What a Website Accessibility Audit Includes
Business owners considering an accessibility audit often don't know what to expect. This covers what an audit includes, how it differs from an automated scan, and what the final report should contain.
Updated with additional research.
When a service business owner starts looking seriously at website accessibility, conflicting information turns up quickly. Quotes and offers range widely. One vendor offers an automated scan for free. Another quotes an enterprise audit. Someone else recommends installing a widget and calling it done.
Knowing what an audit includes cuts through most of that. An audit is a project a small service business can reasonably commission, and it is a different thing from a scan or a certification. The Small Business Owner’s Guide to Website Accessibility covers where an audit fits in the larger picture.
The process should look like this.
Automated Scanning Is the Starting Point
Most audits begin with automated testing: tools that flag code-level issues such as missing image alt text, form labels not associated with their fields, color contrast failures, and missing language attributes. W3C’s evaluation methodology says evaluators will probably want tools to be more efficient. Free options exist.
The limit is what the tools cannot judge. They test what is present in the code, not whether it works for a person using assistive technology. W3C notes that a tool can detect missing alt text but cannot decide whether the text is appropriate. W3C also states that tools cannot check every aspect of accessibility and that human judgement is required.
How much automation covers depends on what is counted. Deque, an accessibility software vendor, analyzed first-time audits covering more than 13,000 page states and about 295,000 issues. Automated testing found 57% of the issues by volume, but it could check only 16 of the 50 WCAG 2.1 AA criteria. The remainder needs manual review.
An audit combines automated scanning with manual review of the user experience, beyond the underlying code.
What Manual Testing Covers
Manual testing evaluates the site as users experience it in ways tools cannot simulate.
Keyboard navigation comes first. Every interactive element (menus, forms, modal dialogs, carousels, accordions, embedded booking widgets) should work with a keyboard alone. A tester works through the site without a mouse, checking for elements that trap focus, actions a keyboard cannot trigger, and focus indicators that disappear or are too faint to follow.
Screen reader testing comes next. Auditors commonly pair NVDA with Chrome on Windows, or VoiceOver with Safari on a Mac. In WebAIM’s 2026 survey of 1,780 screen reader users, which drew a self-selected sample, JAWS and NVDA were the most used desktop screen readers, with VoiceOver third. This is where structural issues show up: headings that don’t reflect the page, links labelled “click here,” and alt text that describes file names.
Visual and cognitive review asks whether the page makes sense in a linear read, whether form error messages are specific, and whether moving content can be paused or stopped, as WCAG 2.2.2 requires. Some reviews go beyond AA. Respecting a visitor’s reduced-motion preference is a Level AAA criterion (2.3.3), and plain-language writing for cognitive accessibility is also AAA. Both are good practice rather than part of an AA conformance target.
Mobile review comes last. WCAG 2.2 sets a 24 by 24 CSS pixel minimum for touch targets, with exceptions, and content has to reflow when zoomed. A site that passes on desktop can still fail on mobile.
Third-party components need their own pass. Many service business sites carry embeds such as booking tools, chat widgets, form builders, and video players. Each has its own accessibility profile, and the owner may not control it. WCAG allows a partial conformance claim when third-party content is outside the author’s control. A thorough audit notes which components have issues and what options exist.
What the Deliverable Should Include
An audit report should leave the owner with a clear inventory of what is broken, a suggested order for addressing it, and enough explanation to make decisions about remediation. W3C’s report template is a useful reference, since it asks for the pages covered, links to the success criteria, a recommendation for each failure, and a plan for monitoring.
A good report has these parts:
- A prioritized issue list, organized by impact on users rather than as an alphabetical dump of every criterion checked.
- Page-specific findings. “Color contrast issues” is not actionable. “Body text on these four pages fails the 4.5:1 ratio that WCAG 1.4.3 requires at Level AA” gives a developer something to fix.
- Plain-language descriptions of each finding, covering who it affects, without requiring fluency in criterion numbers.
- A remediation roadmap with a recommended sequence rather than a fixed quote, since priorities shift once the full inventory is known.
What an Audit Does Not Do
An audit does not make a website compliant. It produces the information needed for decisions about compliance.
It is also not a one-time event. Websites change through new pages, updated plugins, and new embeds, and issues introduced after the audit are not covered by it. W3C’s report template includes a plan for ongoing monitoring for this reason.
An overlay installed after an audit does not replace the audit’s fixes. An overlay adds a layer on top of the site and does not fix the underlying code the audit flagged. The overlay article covers that in more detail.
Why Start with the Audit
The audit sets the baseline. For a business that has never evaluated its site, it answers the question everything else depends on: what is on the site?
Detectable failures are common. WebAIM’s 2026 scan of one million home pages found WCAG 2 failures on 95.9% of them. That scan studied the top-ranked home pages, not small service business sites, and it used automated detection only, so the true rate is higher. The findings are often more bounded than owners expect. A good report turns an abstract concern into a defined remediation plan.
The ADA overview article gives background on the legal side. For a business that wants to know what is on its site and what addressing it would take, the COREaccess™ Accessibility Leadership System covers audit, remediation, training, and monitoring, and a 15-minute conversation can scope the audit for a specific site.