WCAG audit, the fixes, and the re-test
We audit what you already run, write the fixes ourselves, re-test the same criteria and hand you a dated document naming the views tested. Nobody certifies any of this.
Start with the scope
Tell us what has to be assessed and by when. We come back with the scope and the shape of the work.
Read what the quotes in front of you actually commit to
Of the sixteen pages we read, three say the provider writes the fix, four say a re-test happens, and one mentions an attestation of any kind. None say all three, and fifteen do not say what the evidence is worth after the next release. Sixteen do not say who signs the document you receive. Three questions settle most of it: does the work include writing the fix, does it include a re-test of the same criteria, and does it name who signs.
Atyantik review of sixteen provider pages ranking for this work
Atyantik review of sixteen provider pages ranking for this work
Atyantik review of sixteen provider pages ranking for this work
Atyantik review of sixteen provider pages ranking for this work
Every one of these is signed by somebody
For most of them, the signer is the party being assessed. That changes what each one is worth to whoever asked you for it.
| Document | Who signs it | Is it a certification | What it cannot show |
|---|---|---|---|
| VPAT, the blank template | Who signs itThe product owner, as a self-declaration | Is it a certificationNo. ITI, which publishes the template, states there is no certification for VPAT | What it cannot showA blank template shows nothing, and a completed one shows only what its author asserts |
| Accessibility conformance report, the completed document | Who signs itThe vendor whose product it describes | Is it a certificationNo. No federal agency signs, approves or registers one | What it cannot showThat the product is accessible. Only that the vendor says so |
| WCAG 2.2 conformance claim | Who signs itWhoever publishes the content, and they must date it | Is it a certificationNo. W3C publishes the rule and reviews no claim made under it | What it cannot showAnything outside the pages listed and the technologies named in the claim |
| Third-party audit report on W3C methodology | Who signs itThe evaluating firm, in its own name | Is it a certificationNo. W3C publishes the method and issues nothing | What it cannot showConformance, because it samples. W3C: in the majority of situations, using this methodology alone does not result in being able to make WCAG 2 conformance claims |
| Remediation plan | Who signs itThe vendor, as a commitment to the purchaser | Is it a certificationNo. There is no issuing body for it | What it cannot showThat any defect has been fixed. Only a re-test shows that |
| Accessibility statement on the site | Who signs itThe organisation, publicly, at a dated moment | Is it a certificationNo. W3C WAI publishes the guidance and approves nothing | What it cannot showEvidence. It is a public commitment plus a disclosure of known gaps |
| Letter of validation after remediation | Who signs itThe auditing organisation, only after a re-test, and it cannot be self-issued | Is it a certificationNo, and it does not claim to be. It states its own scope on its face | What it cannot showAnything outside the screens examined, or anything after the date of the re-test |
| Conformance badge in a footer | Who signs itNobody. It carries no author, no date and no scope | Is it a certificationNo. W3C: these logos do not represent review or validation of conformance by W3C and/or WAI | What it cannot showEverything it looks like it shows |
What the UK Government Digital Service found when it re-audited 47 sites
These are public sector organisations under a legal duty to be accessible, so this is the optimistic end of the range. GDS audited 47 sites, then audited them again two to four years later. Conformance moved in both directions, and GDS gives a staffing explanation: the knowledge can disappear as team members leave or change roles.
Show data table
| Passed the re-audit | Failed the re-audit | |
|---|---|---|
| Passed the first audit | 17 sites | 6 sites |
| Failed the first audit | 6 sites | 18 sites |
Six of the 23 sites that had passed lost it by the second audit, and six that had failed reached a pass.
The loop, and why it has these five parts
Across five agreements the US Department of Justice reached with companies over inaccessible websites, every one of the five names a WCAG version and level, carries a dated deadline, requires an outside consultant, and requires testing that carries on past the first audit.
What happens, in order
Scope, agreed in writing
We settle which views, templates, documents and apps are in, and name the WCAG version and level we test against, before anyone tests anything.
We run the audit
We test the agreed views against the named criteria, by hand and with tools, recording what was examined and what failed.
We write the fixes
We make the changes in your codebase. You do not get a list telling your team to rewrite code that works.
Re-test of the same criteria
We test the same criteria on the same views again, so what you hold is a result rather than an intention.
The dated document
On its face it names the views tested and the WCAG version and level, gives the date, lists the technologies relied upon and the re-test result.
What our re-test is not
One of those Department of Justice agreements requires the company to retain an independent web accessibility consultant approved by all parties. Independent there means someone who is not the party doing the remediation. We fix, and we re-test our own fixes. That is not independence, and we will not describe it as though it were. If your situation requires an independent verifier, that is a third party, and what we produce is built so that party can check it rather than start again.
A closed loop, or an independent verifier
Do you need a verifier who is not the party doing the remediation, or do you need the failures on what already ships cleared by one accountable firm?
One firm, closed loop
When this is the one
Nobody outside has named a verifier. You need the failures cleared on what already ships, and evidence of what was tested.
What that means in practice
The audit, the fixes and the re-test all come from us, and the re-test is ours. One accountable party, with the limit above stated on the document.
