The AEO Audit Checklist I Run Before Touching a Client Domain

An AEO audit checklist is the sequence I run before recommending visibility work on a client domain: freeze the prompt panel, baseline what AI already says, inspect entities and machine-readable facts, score citeable content, map citation gaps, and only then write a roadmap. Skipping straight to “write more blogs” is how budgets burn.

This spoke is the field sheet behind the Answer Engine Optimization playbook. The outcome definition — inclusion in the answer, not a blue-link rank — lives in What is AI visibility. I have been SEO certified since 2021. The AEO version of that work is still a checklist you can mark pass / fail / n/a, not a vibe.

The short answer

• Do not change the domain until a frozen prompt panel and a dated answer log exist
• Five scores, not one: entities, truth layer, content, corroboration, measurement
• Tools (Semrush, Surfer) speed discovery. They do not replace the panel or the fact sheet
• The deliverable is a ranked 30 / 60 / 90 plan with explicit non-goals
• A failed checkbox becomes a ticket with a line ID. A PDF without tickets is a diary

What is an AEO audit — and what is it not?

This is an operator checklist I run before I touch copy, schema, or llms.txt. It answers three questions: what do answer engines already say, what on the site and the web contradicts that, and which ten tickets unblock the rest.

This audit is	This audit is not
A dated baseline on a frozen prompt panel	A one-afternoon “AEO score” from a dashboard
A fact-conflict hunt across site, schema, and directories	A full backlink detox
A citeability pass on the pages buyers actually ask about	A rewrite of the entire blog
A ranked 30-day truth-layer plan	A paid-media or hreflang program
A measurement ritual with a named owner	A tool-stack shopping list

If a vendor “finishes AEO” without a prompt panel, they finished a slide. Mark the job n/a until the panel exists.

What are the ten AEO audit steps in order?

Run them in this order. Later steps inherit the freeze from step 1. If you skip the baseline, every later “win” is unprovable.

#	Step	Pass looks like	Fail looks like
1	Scope	ICP paragraph, 3–6 competitors, 25–40 prompts, success definition	“We will figure out queries as we go”
2	Baseline answers	Dated log with mention / citation / accuracy per prompt	Screenshots in a Slack thread, no columns
3	Entity and brand facts	One fact sheet; conflicts listed with sources	About says 2017, Crunchbase says 2014, nobody owns the decision
4	On-site truth layer	llms.txt, Organization JSON-LD, About, and offer pages agree	Schema founding year ≠ visible copy
5	Content citeability	Definition, comparison, and method pages pass a 60-word lift	Thin posts that contradict each other
6	Corroboration and gaps	URL leaderboard of who AI actually cites	“We need more PR” with no cited-domain list
7	Local (if applicable)	NAP matrix matches GBP and LocalBusiness	Three addresses, one schema block
8	Technical fetchability	Key URLs 200, indexable, snippet-eligible	Accidental noindex on About
9	Measurement readiness	Named owner, KPI definitions, monthly stub	“We will check ChatGPT sometimes”
10	Roadmap	Top 5 risks, top 5 opportunities, 30 / 60 / 90, non-goals	A 40-ticket dump with no sequence

Google’s own AI-features guidance is blunt: to show as a supporting link in AI Overviews or AI Mode, a page must be indexed and eligible to appear in Search with a snippet (Google Search Central: AI features). Eligibility is not inclusion. The baseline tells you which of those eligible pages actually get named or cited.

How do I freeze a prompt panel before I fetch?

Scope is the cheapest step and the one people skip. If the competitor set moves mid-audit, share of voice is fiction. If the prompt list grows every time someone has a feeling, you will never close the log.

