Customer.io audit: what a consultant should find in the first week

In 1902 Congress gave Harvey Washington Wiley, chief chemist at the US Department of Agriculture, $5,000 to test food preservatives on human volunteers (Wikipedia). He chose 12 young men from hundreds of applicants and fed them three meals a day. For half of them the meals came with preservatives, starting with borax. The newspapers called them the Poison Squad, and fully half of the diners dropped out ill before the fifth round of borax (Science History Institute).

Food at the time sold on its label. "Label after label touted purity, quality, and freshness, but none listed a single ingredient" (American Heritage). Wiley tested what was inside instead, and his first aim was simply to get foods labelled with their additives (Wikipedia). The trials drew national attention to the need for a federal food law, and the Pure Food and Drug Act passed in 1906 (Science History Institute).

A Customer.io workspace is full of labels: an automation called Cart recovery, a segment called Active customers, a goal called Purchased. An audit applies Wiley's method to them: ignore the label and test what is inside.

TL;DR: A Customer.io audit worth paying for is a ranked list of findings, not a slide deck of best practice. Each finding names the screen where it shows up, how many people it touches and what it costs a month. The first week covers 10 checks in priority order, starting with messages that never send (automations queue drafts by default) and triggers that read Apple's machine opens as engagement. Leaking exits, Wait Until blocks with no way out and conversions counted in every automation that shares a goal are the next three checks. Size every finding as arithmetic on your own numbers, never a borrowed benchmark. And on an established workspace, buy a fixed-scope audit before you sign any retainer: the findings list is the retainer's scope, and it proves the consultant can read your workspace rather than recite the docs.

What should a Customer.io audit deliver?

One table, ranked by cost, with a row per finding:

Column	What goes in it
Finding	What is broken, in one plain sentence
Where it shows up	The automation, segment or settings screen
People affected	A count from your workspace, per month
Monthly cost	Arithmetic on stated assumptions, or "risk"
Fix effort	Minutes, hours or a project

A deck that says consider a preference centre describes best practice. It does not tell you which automation is leaking money this month.

The ranking matters more than the count. Dozens of findings in alphabetical order hand the prioritisation back to you. Rank by monthly cost, then by confidence in the number, then by effort. That ranked table is what email marketing consulting should hand you, whoever does it.

Why one week, with a fixed scope?

Everything below can be found with read access in five working days. Day one is the inventory: every live automation, its trigger, its exits, its goal. Days two to four run the checks. Day five ranks and sizes the findings.

A fixed scope keeps both sides honest. You know what you are paying for, and the consultant commits to findings rather than hours. If the list is thin, you have learnt something about the consultant for the price of a week.

The 10 checks, in priority order

The order follows money at risk. Messages that never send cost most, because the automation looks live and nobody checks it. Deliverability sits lower only because someone usually watches it already; if nobody does, move it to the top.

1. Messages that never send

Where: each message block's Settings, under sending behaviour.

Customer.io queues automation messages as drafts by default. In the docs' words, "we queue drafts by default" (automation settings). A message nobody switched to send automatically sits in drafts while the automation shows people moving through it.

The troubleshooting page lists the other silent stops. A ticked holdout test means nobody gets the message. An action condition skips people who do not match. A message limit marks the send Undeliverable. A suppressed address gets no email.

To find them, compare each message's sent count with the journeys that reached it.

2. Triggers built on machine opens

Where: segment conditions, filters and branches that use "opened".

Apple's Protect Mail Activity downloads remote content "in the background when a message is received" (Apple). The option can be switched off, but every Apple Mail user who leaves it on looks like an opener.

Customer.io's Human opened metric, for emails opened since 20 March 2025, excludes Apple's Mail Privacy Protection, Gmail's image prefetching, bots and scanners (metrics overview). The catch: Apple Mail opens count as non-human unless the person clicks, so human opens run low. Segment conditions can target human-only activity (data-driven segments).

It gets expensive in a win-back that excludes anyone who opened recently. Machine opens keep Apple Mail users out of it for ever, which is one of the ways Apple MPP breaks Customer.io triggers.

3. Exit conditions that leak

Where: the workflow menu, Exit conditions.

By default "a person continues through an automation until they stop matching the automation's trigger or filter conditions" (exit conditions). If the trigger is an event, buying does not stop anyone matching it, so the buyer keeps getting cart emails.

On 8 July 2026 Customer.io decoupled exit conditions from conversion criteria (flexible exit conditions release note). Older automations that exit on conversion run as before. The buried constraint: change the conversion criteria on one of those while it runs, and its exit conditions do not change. Someone fixed the goal; the exit still points at the old one.

Every automation with a purchase goal should exit on the same event, in the same case. The exit conditions audit has the walkthrough.

4. Wait Until blocks with no way out

Where: every Wait Until in a live automation.

