Automated scanners catch only 30–40% of WCAG issues — the rest needs a human. This guide walks you through a hybrid WCAG-EM methodology: what tools do for you, what you still have to check yourself, and how to write a report your stakeholders can act on.
An accessibility audit is a structured evaluation of a digital product against a standard — usually WCAG 2.2 AA — to identify barriers for users with disabilities and document how to fix them.
A real audit picks a defined sample of pages / documents / components and evaluates them against named success criteria — not a vague “we looked around”.
Every finding names the WCAG success criterion (e.g. 1.4.3 Contrast Minimum), quotes the offending content, and describes a concrete fix — not “improve accessibility”.
The output is a prioritised list developers and content authors can work from — severity, affected users, effort estimate, and remediation steps in plain language.
For EU EAA, US ADA, UK PSBAR, AU DDA, CA AODA — a documented audit with dates and findings is what regulators and courts actually look at. Keep the report.
Automated tools reliably catch 30–40% of WCAG issues. The rest is context, judgement, and lived experience. A competent audit always combines both.
alt attributes on imagesaria-labelsWCAGHub tools flag both sides. Issues that fail automatic checks go into Issues. Issues that pass automatically but still need a human eye go into a dedicated Manual Review tab — so you never miss the “automated green” blind spots.
Loosely based on the W3C's WCAG-EM methodology, adapted for real product teams with websites, PDFs, and Office documents.
Write down exactly what's in and out. For a website: list the URLs (or URL patterns). For documents: which files, from which folder, up to what date. For Office: which templates, which departments.
Tool step: none yet — this is a writing exercise. A good scope is one paragraph long.
Most audits target WCAG 2.2 AA. For public sector: EN 301 549 (EU), Section 508 (US), AODA (CA), PSBAR (UK), NZGWAS (NZ). For PDFs: add PDF/UA-1 (ISO 14289-1). Document which standard you picked and why — the report refers to it dozens of times.
Tool step: in WCAGHub, pick your jurisdiction in the scan settings — it changes the report's law references and terminology. See the Compliance hub for the full list.
You can't audit every page of a 2,000-page site. WCAG-EM calls for a structured sample: home, key templates, common task flows (login, checkout, contact), and a handful of random pages. Aim for 15–25 URLs for medium sites.
Tool step: run the Web Checker on each sampled URL. Each scan runs 77+ detections against WCAG 2.2 and returns an Issues list, a Passed list, and a Manual Review list.
A website is only half the picture. Annual reports, forms, accessibility statements — anything downloadable is part of scope. PDF/UA-1 (ISO 14289-1) is the governing standard; the Matterhorn Protocol is the industry's detailed checklist on top of it.
Tool step: run the PDF Checker. It runs 55 native checks plus VeraPDF (the reference ISO-14289-1 validator) and merges the results. See our PDF/UA & Matterhorn checklist for the mapping.
Government portals, internal intranets, and publisher workflows all generate Word, Excel, and PowerPoint files. These have their own accessibility rules — heading styles, table headers, slide titles, named sheet ranges — that PDF tools don't cover.
Tool step: upload samples to the Document Checker. It runs 31 detections across all three Office formats, with format-specific checks (slide titles for PPTX, sheet structure for XLSX, tracked changes for DOCX).
For each sampled page or document, do at least four manual passes — this is where the other 60% of issues live.
Tool step: WCAGHub reports include a Screen Reader Compatibility Score (0–100) per page and surface the items most likely to trip NVDA / JAWS / VoiceOver. Use that to prioritise the manual pass.
A good audit report has: an executive summary, the scope, the standard used, a findings table grouped by severity, and per-finding details (WCAG reference, affected user group, steps to reproduce, fix suggestion, effort estimate).
Tool step: every WCAGHub scan generates a branded, itself accessible PDF report with all of the above — plus an AI Summary that turns the findings into executive-level language and maps them to your selected jurisdiction's law references.
The first audit is just the start. Set a cadence — quarterly for active sites, after every release for template changes, monthly for high-risk public sector portals. Re-scan the same sample each time; track the score over time.
Tool step: WCAGHub credits never expire — buy an Enterprise pack once, then spread scans over the year. Keep every report in version control as evidence.
A real compliance audit covers every digital artefact the public can reach — not just HTML. That's why WCAGHub ships three tools on one account.
77+ detections across WCAG 2.2 A & AA
55 native checks + 106 VeraPDF (ISO 14289-1)
31 detections across DOCX, XLSX, PPTX
Most “accessibility audits” that end up in a legal file got one of these wrong.
A single automated scan catches 30–40% of issues at best. If your audit report doesn't include a keyboard pass, a screen-reader pass, and a zoom pass, it isn't an audit — it's a linter output.
Home pages are usually the most polished. The login, search results, PDF downloads, account settings, and checkout — that's where most barriers live. Always sample across templates, not just the front page.
EAA, EN 301 549, Section 508 and AODA all explicitly include downloadable documents. “We made the website WCAG-AA” is not compliance if your annual report PDF is untagged and your policy DOCX has no heading styles.
“Add alt text to images” is not actionable at scale. “WCAG 1.1.1 (Level A): 14 images on /products/ are missing alt attributes, e.g. <img src="hero.jpg">” is.
Every release reintroduces regressions. A single audit is a snapshot, not a programme. Set a re-scan cadence and track score over time — that's the number your board actually cares about.
The questions we get most often from agencies, public sector buyers, and in-house compliance teams.
For a 20-URL site plus a handful of PDFs / documents, budget 2–5 working days — one day for scans and triage, 1–3 for manual passes, and one for writing up. Large portfolios or complex web apps can take weeks.
WCAG 2.2 is the current W3C recommendation and supersedes 2.1. EN 301 549 v4 (Sep 2024) references it. New audits should target 2.2 AA. Existing 2.1 policies remain valid for their term, but any new procurement should say 2.2.
No. EU EAA, US ADA case law, and AU DDA all assume the tested standard is WCAG, which contains criteria that cannot be judged automatically (e.g. 1.1.1 for meaningful alt text, 2.4.2 for descriptive titles). A defensible audit always combines automated and manual evaluation.
Both work. Internal teams are cheaper and build capability; external audits add independence, useful for regulated sectors. Many organisations run quarterly internal audits plus one external per year. WCAGHub works for both — buy credits once, scan as often as you need.
A VPAT (Voluntary Product Accessibility Template) and the ITI's Accessibility Conformance Report (ACR) map each WCAG / Section 508 criterion to a conformance level (Supports, Partially Supports, Does Not Support). A WCAGHub audit report gives you the underlying evidence; the VPAT is the summary document built from it.
Six market jurisdictions: AU (DDA), US (ADA / Section 508), EU (EAA / EN 301 549), UK (Equality Act / PSBAR), CA (ACA / AODA), and Global (WCAG 2.2 as voluntary baseline). The report's law references and terminology change based on the jurisdiction you pick. See the Compliance hub.
Yes — each re-scan uses one credit. Since credits never expire, many teams buy a volume pack and re-scan after every release. See pricing and Enterprise packs.
WCAGHub tools cover web (including responsive and PWAs), PDFs, and Office files. Native iOS and Android apps need platform-specific testing (XCTest / Espresso accessibility APIs) — that's not in scope for our tools today. The methodology in this guide still applies.