What an Accessibility Audit Actually Covers, and What the Scan Missed

A real accessibility audit pairs an automated scan with manual testing: keyboard-only navigation, screen reader checks, and a human reading the criteria. The scan finds missing alt text and contrast failures. The manual pass finds the keyboard trap in the date picker and the focus order that jumps across the page. One without the other is a report, not an audit.

The number the scan vendors do not print

Automated accessibility tools reliably catch 30 to 40 percent of WCAG failures. That figure comes from the vendors themselves and from practitioners who have run both, and it is the most important number in accessibility procurement. A scan that reports zero errors has not found zero barriers. It has found zero of the barriers it can see. The other 60 to 70 percent live where a scanner cannot go: a keyboard trap in a modal, a focus order that jumps from the header to the footer and back, a tab that announces nothing, a form error that appears in color only, a video with captions that lag the audio by four seconds.

That is why a demand letter cites failures the scan never flagged. Plaintiff firms run scanners too, and they know what the scanners miss; the letters name the failures that require a human to find, because those are the ones the store never fixed. A store that treats a clean scan as compliance is defending itself with a document that proves it never looked.

What the manual pass actually does

A proper audit has three parts, and the scan is only the first. The automated scan runs across the template set and produces the countable failures: missing labels, contrast ratios, empty buttons, duplicate ids. The keyboard pass follows: a tester navigates the whole purchase flow with Tab, Shift-Tab, Enter, Space, Escape, and arrow keys, and records every place focus disappears, gets trapped, or lands somewhere illogical. The screen reader pass follows that: the same flow with NVDA or VoiceOver, checking that every control announces its name, role, and state, and that dynamic changes like cart updates and form errors are announced.

The third part is the one that makes it an audit instead of a test session: a human maps every finding to a WCAG success criterion and a severity, and writes the remediation in the order that matters, blockers first, then the failures that affect the purchase flow, then the rest. The deliverable is not a score. It is a list of barriers, each with a criterion number, a location, and a fix, in an order a developer can work through. Anything less is a scan with a cover page.

How to buy one without wasting the money

Ask the vendor three questions before signing. Which success criteria does the automated scan cover, and which does it not? Who does the manual testing, and with what assistive technology? And does the report map findings to criteria with remediation steps, or does it hand back a score and a list of URLs? A vendor that cannot answer the first question is selling a scan. A vendor that answers it honestly is selling an audit, and the price difference is the difference between a document that helps in a negotiation and one that does not.

Run the audit before the demand letter arrives, not after. After, the same work happens under a deadline set by someone else, with a lawyer billing by the hour and a settlement clock running. Before, it is a project with a beginning and an end, and the store chooses the order of fixes. The cheapest audit is the one done early. The most expensive is the one done twice, once as a scan that missed the barrier, and once as a settlement that priced it. The deadline pressure behind this is the Title II deadline that moved to 2027, and buyers read your VPAT before they read your homepage.

Frequently asked questions

What percentage of WCAG failures can automated tools catch?

About 30 to 40 percent, by the vendors own figures and practitioner estimates. Scanners reliably find missing alt text, contrast failures, and empty buttons. They miss keyboard traps, focus order problems, and most meaning and context failures.

Is a clean scan the same as being compliant?

No. A clean scan means no failures were found by the automated checks that ran. The criteria the scan cannot test, including keyboard operation, focus order, and error identification in context, may still be failing.

What should an audit report contain?

Every finding mapped to a WCAG success criterion, with its location, severity, and a remediation step, in an order a developer can work through. A score alone is not a report.

How often should a store audit?

After every major theme change, checkout change, or app install that touches the purchase flow, and at least once a year as a baseline. A store that only audits after a demand letter is auditing on someone else's schedule.