Without a Max time, people can get "stuck waiting in your automation forever" (Wait Until). The same page holds three more traps:

• An Event time path whose timestamp is missing or malformed "won't do anything". With no other path, the person waits indefinitely.
• People who were never in a segment skip a "not in segment" wait.
• People who already meet a condition skip the wait, so a late sign-up gets the confirmation and the reminder close together.

Since 26 August 2026 one Wait Until can chain delays in a Delay path and group conditions with And and Or (Wait Until delay paths release note). Old stacks of delay blocks are worth rebuilding, but the forever-wait is the finding to size. See the Wait Until chain audit.

5. Conversions counted in every automation

Where: each automation's Goal.

Customer.io counts automation conversions "independently for each automation" (goals and conversion criteria). Put a purchase goal on the welcome, cart and browse flows, and one order from someone in all three records three conversions. Add the reports up and email earned more than you took.

The same page has two more findings in it. Event names in conversion criteria are case sensitive, so a goal on Purchase never matches purchase. And edits to the criteria are not retroactive.

The workspace Goals feature counts unique people and credits the last message from a source, so it does not double count. It tracks data only since November 2025, and workspaces that never used it do not see the page. Details in the goals vs conversion events trap.

6. Subscription and suppression gaps

Where: Workspace Settings, the subscription centre and Workspace Suppressions.

Topic and channel preferences live in cio_subscription_preferences, and Customer.io "only checks them while your subscription center is enabled" (consent and subscriptions). A workspace that backfilled preferences but never enabled the centre is ignoring them.

Two defaults on the subscription centre page catch teams out. A new topic is opt-out, so it sends to everyone not globally unsubscribed. And preferences "do not filter customers out of automations or broadcasts": people enter journeys, they just do not get the messages.

Suppression works alike. An ESP-suppressed person "can still receive messages on other channels and enter automations" (workspace suppressions). The usual finding is an SMS step reaching people who complained about the email.

7. Frequency limits nobody assigned

Where: Workspace Settings, Message frequency limits, then each automation's Message settings.

A limit in settings does nothing alone: "By default, no workflow counts towards a limit" (message frequency limits). Check that the limit exists and that the right workflows use it.

A blocked message is Undeliverable unless a retry window is on. Windows run up to 48 hours, and limit time frames up to 31 days (set up message limits).

Do not confuse this with the per-automation rate limit, which caps speed at 1 to 60,000 messages per minute per channel. A rate-limited person carries on in the workflow unless the message waits before continuing (automation settings).

8. Dead segments

Where: the Segments page, Usage column.

Two kinds of dead segment exist, and only one cleans itself up.

The first is unused. Auto-archive, released on 30 June 2026 (auto-archive release note), sweeps data-driven segments untouched for 3, 6, 9 or 12 months (segments). It is off by default, skips manual segments and never archives a segment another segment references, so auto-archiving segments is worth setting up before the audit, not instead of it.

The second is expensive: a segment that triggers a live automation but matches nobody, because the attribute it tests stopped arriving. Auto-archive never touches it, since it is in use. The check is a membership count over time for every segment a live automation depends on.

9. Deliverability basics

Where: sending domains, the Deliverability report and Google Postmaster Tools.

Gmail requires senders of more than 5,000 messages a day to set up DMARC and one-click unsubscribe, starting 1 February 2024. Google asks for spam rates below 0.10% and never to reach 0.30% (Google). Customer.io's minimum DMARC record is v=DMARC1; p=none (domain authentication).

Customer.io's deliverability report is a Premium and Enterprise feature. It colours each provider against these thresholds:

Metric	Good	Red: at-risk
Delivery	≥ 98%	< 95%
Bounce	≤ 1%	> 5%
Spam	< 0.05%	> 0.1%

What the report cannot show is Gmail: Google does not send spam complaints to Customer.io (Google Postmaster Tools). Without Postmaster Tools, nobody watches Gmail's spam rate.

10. What the workspace already tells you

Where: Workspace performance, and the Design Studio Review panel.

The Workspace Performance dashboard suggests archiving unused segments and reviewing automations with no recent sends (Workspace Performance dashboard docs). That is a free first pass at checks 1 and 8. Our Workspace Performance dashboard guide explains each tab.

The Review panel gives each Design Studio email a 0 to 100 readiness score and flags a missing unsubscribe link as an error (review panel). Running every live email through it takes an afternoon; see the readiness score.

How do you size what each finding costs?

With one formula and your own numbers: people affected per month, times the conversion the step normally achieves, times the value of a conversion. Never with an industry benchmark, which describes someone else's workspace.

