Creatio CRM Health Audit: 25 Checks Every Business Should Run After Go-Live

Configuration Health — 5 Checks:

• Check 1 — Object and Field Usage Audit: Extract list of all custom objects and fields. For each, determine: when was it created, when was it last modified, how many records use it, does it appear in any report or dashboard, is it referenced by any automation. Flag any object or field with zero records, never used in a report, and unreferenced by automations — these are candidates for retirement. Severity: medium. Action: retire or archive unused configuration to reduce system complexity.
• Check 2 — Automation Redundancy Audit: Extract all business processes, case management processes, workflows, and event handlers. Map each to the business function it serves. Identify: automations with overlapping trigger conditions that may conflict, automations that perform similar actions on the same object, automations with no successful executions in the last 90 days, automations with high error rates. Severity: high if conflicts are found (automations that fire simultaneously can create unpredictable results). Action: consolidate redundant automations, retire unused automations, fix conflicting automations.
• Check 3 — Page Layout Complexity Audit: Review section, detail, and page layouts for each object. For each layout, count: number of fields displayed, number of tabs, number of detail sections, number of embedded components. Flag layouts with more than 30 fields on a single page (users miss fields), more than 5 tabs (users stop navigating), or fields that are never populated (wasted space). Severity: medium. Action: redesign complex layouts — consolidate related fields, move infrequently used fields to secondary tabs, remove unused fields from layouts.
• Check 4 — Lookup and Relationship Integrity Audit: Extract all lookup fields. For each: verify the referenced object exists and is active, verify that at least 50% of records have a populated value (if significantly less, the lookup may not be needed), verify that populated values reference valid records (no broken references). Flag lookups to retired or inactive objects. Severity: high if broken references exist (they cause runtime errors). Action: fix broken lookups, remove unused lookups, validate lookup data integrity.
• Check 5 — User Access Configuration Audit: Verify that role structure matches current organizational structure (roles for departments or positions that no longer exist should be retired). Verify that data visibility rules produce correct results — test with sample users from each role. Verify that no user has more access than their role requires. Check for inactive users with active licenses. Severity: critical if access control is incorrect (data breach risk). Action: align roles with current organization, correct visibility rules, deactivate unused accounts, reclaim unused licenses.

Workflow Health — 3 Checks:

• Check 6 — Business Process Execution Audit: Extract execution history for all business processes (last 90 days). Calculate: success rate per process, error rate per process, average execution time, most common error types. Flag processes with error rate above 5%, processes that have not executed in 30+ days (inactive or broken trigger), and processes with average execution time above 30 seconds (performance concern). Severity: high if critical business processes have errors. Action: fix error-causing conditions, improve error handling, retire inactive processes.
• Check 7 — Scheduled Process Audit: Verify all scheduled processes. For each: confirm it ran on its last scheduled execution, confirm it completed successfully, verify its schedule is still appropriate (some processes are scheduled for times that made sense at go-live but no longer do). Flag any scheduled process that missed its last execution or completed with errors. Severity: high — scheduled process failures are silent (nobody notices until the data is wrong). Action: fix failed scheduled processes, implement monitoring and alerting for scheduled process failures.
• Check 8 — Case Management Process Audit: For each active case management process, verify that case stages are being used as designed — are cases progressing through stages at expected rates, are cases getting stuck in specific stages, are stage transitions happening within SLA targets. Flag any case type with a backlog of cases in a specific stage (process bottleneck) or a high rate of manual stage changes (users bypassing the process). Severity: medium. Action: investigate and resolve bottlenecks, improve process design if users are bypassing it.

Security Health — 4 Checks:

• Check 9 — User Authentication Audit: Verify that all active users have authenticated in the last 90 days. Verify that multi-factor authentication is enforced for all users with access to sensitive data. Verify session timeout policy is configured. Flag inactive accounts, users without MFA (if required by policy), and excessively long session timeouts. Severity: critical if security policies are not enforced. Action: deactivate stale accounts, enforce MFA, configure appropriate session timeouts.
• Check 10 — Role and Permission Audit: For each role, verify that the permissions match the role's actual job requirements — users should have access to what they need for their work and nothing more. Test by logging in as a sample user from each role and verifying what they can see and do. Flag roles with excessive permissions, roles for organizational units that no longer exist, and permission configurations that grant access through unintended inheritance. Severity: critical if permissions are too broad. Action: tighten permissions to least-privilege principle, retire obsolete roles.
• Check 11 — Data Visibility Audit: Verify that organizational structure settings correctly limit data visibility. Test by logging in as users from different organizational units and verifying they can see their own team's data and cannot see data from teams they should not have access to. Flag any visibility configuration that allows cross-team access that should be restricted. Severity: critical — incorrect visibility exposes sensitive data. Action: correct organizational structure and visibility rules.
• Check 12 — Audit Logging Configuration: Verify that audit logging is enabled for: configuration changes (who changed what and when), access to sensitive records (who viewed high-security data), user management changes (who created, modified, or deactivated users). Verify that audit logs are being retained for the required period per compliance policy. Flag disabled audit logging, insufficient log retention, or logs that are not being reviewed. Severity: high. Action: enable and configure audit logging per compliance requirements.

