Admin problem
Then we check permission sets. Specifically, how many Super Admins you have.
The answer should be a small number. Two or three. Enough that you're not locked out if someone's on vacation, few enough that you know exactly who they are.
What we find, more often than not, is that roughly every other user is a Super Admin. This is not best practice, and it usually happens for an understandable reason: somebody hit a permissions wall mid-quarter, asked for access, and the fastest path was to promote them rather than build a proper permission set. Repeat that a dozen times over two years and your access model is gone.
The risk isn't that your team is malicious. It's that Super Admins can delete properties, edit workflows, change pipeline stages, modify billing, and export your entire database — often without realizing what depends on the thing they just changed. Most of the genuinely expensive portal disasters we've cleaned up started with someone well-intentioned who had more access than their job required.
What we pull: permission sets in use, Super Admin count, who can edit workflows, who can delete properties, export and billing access.
Workflows — the count, and the craft
Workflows are where we spend the most time, because it's where the most damage hides.
First, the raw numbers. How many workflows exist, and how many are actually active versus inactive? A portal with 140 workflows and 30 active isn't automated — it's haunted. Those 110 inactive workflows are a graveyard nobody wants to touch, because nobody remembers what they did or whether turning one off broke something. Meanwhile, some of the "inactive" ones are enrolling contacts you forgot about.
Then, the craft. Were these built to a standard, or did they accumulate? Naming is the fastest tell. Is it “[Sales] Deal Stage — Closed Won → Onboarding Handoff,” or is it “New Workflow (3)”? You'd be amazed how often it's the second one.
Here's the rest of what we check — the boring stuff that separates a portal you can maintain from one you can't:
Folder structure. Organized by team and function, or 200 workflows in a flat list?
Enrollment logic. Are triggers specific, or does everything enroll on "Contact is known" and get filtered later?
Re-enrollment. Set deliberately, or left on default and quietly emailing people four times?
Overlap. Do three different workflows all set Lifecycle Stage? They shouldn't. They frequently do.
Dead ends. Branches that go nowhere, delays measured in months, actions referencing properties that no longer exist.
Documentation. Any internal notes explaining why a workflow exists, or is that knowledge sitting with someone who left in 2023
None of this is overly interesting - but it all helps determines whether your team can change something next quarter without calling a consultant.
What we pull: total workflow count, active vs. inactive split, folder tree, enrollment and re-enrollment settings, actions referencing deleted properties.
What you get at the end
A prioritized, plain-English list:
What's working, and should be left alone
What's costing you money right now, with the number attached
What to fix first, in priority order
Roughly what each fix takes
Which fixes your own team can handle without us
Every finding is tied to something we actually pulled out of your portal, so you can verify it yourself.
Something you can hand to an internal admin and have them start on Monday.
Plenty of clients do exactly that. We're fine with it — a good audit is worth paying for on its own, and we'd rather be the people who told you the truth than the people who manufactured a project.
How long it takes
We size the audit during a short discovery call, before anything starts, so you're not paying for a review that's too narrow to be useful or too broad to be worth it.
The one-hour version. A focused pass on a specific problem: seats and licensing, a permissions model that's gotten away from you, or a workflow set that's misfiring. Good when you already suspect where the issue is.
Under the hood. A full review across Hubs — objects and properties, pipelines, teams and permissions, the whole workflow inventory, and the reporting built on top of it. Good when you've inherited a portal, or nobody's looked in two years.
Common Questions
Do I have to hire you to do the fixes? No. The audit is a standalone engagement and the findings are yours either way. Plenty of clients take the list and handle it in-house, and we'd rather be the people who told you the truth than the people who manufactured a project.
What access do you need to my portal? Enough to see everything, and no more than that. We'll tell you exactly which permissions we need before you grant anything, and we're happy to be removed the day we deliver. Given that half this page is about permission sprawl, we're not going to be the ones adding a permanent Super Admin to your portal.
We just implemented HubSpot. Is it too early for an audit? Usually not — six to twelve months post-implementation is one of the better times to look. That's long enough for real usage patterns to show up and early enough that bad habits haven't calcified into things nobody wants to touch. It's also when unused seats from the original rollout tend to surface.
What if we're only on free tools or Starter? Then the audit is shorter and cheaper, and mostly about whether you're leaving value on the table or about to outgrow your tier. We'll also tell you if you don't need to upgrade, which is a real answer we give more often than you'd think.
Do you audit portals you didn't build? That's most of our audit work. Inherited portals, portals from a previous agency, portals where the person who set everything up left in 2023 — those are the ones with the most to find.
Can you do this in Spanish? Yes. We work in English and Spanish, with clients across the US, Canada, and Latin America, and we can deliver the findings in either language.
How much does an audit cost? This will depend entirely on the scope and detail of the type of audit you are looking for. Please send us an email to contact@koishark.com or book a call with us so that we can determine what we’d be looking at in terms of price.
Book a free 15-minute call
Tell us which Hubs and tiers you're on and what's bothering you. We'll tell you whether an audit is worth it — and roughly how big it needs to be.
Book a call Or email contact@koishark.com
KoiShark Consulting is a certified HubSpot Solutions Partner. We audit, rebuild, and train teams on HubSpot in English and Spanish, for startups and midsize companies across the US, Canada, and Latin America.