The short version

A zero-budget audit is credible if it holds three things constant: the prompt list, the number of runs per prompt, and the session state. Without those you are measuring randomness.

Everything else about an audit is convenience. Those three are what make the result something you can compare to itself next quarter, which is the only property that matters.

You do not need a tool to run a defensible first audit. You need a spreadsheet, an afternoon, and the discipline to not change anything halfway through. What makes a paid audit credible is not the software, it is holding the experiment still, and you can do that for free.

What makes an audit credible?

Three constants. Break any one and the numbers stop being comparable, including to your own numbers from last month.

Constant 1

The prompt listWritten before you see any results, and frozen for at least a quarter

Constant 2

Runs per promptThe same number every time, on every engine. Three is the floor

Constant 3

Session stateFresh, memoryless, logged out. Every run, without exception

The third one is the one people lose. It is easy to run twenty prompts carefully and then run the twenty-first in your own account because the temporary window timed out, and that single row quietly contaminates the set.

How do you build the prompt list?

Badly-built prompt lists are the most common reason a free audit produces nothing useful. Two rules cover most of it.

Useless prompt “Is [your company] good?”

Contains your name, so the engine is describing a company you named rather than choosing one. It tests nothing about visibility.

Useful prompt “Best [category] tool for a 12-person agency?”

Unbranded, specific about the buyer, and phrased the way somebody asks before they know the vendors. This is the question you are actually competing in.

If your brand name appears in a prompt, that prompt is not measuring visibility. Keep a couple of branded prompts to check accuracy, but count them separately.

Ask somebody who bought recently how they searched, and use their words rather than your category page’s words. Ten to twenty prompts is enough for a first pass, and fewer well-chosen prompts beat more written in your own vocabulary.

What does the audit actually look like?

The five steps, in order

Freeze the list

Write the prompts in a sheet and stop editing them. Number them, because you will need to refer to them by ID for the rest of the programme’s life.

Editing the list mid-audit is the single most destructive thing you can do here.

Pick engines and a run count

Three engines minimum, because they use different retrieval. Three runs per prompt per engine, so a single unlucky sample cannot set your strategy.

Write the run count down. It is the denominator of every number you will report.

Run them in clean sessions

Temporary chat or a private window, memory off, no pasting between runs. Reset between engines as well as between prompts.

A contaminated session produces a flattering result you cannot reproduce.

Record the full text

One row per run. Every brand named, the order they appeared in, every URL cited, and the complete answer.

A tally cannot answer a question you think of in November. The text can.

Compute rates, not verdicts

Mention rate, citation rate, and how often you appear when the question is a buying question. Three fractions with the same denominator.

A rate can be compared next quarter. A screenshot cannot.

Roughly two hours for ten prompts across three engines. The recording is most of the time, and it is the part that pays back.

audit.csvOne row per run

date,engine,prompt_id,run_no,we_named,name_order,brands_named,cited_domains,answer_text
2026-08-19,chatgpt,Q1,1,yes,3,"You;Vendor A;Vendor B","g2.com;vendora.com",""
2026-08-19,chatgpt,Q1,2,no,,"Vendor A;Vendor C","vendora.com;blog.example",""
2026-08-19,chatgpt,Q1,3,yes,1,"You;Vendor A","yoursite.com;g2.com",""

Nine columns, and only one of them is hard to fill in. Paste the answer text even when it feels excessive, because it is the column that stops being replaceable the moment the session closes.

What goes wrong most often?

Four mistakes account for nearly every unusable first audit, and all four are free to avoid.

The four that ruin an audit

Editing the prompt list Adding prompts because you are losing on the current ones. The new denominator cannot be compared to the old one, so the series restarts from zero. Unrecoverable

One run per prompt Answers vary between identical runs, so a single sample is a coin flip reported as a finding. Unrecoverable

Logged-in sessions Memory and history shape the answer. You end up measuring your own past conversations rather than what a stranger sees. Unrecoverable

Recording verdicts only A column of yes and no cannot answer a question you think of in November. Fixable only by running everything again. Expensive

Three of the four cannot be repaired after the fact. Once a constant has moved, the earlier data is simply not comparable to the later data.

There is a fifth, subtler one: fixing something mid-audit. If you unblock a crawler on day two, the days either side are measuring different sites. OpenAI notes that a robots.txt change can take around 24 hours to register, so finish the baseline first and make changes afterwards, deliberately, with the date written down.

What do you do with the result?

Three fractions, and then a decision about which problem you have.

Mention rate

Runs where you were named, over total runs. The headline number.

Citation rate

Runs citing your domain, over total runs. Always lower, and the gap is diagnostic.

Competitor frequency

Which brands appear most across the set. Your real competitive set, as the engines see it.

The third one is usually the surprise. The companies engines name alongside you are frequently not the ones on your battlecards.

From there the reading is the same as the four-cause diagnostic: absent everywhere points at entity or access, present-but-never-listed points at evidence, and listed-but-wrong points at a stale source. If the answer is evidence, the recommendation-list problem covers what to do about it.

What are the limits of doing this by hand?

Worth stating plainly, because a free audit that oversells itself is worse than none.

A hand audit gives you A defensible baseline and a direction

Enough to know which problem you have, enough to argue for a budget, and enough to compare against in three months if you keep the constants.

It cannot give you A volatility band

Knowing how much your numbers move on their own needs daily sampling over weeks. Without it, you cannot tell a real improvement from ordinary variance.

That gap is the honest reason to automate eventually. Not the dashboards, and not the alerts. The band.

Should you check crawler access first?

Yes, before you run a single prompt, because an audit of a site the answer crawlers cannot fetch is measuring the wrong thing entirely.

Open your robots.txt and read it rather than assuming. The distinction that matters is between the crawler feeding an assistant’s answer index and the crawler collecting training data: OpenAI states those settings are independent of each other, and Perplexity documents the same split. A broad rule written to opt out of training can also be removing you from the answers, which would make your baseline a measurement of your own configuration.

Two more things are worth knowing while you are in the file. RFC 9309 specifies that the most specific matching rule wins and that an allow beats an equivalent disallow, which is the reverse of what most people assume. And robots.txt is not a hiding mechanism at all: Google states it “is not a mechanism for keeping a web page out of Google”, because a disallowed page can still be indexed when other sites link to it.

Do the free version first anyway. A quarter of hand-run data with the constants held is worth more than an expensive tool pointed at a prompt list nobody thought about, and it tells you what to buy if you decide to buy anything.