Adoption Health — 4 Checks:

• Check 13 — User Login Activity: For each licensed user, determine login frequency in the last 30 days, time since last login, and session duration. Flag users who have not logged in for 30+ days. Severity: high — inactive users represent wasted license cost and potential process bypass risk. Action: investigate reasons for inactivity, reassign licenses if appropriate.
• Check 14 — Activity Quality: For each department, review activity creation rates: how many leads, opportunities, activities, and cases are being created per user per week. Compare against expected rates based on process design. Flag departments with activity rates significantly below expectations. Severity: medium. Action: investigate — are users working outside the CRM, or is the expected activity rate unrealistic?
• Check 15 — Task Completion Rate: Extract all tasks created in the last 90 days. Calculate completion rate (completed tasks / total tasks). Identify users or teams with completion rates below 50%. Flag tasks that are past due by more than 30 days. Severity: medium — incomplete tasks mean work is not being tracked or followed up. Action: investigate why tasks are not being completed — too many tasks, irrelevant tasks, or users not using the task system.
• Check 16 — Process Adherence Audit: For three critical business processes per department, trace a sample of records through the process to verify they followed the defined workflow. Identify records that bypassed the process (e.g., opportunity closed without going through required stages). Flag significant process bypass rates. Severity: high — process bypass means the CRM is not enforcing business rules. Action: investigate root cause — is the process too rigid, are there legitimate exceptions, or is it a training issue?

Data Quality Health — 5 Checks:

• Check 17 — Completeness Audit: For critical fields per object, calculate the percentage of records with populated values. Flag fields with completeness below 80% on critical fields (e.g., contact email below 80%, opportunity close date below 90%). Severity: high if critical fields are incomplete — reports based on incomplete data are unreliable. Action: identify root cause of incomplete data, implement mandatory fields or data validation rules, run data completion campaigns.
• Check 18 — Duplicate Detection Audit: For accounts, contacts, and leads, run duplicate detection using realistic matching criteria. Calculate duplicate rate. Flag duplicate rates above 5%. Severity: high — duplicates fragment customer data and produce incorrect reports. Action: merge duplicates, implement duplicate prevention rules, review data entry and import processes.
• Check 19 — Picklist Consistency Audit: For each picklist field, compare actual values in records against defined picklist values. Flag picklist fields where more than 5% of records have values not in the picklist definition (indicates imports or API calls bypassing validation). Severity: medium. Action: add missing values to picklist (if legitimate), correct records with invalid values, enforce picklist validation on imports and API calls.
• Check 20 — Relationship Integrity Audit: Verify that all lookup and relationship fields contain valid references — no records referencing deleted parent records, no junction records with missing parent references. Flag any broken relationships. Severity: critical — broken relationships cause runtime errors and data corruption. Action: fix or delete orphaned records, implement cascade rules to prevent future orphans.
• Check 21 — Data Timeliness Audit: For key data points, measure the lag between when an event occurs and when it is recorded in Creatio. For example: a lead is created on the website at 10:00 AM — when was it created in Creatio? Identify processes with data entry lag of more than 24 hours. Severity: medium — stale data degrades reporting accuracy and customer response times. Action: automate data capture where possible, set timeliness SLAs for manual data entry.

Integration and Performance Health — 4 Checks:

• Check 22 — Integration Connectivity Audit: For each integration, verify: last successful execution, last error, error rate in the last 30 days, data throughput (is it keeping up with volume?). Flag integrations with errors in the last 24 hours or no successful execution in 7 days. Severity: critical — failed integrations silently corrupt data. Action: fix failed integrations, implement monitoring and alerting.
• Check 23 — API Usage and Rate Limit Audit: Review Creatio API usage in the last 30 days. Identify API calls approaching or exceeding rate limits. Flag any integration that is consuming a disproportionate share of API capacity. Severity: medium — rate limit exhaustion can cause system-wide degradation. Action: optimize high-volume API consumers, implement rate limit monitoring, request rate limit increases if justified.
• Check 24 — Page and Report Performance Audit: Measure page load times for the 10 most-used pages. Measure report generation times for the 5 most complex reports. Flag any page taking more than 5 seconds to load or any report taking more than 30 seconds to generate. Severity: medium — slow performance drives users away from the system. Action: optimize slow pages (reduce field count, optimize sections and details), optimize slow reports (add filters, pre-aggregate data, schedule during off-peak hours).
• Check 25 — System Performance and Health Monitoring Setup: Verify that performance monitoring is configured and generating alerts. Key metrics: page load times, API response times, database query performance, server resource utilization. Flag if monitoring is not configured — you cannot manage what you cannot measure. Severity: high — without monitoring, performance degradation is discovered by users, not by administrators. Action: configure performance monitoring, set up alerting thresholds, establish a monthly performance review process.