• Business model and ICP written in one paragraph
• Priority markets and languages listed
• Competitor set (3–6) frozen for this audit window
• Prompt panel drafted (25–40) across the five jobs below
• Success definition agreed in writing (example: citation rate on recommendation prompts, not “more AI traffic”)
• Out-of-scope queries parked (brand vanity, one-off exec asks)

Prompt job	Buyer is asking	Example shape	Why it belongs
Recommendation	Who should I hire / buy	“best [category] for [ICP]”	Revenue. This is the panel that funds the work
Comparison	How do these differ	“[you] vs [competitor]”	Surfaces fact conflicts and missing criteria pages
How-to / method	How is this done	“how to [job] without [failure]”	Tests whether your method pages are extractable
Brand	Who are you	“[brand] founding year” / “what does [brand] do”	Accuracy and identity. Wrong here is a risk, not a KPI miss
Local (if applicable)	Who is near me	“[service] near [city]”	GBP / NAP / LocalBusiness alignment

Semrush’s prompt-tracking guidance is the same idea with a vendor UI: load a set, then watch citation rate and competitor appearance on that set (Semrush: which AI search prompts to track). Freeze first. Tool second.

A 12-prompt “audit” is a sample. A 200-prompt dump is a stall. 25–40 is the range I can re-run monthly without the ritual dying.

Why baseline AI answers before I touch the CMS?

Run the panel before anyone edits a heading. The log is the only proof the later work moved anything.

• Run the panel in ChatGPT with search on, in a buyer-relevant mode
• Run the panel in Perplexity
• Sample Google AI Overviews (and AI Mode where the query triggers it) on the priority subset
• Log mention, citation, share-of-voice slice, and accuracy per row
• Archive the answer (screenshot or export) when the failure is load-bearing
• Record the date, product, and whether search / grounding was on

Column	What you write	Legal values
prompt_id	Stable ID (rec-04, brand-02)	string
product	ChatGPT / Perplexity / AI Overviews / AI Mode	enum
mentioned	Brand string in the answer	yes / no
cited	Your URL or clear source credit	yes / no + URL
competitors_named	Who else appeared	list
accuracy	Facts about you	pass / fail / n/a
failure_note	What was wrong, in one line	free text
archive	Link to screenshot or export	URL

ChatGPT answers that used search can show inline citations; if they do not, the Sources control under the response lists the links (OpenAI Help: ChatGPT Search). Log both. A mention without a source and a source without a name are different tickets.

Semrush splits the same three numbers I want on the sheet: a mention is the brand inside the answer, a citation is a linked reference to a URL, and share of voice is your slice versus the frozen set (Semrush: AI share of voice; Semrush: AI visibility metrics). One blended “visibility %” hides a mention-only win that never produces a click path.

Do not “fix” a wrong founding year in the CMS during this step. Write the fail. The entity section owns the reconciliation.

How do I audit entity and brand facts?

Answer engines collapse identity. If the site, LinkedIn, a directory, and schema disagree, the model will pick one and sound sure.

• Fact sheet extracted: legal name, public name, founded, HQ, offers, founder names
• Conflicts listed across site vs LinkedIn vs directories vs Crunchbase / Wikidata
• Name-collision check completed (other companies, people, products with the same string)
• Person entities (founders) spot-checked for title and sameAs consistency
• sameAs candidates inventoried — only URLs that actually identify this org
• Product and offer renames from the last three years listed with redirect status

Field	Site	Schema	LinkedIn	Directory / Wikidata	Decision
Public name					pick one string
Founded					pick one year
HQ / service area					pick one posture
Primary offer					pick one sentence
Founder title					pick one title

sameAs is a schema.org property: a URL that unambiguously indicates the item’s identity — Wikipedia, Wikidata, or the official site (schema.org/sameAs). Google’s Organization structured-data docs put sameAs on the homepage or About page to help disambiguate the org (Google Search Central: Organization). Do not point sameAs at a Facebook page you no longer own or a Crunchbase row for a different legal entity.

Sample findings language I actually use:

Brand query in Perplexity (dated) stated founding year 2014; About and schema state 2017; Crunchbase states 2014. Reconcile to 2017 across Crunchbase and the three directory pages in Appendix B before any content sprint.

Avoid: “Your entity architecture needs a complete transformation.” That sentence funds nothing.