Here it is on one made-up workspace. Every figure below is an assumption, or arithmetic on assumptions:

Finding	People a month	Lost conversion	Value each	Monthly cost
Cart emails 2 and 3 queued as drafts	1,500	2%	£80	£2,400
Win-back excludes machine openers	900	3%	£80	£2,160
Onboarding Wait Until with no Max time	400	5%	£80	£1,600

On those assumptions the three cost £6,160 a month, or £73,920 a year. Change an input and the order can change too. If 1,200 people a month reach the cart emails instead of 1,500, that row falls to £1,920 and drops below the win-back. That is the point: the ranking depends on the inputs, so size each finding with your own numbers, and anyone can check the order by checking the arithmetic.

Some findings are not revenue. Double-counted conversions cost decisions, because the report overstates what email earns. A missing Postmaster Tools account is a risk. Mark those rows "risk", rank them by judgement, and keep them in the same table.

When is an audit the wrong purchase?

When there is little to audit. With fewer than five live automations, spend the money building the next one properly. If data is not arriving reliably, the problem is implementation, and our implementation cost guide is the better start.

It is also wrong when you already know the fix. If your cart flow exits on the wrong event, pay someone to fix it, not to tell you.

It is right when the workspace has outgrown anyone's memory of it: several authors, automations nobody owns, two workspaces doing one job. Kip had that shape when we consolidated its two Customer.io workspaces, holding 200,000+ profiles and 80+ live campaigns. The case study lists inconsistent naming and limited segmentation among the problems (Kip case study), problems an audit surfaces before anyone moves a campaign.

Why buy the audit before the retainer?

Because the findings list is the retainer's scope. Without it, a retainer opens with weeks of discovery at retainer rates, and you cannot tell whether month one went on your biggest problem.

The audit is also the cheapest test of a consultant you will get. Anyone can describe best practice; only someone who has read your workspace can name the automation losing you money. If you are still choosing who to hire, compare agency, freelancer and in-house.

Want a ranked findings list for your workspace? Send us a short note about what you run in Customer.io.

FAQ

What does a Customer.io audit include?

A Customer.io audit should include a ranked table of findings, each with its screen, the people affected and a monthly cost. The checks cover sending behaviour, open-based triggers, exits, Wait Until blocks, goals, subscriptions, suppressions, frequency limits, segments and deliverability.

How long does a Customer.io audit take?

A focused audit of an established workspace fits in one working week with read access. Day one is the inventory, three days run the checks, and the last day ranks and sizes the findings.

Should I hire a Customer.io consultant for an audit or a retainer first?

Hire for a fixed-scope audit first. Its findings become the retainer's scope, and it shows whether the consultant can find problems in your workspace before you commit to monthly fees.

Why are my Customer.io automation messages not sending?

Check the sending behaviour first: automation messages queue as drafts by default. Holdout tests, action conditions, message limits and suppressed addresses also stop sends.

Does Customer.io double count conversions across automations?

Yes, automation conversions are counted independently for each automation. If two automations share a goal, one purchase records a conversion in each, so summed reports overstate revenue.

Do unsubscribed people still enter Customer.io automations?

Yes, unsubscribed people can still trigger and enter automations. They do not receive email, SMS or push messages, but other workflow actions still run for them.

Does Customer.io archive unused segments automatically?

Only if you turn auto-archive on, because it is off by default. It then archives unused data-driven segments left unedited for 3, 6, 9 or 12 months, never manual segments.

Sources

• Customer.io, Automation exit conditions, updated 14 September 2026.
• Customer.io, Set your own exit conditions, 8 July 2026.
• Customer.io, Wait until.
• Customer.io, Chain multiple delays in a Wait Until block, 26 August 2026.
• Customer.io, Automatically clean up stale segments, 30 June 2026.
• Customer.io, How segments work.
• Customer.io, Goals and conversion criteria.
• Customer.io, Goals.
• Customer.io, Data-driven segments.
• Customer.io, Metrics overview.
• Customer.io, Email deliverability metrics.
• Customer.io, Message frequency limits.
• Customer.io, Set up message frequency limits.
• Customer.io, Automation concepts and settings.
• Customer.io, Why aren't people receiving my message?, updated 14 September 2026.
• Customer.io, Consent and subscriptions.
• Customer.io, Subscription centre.
• Customer.io, Workspace suppressions, updated 18 September 2026.
• Customer.io, Domain authentication.
• Customer.io, Google Postmaster Tools.
• Customer.io, Workspace performance dashboard, updated 29 September 2026.
• Customer.io, Review your email, updated 5 October 2026.
• Google, Email sender guidelines.
• Apple, Change Privacy settings in Mail on Mac.
• Science History Institute, Harvey Wiley's Fierce Pursuit of Food Safety.
• Wikipedia, Harvey Washington Wiley.
• American Heritage, Saved by The Poison Squad, November/December 2024.
• NerveCentral, Kip case study.