Most agencies with "CRO" in the name do a version of the same four things, in the same order. Understanding that sequence is useful before you hire one - it tells you which parts you might handle yourself, and which parts genuinely require dedicated expertise and ongoing resource.
The short version: they audit your page, review your data, run structured A/B tests, and repeat. Each phase feeds the next. The part most people skip to is the testing. The part most people should focus on first is the audit.
They start with an audit
No agency skips this. Before any testing happens, before hypotheses, before strategy decks, they read your page. They assess it against a set of conversion principles - is the headline clear to a cold visitor, is there one obvious call to action, does the page address the visitor's most likely objection before they reach the CTA. This part is almost entirely judgement-based. A good auditor has seen hundreds of pages and recognises patterns fast. A weaker one runs a checklist and calls it done.
The audit usually covers one to five pages - your highest-traffic entry points - and produces a findings document with prioritised recommendations. This is the foundation everything else is built on, because you cannot know what to test until you know what is broken. An agency that jumps straight to testing without a proper audit phase is optimising blind.
The audit is also the most transferable part of the engagement. You own the findings regardless of what happens next.
Then they review your behavioural data
A good CRO agency does not look at the page in isolation. They pull whatever behavioural data exists - heatmaps, scroll depth, session recordings, funnel reports, form abandonment rates - and use it to validate the audit's hypotheses. If the audit suggests the CTA is too far down the page, scroll data either backs that up or it does not.
This phase also surfaces things a visual audit misses. A session recording might show visitors consistently dropping at the pricing section - evidence of a specific friction point that was not visible from reading the page alone. The data review is where the audit's hunches become testable. It is also where a CRO engagement starts to require real traffic volume to be useful. If your page gets fewer than a few hundred visitors a week, the behavioural data is too thin to draw reliable conclusions from.
They run structured A/B tests
This is the part most people picture when they think of CRO work. An agency builds controlled experiments: version A of the headline against version B, the form above the fold versus the form lower down, two different CTA wordings. They track which variant produces more conversions, call the winner, and that becomes the new control for the next test.
There are real constraints here that agency proposals often understate. A/B testing requires enough traffic to reach statistical significance - typically thousands of visitors per variant, depending on your baseline conversion rate. On lower-traffic pages, a single test can take months to produce a reliable result. A testing programme that sounds fast in a proposal can move very slowly once it is running.
One opinion worth stating plainly: countdown timers are the laziest lever in the CRO playbook. Most visitors recognise artificial urgency and discount it. Any agency that leads with urgency tactics rather than message clarity is optimising the wrong thing.
They report, iterate, and repeat
CRO is not a one-off project for an agency. It is a retainer model. Once the audit and first test round are done, the agency produces a report, builds the next set of hypotheses, and the cycle continues. In a mature programme, this ongoing iteration is where the value compounds - each test informs the next, and over six to twelve months you can move conversion rates meaningfully.
The honest version of this: the first three months of a CRO engagement are usually the most productive, because the obvious wins are found and fixed quickly. Months four onwards require more sophisticated thinking and more traffic volume to find smaller gains. Plenty of businesses find the ROI drops noticeably after the initial phase. For a full view of what this typically costs and when it makes sense to commit, the CRO agency overview covers the pricing breakdown.
The part that does not require a retainer
The audit that kicks off every CRO engagement is also the part that does not need a long-term commitment to access. If you have not had an independent read of your page yet - someone who does not know your product looking at it cold and telling you what is confusing, what is missing, what is pushing the right visitors away - that is the useful first step, and you can do it before signing anything.
Ferguson does exactly that part of the job. Paste your URL and in around three minutes you get a scored report covering the same criteria a CRO agency opens with: headline clarity, CTA structure, objection coverage, trust signals, social proof, and load speed. Findings are prioritised by conversion impact, and the fixes come with copy rewritten in your voice - not just a list of things still to do.
If you'd like a Ferguson audit run on your page and want to talk through the findings, get in touch at hello@useferguson.com. We can walk you through what the report surfaces and what to prioritise fixing first.