Salesforce Org Health Checklist

Can you explain, in one sentence, what every profile and permission set in your org is there for?

Are profiles simple, with access granted mainly through permission sets rather than dozens of cloned profiles?

Is the "View All"/"Modify All" and "View Setup and Configuration" flags restricted to administrators who actually need it?

Do you have a documented process (or recent evidence) for reviewing who still has access when people change roles or leave?

Are your Flow and workflow automation entries named clearly, owned by someone, and documented?

Can you list what the last 60 days of Flow errors were, and which were actually fixed?

Do you have a check that detects recursive triggers or duplicate flows doing the same thing?

Are critical automations tested in a sandbox before being pushed to production?

Is your Apex test coverage at or above 75% for the classes you actively deploy?

Do you have hard Apex exceptions or recurring system errors appearing in the Apex exception log in the last 30 days?

Is your custom code inside the governor limits (e.g., no wildcard SOQL, no SOQL in loops, batchable-sized batches)?

Do your deployments go through a sandbox-first path with a changelist or CI, and fail cleanly instead of risking production?

Can you run a duplicate report and count the accounts and leads with no obvious ownership gaps?

Are duplicate detection and merge rules in place so new dupes are caught at input, not after the fact?

Do your key reports and dashboards reflect data people trust, or are they routinely "that's the wrong number"?

Is there a retention/archival plan so records don't quietly grow your data storage bill every quarter?

Are all your integrations using authenticated, correctly-scoped credentials (no shared passwords, no disabled users carrying keys)?

Can you see the last time each integration succeeded, and do you get alerted when one silently fails?

Are you well under API request limits each rolling 24h window for the connectors you run?

Are callouts retry-safe (idempotent), so a timeout doesn't double-create records on the far side?

Do you know your current data and file storage usage, and how close you are to your license caps?

Are your files (attachments, chatter files) under control, or are they a growing share of your file storage?

Do you get notified before you approach any hard limit that could block users or API calls?

Is your platform event / streaming / data export usage clear enough that rising costs won't surprise you mid-quarter?