What is the on-site truth layer in an AEO audit?

This is the machine-readable briefing. If it conflicts with the visible page, you trained the web to distrust you.

• /llms.txt exists, returns 200, reads as a briefing — not a sitemap dump
• Organization or LocalBusiness JSON-LD validates and matches visible facts
• Article / FAQ markup is honest where present (visible Q&A only)
• About page answers who / what / for whom in the first screen
• Primary offer and pricing posture pages are extractable (not a vibe paragraph)
• Old product names redirect or are explained on the current offer URL
• Docs or app subdomains included if those are the URLs AI already cites

Check	How I verify	Fail
llms.txt fetch	curl -I https://example.com/llms.txt	404, HTML wrapper, or a URL dump with no H1
Organization JSON-LD	View source + schema.org/Organization fields vs About	foundingDate ≠ About year
FAQ markup	Visible questions match FAQPage nodes	FAQ JSON-LD on a page with no questions
About first screen	60-word lift test	Hero slogan, no who / what / for whom
Offer page	Can a model quote price posture or package names	“Contact us for pricing” as the only sentence

Jeremy Howard’s /llms.txt proposal is a markdown file at the site root (or a subpath) that gives models a short briefing plus links to detailed pages (llmstxt.org). The only required element is an H1 with the project or site name. A file that is a second sitemap is a fail. A file that restates the fact sheet and points at About, offers, and the method pages is a pass.

Google recommends placing Organization structured data on the homepage or a single About URL, with no required properties — add the ones that are true (Google: Organization structured data). I still want name, url, logo, description, and a clean sameAs list. Extra types you cannot defend are noise.

FAQPage remains a valid schema.org type for a page that presents frequent questions (schema.org/FAQPage). Google’s FAQ rich-result feature no longer appears in Search as of 7 May 2026 (Google Search Central changelog, FAQ rich result). Keep honest Q&A in the HTML because models lift visible answers. Do not keep stuffed FAQ JSON-LD that the visitor cannot see.

How do I score content citeability?

I am not scoring “content quality.” I am scoring whether a model can lift a 60-word block that would still be true out of context.

• Definition page exists for the core category term
• Comparison or criteria page exists if buyers compare
• How-to / method pages use steps and tables, not a narrative mush
• Cluster map drafted: one pillar, the spokes that exist, the spokes that do not
• Top revenue or lead pages pass the 60-word quote test
• Surfer (or equivalent) used as a coverage aid — never as pass / fail religion
• Thin or contradictory posts flagged for merge or removal
• Dates on method pages are real (dateModified matches the last factual edit)

60-word quote test. Open the page. Copy the first answer block. Read it to someone who cannot see the H1. If they cannot tell what the page claims, the page is not citeable. Fix the lead. Do not add another H2.

Page type	Must exist when	Pass	Fail
Definition	You sell a named category	First 80 words answer the term	History of the industry
Comparison	Buyers shortlist 2–3 vendors	Criteria table, your row honest	Feature dump, no decision
Method	You claim a process	Numbered steps + failure mode	A process paragraph with no steps
Case / proof	You claim outcomes	Named constraint + what shipped	Adjective pile, no artifact
Pricing posture	Money changes hands	Range or package names extractable	“Let’s hop on a call” as the only fact

Google’s generative-AI guidance repeats the same technical floor: indexed, snippet-eligible, people-first pages — no special AI schema (Google: optimizing for generative AI features). Citeability is the editorial half of that floor.

How do I find corroboration and citation gaps?

On-site truth is necessary. It is not sufficient. If every cited URL on the recommendation prompts is a roundup you are absent from, the next ticket is not another blog post on your domain.

