Most affiliate audits look at the same handful of things: how many partners are active, whether the creative is current, whether commission tiers still make sense. Useful, but surface-level. The audits that actually change a programme's numbers dig into two things that are easy to miss: whether the tracking can be trusted, and whether the partners getting paid are actually creating sales, not just claiming credit for ones that were already happening.
Start with tracking, because everything else depends on it
If tracking is broken, every other number in the audit is unreliable before you've even looked at it. This is where server-to-server tracking becomes the first thing worth checking.
Most affiliate tracking historically ran through a third-party cookie dropped in the customer's browser — set on click, checked again at purchase to attribute the sale. The problem is that browsers increasingly block or limit third-party cookies, and customers switch devices constantly between the click and the purchase, so a real, valid sale often goes untracked simply because the cookie never survived to see it.
Server-to-server (S2S) tracking works differently: instead of relying on the customer's browser to hold onto that cookie, the sale confirmation is sent directly between the merchant's server and the affiliate network's server. No cookie in the middle to get blocked, cleared, or lost across devices. Programmes that have made this switch report attributing 18 to 24% more conversions than programmes still relying on cookies alone — which usually isn't new sales appearing, it's sales that were happening all along finally getting counted, and finally getting attributed to the partner who deserves credit.
Why cross-device attribution trips up most programmes
Fifty-nine percent of brands say cross-device attribution is a genuine challenge in evaluating their affiliate campaigns — and it's easy to see why once you picture how people actually shop.
Someone scrolls a creator's post on their phone during their commute, taps the affiliate link, browses the product, then closes the tab without buying. That evening, they open their laptop, search the brand name directly, and complete the purchase. To the affiliate's cookie, that customer vanished — the phone click and the laptop purchase look like two unrelated events, so the affiliate gets no credit for the sale it clearly influenced. Multiply that across a programme's entire partner base and a meaningful share of real, affiliate-driven revenue simply never shows up as affiliate-driven at all.
This isn't a small edge case — it's closer to the default shopping pattern now. An audit that doesn't check whether the programme's tracking can follow a customer across devices is auditing an incomplete picture of what the channel is actually doing.
The real issue: incrementality
This is the one that gets overlooked most often, and it's the one that matters most.
A conversion is incremental when the affiliate genuinely caused it — the partner's content, recommendation, or promotion is what got that customer to buy, and without that touchpoint, the sale likely wouldn't have happened. A conversion is non-incremental when the customer was already going to buy anyway, and the affiliate simply happened to be the last thing they clicked before checking out — commonly a coupon site or cashback partner catching someone who had already decided, at the exact moment they were about to purchase regardless.
The distinction matters because last-click attribution, the default model most programmes still run on, can't tell the difference. It gives full credit to whichever partner touched the sale last, whether that partner created the demand or just intercepted it seconds before checkout. The result is a programme that looks, on paper, like a huge percentage of revenue is being driven by a handful of coupon and loyalty partners — when in reality, much of that spend is just paying commission on sales that would have happened for free.
This is why a proper audit typically uncovers 15 to 20% of commission spend that's effectively wasted — cookie-stuffing, unauthorized brand-term bidding, and this kind of coupon-site leakage, once someone actually goes looking for it. And it compounds: affiliate marketing now drives roughly 10% of ecommerce sales globally, so a programme running on flawed incrementality assumptions isn't leaking a small amount at the margins, it's misallocating a meaningful share of a genuinely large budget.
What a proper audit actually checks
- Tracking infrastructure — is it server-side, and does it hold up across devices, or does it quietly drop real conversions
- Incrementality — which partners are creating new demand versus intercepting existing demand at the last click
- Fraud exposure — cookie-stuffing, unauthorized bidding on brand terms, fabricated traffic
- Commission structure — are payout tiers still matched to the actual value each partner type brings
- Partner quality over partner count — a smaller roster of the right partners consistently outperforms a large roster of the wrong ones
Most of this doesn't show up in a standard partner-and-creative review. It only shows up when someone is specifically looking for it.
Why this matters either way
Whether this sits with an in-house team or an agency managing it, the difference is the same: a review that reads as a checklist exercise, versus one that hands over a real number — this is what we found, this is what it's costing, here's the fix. That's a very different conversation to walk into.
Where your own setup currently stands on tracking and incrementality is worth a direct look — that's exactly the kind of thing we'd get into together.
Want to talk through how this applies to your own programme?
Start a conversation →