Audit your Salesforce org in a day. Without the consultant.
90 weighted checks, a scanner that runs a third of them for you, a scoring workbook, and the fixes that work. The method we use on paid audits, packaged for admins.
Get the kit for $199Instant download. Use it on every org you manage. 14-day refund if it isn't useful.
What's in the kit
Four files. Everything reads from the same list of 90 checks, so the playbook, the scanner, and the scorecard agree with each other.
Salesforce-Org-Audit-Playbook.pdfThe 90 checks, with why, how, and fix. 25 pages. Each check has the Setup path or the exact SOQL query to run, the reason it matters (for when someone asks), and the fix. Plus the ten remediation patterns that come up in nearly every audit, step by step, and a two-page guide to presenting findings to leadership.
scanner/scan.mjsThe metadata scanner. One Node script, no install, never connects to your org. Point it at a metadata retrieve and it evaluates about a third of the checks with item-level findings: which profiles, which flows, which lines of Apex. Outputs an HTML report and JSON.
Salesforce-Org-Audit-Scorecard.xlsxThe scoring workbook. Mark each check Pass, Fail, Partial, or N/A. It scores by area and overall (Critical checks weigh 5, Important 3, Hygiene 1), ranks a Fix-First plan automatically, and gives you a 30-60-90 tab to plan the cleanup.
Executive-Summary-Template.docxThe two-page summary for your boss. Score, three risks with consequences, what's working, the plan, and what you need from them.
Eight areas, 90 checks, 284 points
Weighted so a security hole counts more than a missing help text. Scored the same way we score orgs on a paid engagement.
Scanner coverage is the share of checks the script evaluates from metadata alone. The rest need org data or a human, and the playbook tells you exactly how to check each one.
| Area | Checks | Critical | Scanner |
|---|---|---|---|
| Security & Access | 14 | 5 | 5 |
| Data Model | 12 | 1 | 11 |
| Automation | 13 | 4 | 10 |
| Apex & Code | 14 | 5 | 12 |
| Integrations & API | 8 | 1 | 1 |
| Data Quality | 10 | 2 | 0 |
| Reporting & Adoption | 9 | 1 | 0 |
| Release & Governance | 10 | 1 | 1 |
How the day goes
About six focused hours for a typical org. The order matters: the scanner first, so you spend your time on judgment calls, not counting fields.
- Retrieve
Two Salesforce CLI commands pull your classes, flows, objects, and profiles to a folder. Nothing changes in the org. 20 minutes.
- Scan
Run the script. Open the report. Transfer the pass, review, and fail results into the scorecard. 15 minutes.
- Check
Work the manual checks area by area. Most are a Setup page or one query from the playbook. Paste the counts into the notes; that's your evidence. 4 hours.
- Plan and present
Read the score. Take the top ten from the Fix-First tab, assign owners, fill the two-page summary. 1 hour.
Things it finds that nobody notices for years
From real audits. Every one of these has a check, a query, and a fix in the kit.
Granted during a 2021 data migration, never removed. Forty users could delete the pipeline.
Firing in undefined order. The "random" stage reverts were not random.
Her password expired on a Friday. The ERP sync stopped for three days.
Fine for one quote. The 400-line bulk import hit the governor limit and failed every time.
Three sources of truth. Marketing dialed the wrong one for a year.
Every sandbox refresh broke it. Every deployment "fixed" it by hand.
The ten that run the business were impossible to find.
$68,000 a year. The audit paid for itself 300 times over in the first hour.
This is for you if
- You're the Salesforce admin, RevOps lead, or IT owner, and you inherited an org you don't fully trust.
- You need to show leadership what's wrong, with numbers, before asking for time or budget.
- You're a consultant or fractional admin and want a repeatable audit you can run for every client.
- You're about to start an AI, CPQ, or re-implementation project and want to know what you're building on.
This is not for you if
- You want someone else to do the work. The kit gives you the method and the tools; you still spend the day. (We do run full audits as a service; see below.)
- Your org is under a year old with one admin and no custom code. Run the free Org Health Scorecard instead.
- You can't run a command-line tool or get someone who can. The scanner needs the Salesforce CLI and Node.js.
- Playbook (PDF), scanner, scoring workbook, executive summary template
- Use on every org you manage, including client orgs
- Instant download after checkout
- Free updates to Edition 1 fixes
- 14-day refund, no questions asked
Secure checkout by Stripe. Card or Link. You'll land on the download page right after paying, and get a receipt by email. The charge shows as Free Thinkers Consulting LLC.
Questions
Does the scanner connect to my org or send data anywhere?
No. It reads a folder of metadata on your machine and writes two files next to it. There is no network call in the script; it's 900 lines of plain JavaScript you can read. You retrieve the metadata yourself with the Salesforce CLI.
What do I need to run it?
Node.js 18 or newer and the Salesforce CLI, both free. The README walks through the two retrieve commands. If you've never used a terminal, budget an extra hour the first time or ask a developer to run step one for you; everything after that is Setup pages, SOQL, and a spreadsheet.
Is this the same as Salesforce Optimizer or Health Check?
Those are good and free, and the kit tells you to run both (checks GOV-08 and GOV-09). They cover a slice of security settings and some unused metadata. They don't look at your flow architecture, trigger patterns, Apex security, integration design, data quality, adoption, or governance, and they don't give you a weighted score, a ranked plan, or a way to present it.
How is this different from your paid Salesforce Audit?
Same checklist. On a paid audit a senior architect does the work, reads your code by hand, interviews your team, writes the findings, and walks you through them. The kit gives you the architect's checklist and tools so you can do it yourself. If you run the kit and want a second set of eyes on the result, we'll credit the kit price toward a full audit.
Can I use it for clients?
Yes. The license covers orgs you manage or audit on behalf of your own clients. You can't resell or redistribute the kit itself.
Will the checks go out of date?
The fundamentals (one trigger per object, no DML in loops, no Modify All Data for sales) have been true for a decade. Where Salesforce changes things (Workflow Rules and Process Builder retirement, MFA enforcement), the checks reflect the current state as of October 2026. Edition 1 fixes are free; a future Edition 2 will be a separate purchase.
What if it isn't useful?
Email hey@freethinkersconsulting.com within 14 days and we'll refund you.
Who made this
Free Thinkers Consulting is a Salesforce Partner that builds and fixes custom Salesforce systems for companies like BlueScope, United Fire Group, FairSquare, and GLS. Every engagement is led by a senior architect. The audit checklist in this kit is the one we use when a new client asks "how bad is it?"
We packaged it because most orgs we see would have caught their own problems years earlier with a list and a method. Now you have both.
freethinkersconsulting.com · The full Salesforce Audit service · Free 3-minute Org Health Scorecard
"I've worked with many consultants, but Free Thinkers is easily one of my favorites to work with."Salesforce Manager, United Fire Group