• URL leaderboard built from the baseline citations (not from a guessed PR list)
• Directory and roundup presence reviewed against the leaderboard
• High-value targets listed only when they already appear as sources
• Partner or customer write-ups on external domains noted
• Wrong or toxic mentions queued for cleanup with a source URL
• Semrush (or similar) used for competitor and SERP discovery around this step — not as the verdict

Leaderboard column	Source	Decision it supports
Cited domain	Baseline Sources / footnotes	Who the products already trust
Prompt IDs	Your log	Which jobs you lose
Your URL present	yes / no	Content vs corroboration ticket
Fact about you	accurate / wrong / absent	Cleanup vs creation
Owner	named person	Who writes the outreach or the page

A gap is “this prompt cites three domains and none of them is us, and the cited pages are extractable comparison tables.” A wish is “we should be in TechCrunch.” Write gaps. Park wishes.

When do local checks apply in an AEO audit?

Skip this section only when the brand has no service area, no storefront, and no Google Business Profile. If any of those exist, local is not optional.

• NAP matrix across the top listings (name, address, phone, URL)
• GBP categories and services match the site
• LocalBusiness (or a more specific subtype) matches GBP
• Service-area pages quality-reviewed — real pages, not city-name spam
• Local prompts included in the baseline panel
• Hours, service area, and “we serve X” copy agree across GBP, schema, and footer

Surface	Name	Address	Phone	URL	Hours	Notes
Site footer
Contact page
LocalBusiness JSON-LD
GBP
Top directory 1
Top directory 2

Google’s AI-features page explicitly tells you to keep Business Profile information up to date if you want those surfaces to stay coherent (Google: AI features and your website). A LocalBusiness block that invents a suite number the GBP does not have is a fail, even if the JSON-LD validates.

What technical fetchability checks belong in an AEO audit?

This is not a Lighthouse vanity hunt. It is a fetch-and-index check on the URLs the panel already cares about.

• Key pages return 200 and are indexable
• Canonical tags point at the URL you want cited
• Primary templates are not broken on mobile (usable, not 100)
• Sitemap includes the answer pages (About, offers, definitions, methods)
• No accidental noindex on About, offer, or definition URLs
• robots.txt does not block those paths for the crawlers you still want citing you
• Docs / app / marketplace hosts included if they appeared in the citation log
• Training-bot policy (example: Google-Extended) is an explicit decision, not an accident

Check	Command or tool	Pass	Fail
Status	curl -I on each key URL	200	3xx loops, 404, 401 on public pages
Indexability	robots meta / X-Robots-Tag	index, snippet-eligible	noindex or nosnippet on About
Canonical	<link rel="canonical">	self or intended	points at a campaign URL
Sitemap	/sitemap.xml	answer URLs present	blog only
robots.txt	/robots.txt	key paths allowed to Search crawlers	Disallow: / for Googlebot by mistake

A robots.txt file tells crawlers which URLs they may access. It is not a way to hide a page from Google Search; use noindex or authentication for that (Google: Introduction to robots.txt). I have watched teams “block AI” with a blanket Disallow and then wonder why AI Overviews stopped citing them.

Google-Extended is a standalone robots.txt product token for Gemini training and grounding uses. Google states it does not affect inclusion or ranking in Google Search (Google: common crawlers — Google-Extended). Write the policy down. Do not confuse a training opt-out with a citation opt-out.

How do I know AEO measurement is ready?

If nobody owns the log, the audit dies the week after the workshop.

• Logging template owned by a named person (and a backup)
• Analytics can show AI referrers where the product actually sends them
• Monthly reporting stub agreed: three numbers, not a 20-slide deck
• KPI definitions written: mention rate, citation rate, share of voice, accuracy fail count
• Re-run cadence set (weekly panel on a subset, monthly full panel)
• Search Console generative-AI inclusion confirmed if Google surfaces matter

KPI	Definition I use	Do not substitute
Mention rate	Prompts where the brand string appears ÷ panel size	Impressions
Citation rate	Prompts where your URL is credited ÷ panel size	“We got mentioned on LinkedIn”
Share of voice	Your mentions ÷ mentions across the frozen set	Category search volume
Accuracy fails	Rows with a wrong fact about you	Sentiment vibes

Semrush’s metric glossary matches those three columns: mentions, citations, and share of voice versus competitors (Semrush: AI visibility metrics). Use the vendor when it saves hours. Keep the sheet even if the vendor seat lapses.