An independent verifier
When this is the one
Verification by an outside party has been required by a decree, a signed settlement, a regulator or a large customer.
What that means in practice
A third party runs the verification. We do the remediation and hand over the tested evidence in a form that party can check rather than repeat.
What you can send onward
Where a customer asks for an accessibility conformance report, that document is signed by the product owner, which is you. We hand over the tested evidence behind it. VPAT is a registered trademark of the Information Technology Industry Council, and nothing we produce is called one.
| In the pack | What it states | What it does not state |
|---|---|---|
| Audit findings, view by view | What it statesEvery view we tested, the criteria applied, and each failure with the place in the product it lives | What it does not stateAnything about views outside the agreed scope |
| The fixes, written in your codebase | What it statesThe change that was made and where it was made | What it does not stateThat nothing new arrives with your next release |
| Re-test result | What it statesThe same criteria re-tested on the same views, with the date it was done | What it does not stateA status that holds after that date |
| Scope and method statement | What it statesThe tested views on the face of the document, the WCAG version and level, and the technologies relied upon | What it does not stateA certificate. Nobody issues one for this |
| Evidence behind the report your customer asked for | What it statesThe tested material a product owner needs to complete and sign that report | What it does not stateA legal opinion, and not a prediction that no letter arrives |
Where the failures sit, by Deque's own rule set
Deque publishes the axe testing engine, and it has 100 non-deprecated rules. Sorted by which layer owns the markup that fails them, most of them land in one place. In the US Web Design System's own self-assessment, all ten disclosed WCAG A and AA exceptions name a component as the defect site rather than the markup of a team consuming it.
Show data table
| Segment | Value (rules) | Share |
|---|---|---|
| Markup an application team wrote | 61 | 61% |
| ARIA emitted by a component library | 33 | 33% |
| Third-party embeds | 6 | 6% |
Most of it is in markup your own team owns, which is where we write the change.
What public agencies paid, from United States federal award records
None of these are our numbers. They are medians from 425 United States federal contract awards where accessibility is the stated purpose, grouped by what was bought, every one an award to a third-party vendor.
Show data table
| Item | Median award value |
|---|---|
| Documents only (n=41) | 39,397 USD |
| One product or website (n=23) | 66,515 USD |
| Scanning tool licence alone (n=65) | 82,980 USD |
| General Section 508 services (n=199) | 93,619 USD |
| Training content (n=10) | 189,336 USD |
| Department-wide programme (n=87) | 627,864 USD |
Scope class moves the figure by more than an order of magnitude, which is why no single median across classes is shown.
What moves the number here
Five scope questions you can answer before speaking to anyone. How many distinct templates and screens are in scope, rather than how many pages. Whether PDFs and other documents are included. Whether native apps are included. Whether the report has to be produced in a format your customer names. And whether a re-test of the same criteria is part of the work.
Whether to call us
Buy this when
You have a live product and someone outside the company has asked you for evidence about it.
You want the failures cleared on what already ships, without changing how the team builds.
Your team will keep releasing while this runs, and the evidence has to survive that.
Do not buy this when
It is not built yet, and you want it designed and tested to the standard from the start.
You want somebody to hold the level over the following year rather than reach it once.
What landed on your desk is a security questionnaire, and not an accessibility one.
You want the whole experience rethought, not an existing one brought to a stated level.
The six questions we get asked
Nothing here is legal advice, and none of it is a statement about your own exposure.
We already have an accessibility widget running on the site. Isn't that covered?
- The United States Federal Trade Commission's complaint in its case against accessiBe states, citing W3C and Utah State University's Institute for Disability Research, developer of the WAVE tool, that no automated testing tool alone can determine if a website meets accessibility standards, and that manual human testing is required.
- About that one company: the FTC alleged its compliance claim was deceptive.
- accessiBe agreed to an order, neither admitting nor denying the allegations, and agreed to pay USD 1,000,000 in monetary relief usable for consumer redress.
- The final order was issued on 21 April 2025 and bars that company from representing that its automated technology can make any website WCAG compliant.
- That order binds one company on its own marketing claims.
Is what you hand over a certification, or not?
- The Information Technology Industry Council, which publishes the VPAT template, states plainly that there is no certification for VPAT, and that the product owner completes it as a self-declaration.
- W3C says its own conformance logos do not represent review or validation of conformance by W3C or WAI.
- So what you get here is a dated document naming the views we tested, the WCAG version and level, the technologies relied upon and the re-test result. It is evidence with its scope written on its face.
Will this stop the letters and the lawsuits?
What does it actually cost, and what makes it go up?
Are you going to make my team rewrite code that works fine?
What is any of this worth after next month's release?
Tell us what has to be assessed
Tell us what has to be assessed, by when, and who asked you for it. We come back with the scope, the shape of the work and whether it is ours to do.
Two good ways this ends. Either we agree a scope and get to work, or we tell you straight that this is not ours.
- What you send stays between us.
- A senior software engineer reads it, not a sales desk.
- Nothing above is held back behind an email address.