What an accessibility audit really is

Somebody asks whether your website is accessible. Perhaps a school you supply, a council you are tendering to, or an insurer. What they want is an audit, and if you go looking for one the quotes come back wildly apart, which tells you something is unclear about what is being bought.

So here is what an audit is, in three parts.

One: a machine opens your pages

A tool loads each page in a real browser and tests it against the standard. The standard is WCAG, the Web Content Accessibility Guidelines, written by the W3C, the body that looks after the web's shared rules; the current version is WCAG 2.2. It is a numbered list of rules at three levels, A, AA and AAA, and AA is the one everybody means.

The engine is usually axe, made by Deque. It is open source, and Chrome's own Lighthouse report scores accessibility with axe's assessments, so you have very likely had its results in front of you already without being told whose they were. That is not a criticism of anybody: it is a good engine, and there is no advantage in a different one.

Two: a person answers what the machine cannot

This is the part people are surprised by, and the makers of the tools are the ones who say it loudest. Deque publish their own numbers. Across the audits in their sample, automated tests found about 57% of the problems those audits contained - and on the same page they are careful to say that this is not the same as covering 57% of the standard. Measured by the standard's own rules, they put automated tools at roughly 16 of the 50 success criteria of WCAG 2.1 at levels A and AA. (That is the version their figure is stated against; WCAG 2.2, the current one, has more.)

The other rules need eyes. Is the description on that photograph actually true. Does the page read in a sensible order when it is read aloud. Can somebody who cannot use a mouse get through your menu. Do your forms say anything useful when they are submitted empty. No tool knows. Somebody has to look, and the honest way to do it is to look with the person who owns the site, because half of the answers are about intent.

Three: a record

What was checked, on what date, on which pages. What was put right and when. What is left, and why. That is the part the person who asked you actually wants, because it is the part they can put in a file.

And then nobody certifies it

There is no examining body for WCAG. The W3C's own guidance on conformance is blunt about where a claim comes from: "It is not required to make any conformance claim in order to conform", and where a claim is made, it is made by the authors of the site about their own site.

Read that again, because it reframes the whole purchase. When an agency sells you an audit, what you are buying is a competent stranger's assessment, with their name on it. That has real value: they are experienced, and they are independent. What it is not is a certificate, because there is no such thing to issue.

Which leaves one question that actually matters

If nobody certifies the result, the only thing separating a good audit from a bad one is whether it is still true.

And this is where the usual shape falls down. An audit is a snapshot. It is delivered as a document. The day after it arrives you add a photograph to your homepage, and the audit is now a description of a website that no longer exists. Not wrong, exactly. Just historical. Six months later, when somebody asks for it, you send a PDF describing a page you rewrote in the spring.

The two laws usually behind the question - the European Accessibility Act, Directive (EU) 2019/882, and the UK Equality Act 2010 - are not about paperwork either. They are about whether a person can use the thing. A document cannot tell you that about next week. (We are not lawyers and this is not legal advice; read them, or ask whoever advises you.)

So the useful version of an audit is not a better document. It is an audit that re-runs itself: the machine half going again every night, your answers to the human half kept with the date you gave them and marked for a fresh look the moment you change the page they were about, and the public statement rewriting itself every time you publish, so it can never claim something that stopped being true a month ago.

That is what bernard does, because on a site where the tooling already knows what changed and when, it costs almost nothing to do - and it is the only version where the answer you hand somebody is about your site today rather than your site in March. The four words it is allowed to end on are conforms, partially conforms, does not conform, and not yet assessed, and each one travels with the list of what is outstanding that produced it. Never "compliant", and never a badge. The mechanics are in get an accessibility audit, and the rule-by-rule detail is in does my site meet WCAG.