Google’s AI-optimization guide points site owners at the Generative AI performance report in Search Console for those surfaces (Google: generative AI features). That report does not replace the ChatGPT / Perplexity panel. It is one product.

How do I score an AEO audit and timebox the roadmap?

The audit must produce a decision, not a tour.

• Top 5 risks (accuracy, collisions, legal, fetch blocks)
• Top 5 opportunities ranked by revenue × winnability
• 30 / 60 / 90 day plan with owners
• Explicit non-goals (what you will not do yet)
• Tooling notes: what Semrush / Surfer / the manual panel will cover
• Section scores 0–5 written with the rubric below

Section	0	3	5
Entities	Conflicting year / name in public sources	Fact sheet exists; 1–2 residual conflicts	One fact sheet, sameAs clean, collisions documented
Truth layer	No schema or llms.txt; About is a slogan	Partial JSON-LD; one conflict with visible copy	Fetchable briefing; schema matches About and offers
Content	No extractable definition or method page	Some pages pass the 60-word test	Cluster mapped; thin posts queued
Corroboration	No idea who AI cites	Leaderboard exists; no outreach started	Gaps ranked; owners assigned
Measurement	No log	Spreadsheet, no owner	Named owner, monthly stub, KPI definitions

Average the five into a headline index for executives if you must. Always show the five. A 5 on content and a 1 on entities is not “green.”

Suggested hours for a single-brand audit when the operator already knows AEO:

Block	Hours	Notes
Scope and panel	2–3	Longer if ICP is a fight
Baseline runs and logging	3–5	Multi-product, not one screenshot
Entities and profiles	2–3	Multiplies with collisions
Truth layer	2–3	Includes llms.txt and schema
Content citeability	3–4	Top pages, not the whole archive
Gaps and targets	2–3	From the leaderboard only
Local and technical	1–3	Skip local if truly n/a
Roadmap writeup	2–3	Includes scores and non-goals

Total often lands around 2 to 4 working days elapsed once access is granted. Multi-location multiplies local hours. Distrust anyone who “finishes AEO” in an afternoon without a prompt panel.

v1 non-goals I write down so nobody expects infinity:

• Full backlink detox (unless spam is extreme)
• Entire blog rewrite
• International hreflang programs
• Paid media audits

What evidence pack does a 90-minute AEO workshop need?

Missing access is the main cause of shallow audits. Ask before kickoff.

• Analytics access or exports
• GBP access or current screenshots
• CMS or repo access for schema and llms.txt
• Brand guidelines / press kit
• Top 20 landing pages by revenue or leads
• Known competitors (you will still freeze 3–6)
• Prior SEO audits (to avoid rework)
• Product renames in the last three years
• Docs / app / marketplace host list

Deliverable outline. Executive summary. KPI baseline tables. Critical accuracy issues. Section scores with the checklist as appendix. Opportunity backlog ranked. 30 / 60 / 90 plan. Resource ask. Appendix with a raw prompt-log sample. Keep the full raw log available but out of the main PDF. Executives need decisions. Operators need receipts.

Workshop agenda (90 minutes). Leave with yes / no on the 30-day plan.

Block	Minutes	Output
Baseline KPI screenshots	15	Shared view of mention / citation / accuracy
Top risks	15	The five that can wait vs the five that cannot
30-day truth-layer plan	20	Who edits schema, About, llms.txt
Cluster proposal	20	Which pages get written or merged
Resourcing and decision	20	Self-run vs extra hands; yes / no on the 30 days

Audits that end in “interesting” without a decision waste the fee.

Tickets. Each failed checkbox becomes a ticket labeled by layer: entity, truth-layer, content, corroboration, measurement, technical, local. Estimate in half-days. Sort by severity × revenue. Open the ten that unblock the rest — usually fact conflicts, missing About clarity, and the log owner. Attach line IDs (truth-llms-01) so the next pass can mark the line resolved with an evidence URL.

