AEO audit for an HR and payroll software company

The company

Two facts about this market shape the audit. Finance involvement in software decisions rose from 31% to 46% in a year (G2 survey of 1,038 decision-makers, June 2026; G2 runs a review platform), so controllers ask questions too. And many customers of this size are applicable large employers, which the IRS defines by at least 50 full-time employees, including full-time equivalents, on average in the prior year; each must file Forms 1094-C and 1095-C. The panel asks about those forms by number.

The questions buyers ask assistants

The panel follows AEO HQ's measurement design: 40 buyer intents, each written three ways (120 unbranded prompts), plus 20 branded prompts about the company. Wording comes from sales-call notes, support tickets, review-site questions, and Search Console queries. The panel varies the buyer's role and adds constraints such as budget, because 45% of AI-using B2B buyers add constraints such as budget, required features, or compatibility (519 respondents; the publisher sells search-marketing software).

Each prompt runs three times a week on each of the four assistants the audit measures (ChatGPT, Perplexity, Gemini, and Google AI Overviews), in a new chat with a clean session; the ten most important prompts run eight times a week. Results are reported as rates, because the same prompt returned the same list of brands less than once in 100 runs (2,961 runs; industry study; a co-investigator works for a tracking vendor). The table shows 12 of the 140 prompts. The wording is illustrative.

How the assistants reach the company

An assistant answers from what its model learned in training or by searching the web and writing from the pages it finds, called retrieval. Prices and tax coverage change after a model is trained, so they reach assistants mainly through search. Anthropic, for example, says Claude searches when a request depends on information that is "current, changing, or outside its training data". Each assistant searches its own index, built by its own crawler; how AI assistants find and cite sources covers each route.

• Google. AI Overviews and AI Mode show only pages that are indexed and eligible to be shown in Google Search with a snippet, from sites included in Search Console's "Search generative AI" setting, the default. Grounding in the Gemini app is controlled by the Google-Extended token. See how to rank in Google AI Overviews and AI Mode.
• ChatGPT. Sites that block OAI-SearchBot "will not be shown in ChatGPT search answers". ChatGPT search also uses other search providers, and OpenAI names Microsoft and Shopify; Enterprise and Edu workspaces may share disassociated search queries with Bing. See how to rank in ChatGPT search.
• Copilot. Copilot sends the queries it generates to the Bing search service, and a NOARCHIVE tag prevents content from being used in Copilot responses.
• Claude. Anthropic lists Brave Search as a web-search subprocessor, and blocking Claude-SearchBot may reduce a site's visibility in Claude's search results. See how to rank in Claude.
• Perplexity. PerplexityBot builds Perplexity's own index; the Perplexity-User fetcher, which opens pages when someone asks a question, "generally ignores robots.txt rules". See how to rank in Perplexity.

What the audit checks

The audit covers four things: whether crawlers can reach and read the pages, whether the facts buyers check are published and consistent, which third-party sources answers draw on, and whether the claims fit the rules. General items are in the AEO checklist; these are specific to this company.

Access, rendering, and indexing

1. robots.txt on every host. The site, help center, and developer docs sit on different hosts, and robots.txt rules apply only to the host, protocol, and port number where the file is hosted. The audit reads the groups that apply to OAI-SearchBot, Claude-SearchBot, Claude-User, PerplexityBot, Googlebot, and Bingbot, since a crawler follows the group that names it, and the * group only when none does. Blocking training crawlers is a separate choice: OpenAI says each of its crawler settings is independent.
2. The firewall. Google lists allowing crawling "in robots.txt, and by any CDN or hosting infrastructure" among the basics, so the audit reads CDN logs for each crawler's response codes on key URLs.
3. Rendering. For pricing, plans, integrations, tax coverage, and security, the HTML the server sends is compared with the rendered page, because none of the major AI crawlers rendered JavaScript in Vercel's December 2024 data.
4. Index coverage. About 40 key URLs are checked in Search Console's Page indexing report and URL Inspection tool, and in Bing Webmaster Tools.
5. Gated help. Help articles that answer buyer questions are opened in a private window to find those behind a login.

