Most companies do not have one tracking stack.
They have layers: old agency work, new agency work, campaign pixels, GTM changes, CMP settings, Meta and Google defaults, a bit of server-side tagging, and a few urgent fixes that nobody documented.
The uncomfortable part is not that this is messy. It is that nobody can usually say, with confidence, what is live, why it exists, who owns it, and whether it still matches the current business model.
That is why an outside-in scan is useful. It does not replace a proper audit. It creates the first shared object: here is what a public observer can see. Now marketing, legal, analytics, and agencies can talk about the same evidence.