Re-audit triggers. Rebrand or rename. Major market expansion. Merger or acquisition. Product-line sunset. A sudden AI misrepresentation incident. Quarterly if you are actively investing. Between re-audits, the weekly subset of the panel is the heartbeat.

Subdomains and marketplaces. If docs live on a subdomain or offers live on a marketplace, include those hosts in truth-layer and content. Many audits stop at www and miss the URL AI already cites. Add fetch and schema checks for those hosts in the technical section.

Which AEO audit failure modes waste the fee?

These are the ways I have seen this checklist get performed and still produce nothing.

Failure	What it costs	What to do instead
Dashboard-only audit	A score with no prompt IDs	Freeze 25–40 prompts; log by hand once
Editing during baseline	You cannot prove the delta	Ban CMS writes until the log is dated
One blended visibility %	Mentions funded, citations ignored	Three columns, every month
Schema soup	Validators pass; facts still conflict	Sparse Organization + honest pages
llms.txt as sitemap	Models get a URL pile	H1, briefing, links to the pages that matter
Blanket Disallow for “AI”	You opted out of being cited	Separate training tokens from Search crawlers
40 tickets on day one	Nothing ships	Ten tickets; truth layer first
Workshop with no decision	You paid for a tour	Yes / no on the 30-day plan before you leave

The afternoon “AEO audit” is the loudest version: one person clicks a vendor, exports a PDF, and recommends a content calendar. No panel. No fact sheet. No fetch checks. I will not sign that.

Copy the checklists into your tracker. Request the evidence pack. Build the panel. Run baselines before changing anything. Score each section 0 to 5. Present the roadmap with non-goals. Decide the next 30 days. Then — and only then — touch the domain.

FAQ

What is an AEO audit checklist?

A structured list of checks — prompts, entities, schema, content, corroboration, tech, and measurement — used to baseline AI visibility before you invest in fixes. I run it before recommending work on a client domain so the first tickets are facts and fetchability, not a content calendar. If you cannot mark pass / fail / n/a on each line, you do not have a checklist. You have an essay.

What are the AI visibility audit steps?

Scope, baseline answers, entities, truth layer, content, gaps, local and technical, measurement, then a ranked roadmap. That order is the point: later steps inherit the frozen panel and the dated log. Skip the baseline and every later “win” is a story. The playbook layers match these steps; this page is the field sheet.

Do we need Semrush and Surfer to audit?

No. They speed SERP, competitor, and on-page coverage review. The non-negotiable core is a 25–40 prompt panel across products plus a human review of facts and schema. Use Semrush when it saves hours on the leaderboard. Use Surfer as a coverage aid. Neither is a pass / fail religion, and neither replaces the sheet.

Can we self-run this checklist?

Yes for a first pass, if someone will own the weekly panel and the fact sheet. Independent eyes help when you are blind to your own contradictions or you need a prioritized roadmap that survives a stakeholder fight. The skeleton is the same either way. The failure mode is running it once and never re-baselining.

How does this connect to the playbook?

This checklist is the operational pass over the playbook layers: entities, on-site truth, citeable pages, corroboration, and measurement. Use the Answer Engine Optimization playbook when a line fails and you need the strategy behind the ticket. Use What is AI visibility when someone still thinks the KPI is a Google rank.

What happens after the audit?

Ship the 30-day truth-layer fixes first — fact conflicts, About, schema, llms.txt, fetch blocks — then cluster content, then corroboration, measuring the same panel as you go. Do not open forty tickets on day one. Open the ten that unblock the rest, attach line IDs, and re-run the subset weekly so the next audit is a diff, not a restart.

CTA

Do not touch tactics until citations, conflicts, and gaps sit on one page.

Lane: /visibility. If you want a second pair of eyes on a filled sheet: visibility audit. System map: AEO playbook.