The facts buyers check

The audit writes a fact sheet: each fact a buyer is likely to check, the page that states it, and that page's date. Here it covers plans, prices, fees, the states and localities covered, ACA forms, integrations, security reports, data location, and contract terms. The same sheet is the key for grading answers.

Prices come first: 27% of AI-using B2B buyers say AI answers do not reflect real pricing or contract structures, and in trials across six models, a stated price and a recent date raised a source's odds of being cited first in all six (peer-reviewed; laboratory setting; the authors work for a marketing software vendor). Security follows, since IT security review was the biggest source of delay after a vendor was chosen. The AICPA describes a SOC 1 as an examination of controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting; payroll feeds customers' financial statements, so their controllers may ask for one (our reading).

Third-party sources

The audit lists every URL cited in the baseline runs, groups them (review sites, comparison pages and "best payroll software" lists, communities, news, the company's own site), and checks each against the fact sheet. The map comes from this company's runs, not from general studies, because the studies disagree: comparison pages were the most-cited page type across about 1,000 decision-stage prompts (agency study), while review sites made up 1.1% of 149,912 citations in a 102-brand panel (preprint).

Claims and the rules that limit them

Each claim is listed with its URL and the rule it touches. This is not legal advice; the company's counsel decides.

The audit also checks GA4 channels, key events, and the demo form's source question against how to track AI referral traffic in GA4.

Sample findings

These are sample findings for the hypothetical company: they show the form a finding takes and the evidence it needs, describe no real company, and were not measured. Impact is our judgment of how directly a finding affects whether assistants can reach, read, and correctly state the company's facts, or how much rule risk it carries; it is not a forecast.

The deliverable

The report is a PDF with a 60-minute readout call. It has ten parts:

1. Summary. What was measured, when, and the fixes to make first.
2. Method. Panel, assistants, dates, location, account state, run counts, and matching rules, so the baseline can be repeated.
3. Baseline rates. Per assistant: mention rate, citation rate, share of voice against eight named competitors, and branded accuracy, each with its count and 95% interval. Answers without a search or citation stay in the denominator. No pooled score and no rank.
4. Source map. Cited domains and URLs by type, with the company's facts checked on each.
5. Accuracy review. Each branded answer graded against the fact sheet, with the cited page for every error.
6. Access and indexing. robots.txt by host, firewall responses, rendering, index status, and crawler requests.
7. Claims review. Each claim, its URL, the rule, and a suggested rewording for counsel.
8. Findings and fix plan. Owners, effort, and how each fix will be verified.
9. Measurement plan. As below.
10. Appendices. The run log with every answer and citation, the panel, the fact sheet, and the log extract.

Measurement plan

Every measurement uses the same frozen panel, run the same way, following the methodology page and how to measure AI visibility. Two weeks give 820 unbranded and 120 branded runs per assistant, 3,760 in all. The methodology's full design also runs Google AI Mode, Copilot, and Claude; here they are covered by Google's and Microsoft's reports and the logs.

For scale: at 820 runs, an observed rate of 10% has a 95% Wilson interval of about 8.1% to 12.2% (AEO HQ calculation). The real interval is wider because runs of one prompt are correlated, hence the cluster bootstrap. A change between windows is reported only when the interval for the difference excludes zero, and fixed pages are compared with similar unchanged pages: in the only controlled field study found, ChatGPT referrals to pages that were not changed grew 3.5 times over the same period (preprint; one site).

Engagement timeline

The pricing page gives the audit's current delivery time; this example assumes about two weeks from completed intake.

What this example does not show

• Results. No rates, citations, traffic, or pipeline, because the company does not exist.
• How long changes take. A 2026 review of 45 studies found no technique with "a stable, longitudinal, cross-platform causal effect on organic discoverability" (preprint).
• Legal advice. The claims review flags wording; counsel decides.
• Real prompts. A real panel comes from the company's own calls, tickets, and search data.
• Every buyer's view. Answers vary by account, location, interface, and day; the panel samples fixed conditions on four assistants.
• Ads in assistants, or the product's AI features. Neither is in scope.

Next step

The audit's current scope, price, and delivery time are on the pricing page. The evidence behind these checks is in SEO, AEO, and GEO for B2B SaaS companies.