The term “compliance audit” covers a wide range of activities — from a five-minute automated scan that generates a percentage score to a comprehensive manual review conducted over several days by trained specialists. Understanding what a genuine compliance audit involves is important both for setting realistic expectations and for evaluating whether a particular service is going to provide meaningful protection.
Automated Scans vs Manual Audits
Automated accessibility and compliance scanning tools have an important role in the compliance ecosystem. They are fast, scalable and consistent. They are also fundamentally limited in what they can detect.
Automated tools can reliably detect: missing alt attributes on images (though not whether the alt text is meaningful), missing label associations on form elements, missing language declarations, colour contrast failures where text and background colours are defined in CSS, and some ARIA attribute errors.
Automated tools cannot detect: whether a cookie consent banner actually blocks cookies before consent is given (since this requires executing the page as a real browser session), whether navigation is usable by keyboard (since this requires actual keyboard navigation), whether error messages are meaningful to users, whether the reading order of content makes sense when navigated by screen reader, or whether ARIA attributes are being used correctly in context.
Research consistently shows that automated tools detect approximately 30-40% of real accessibility failures. Manual review is required to find the remainder.
What a Manual Compliance Audit Covers
A comprehensive manual compliance audit conducted by trained specialists examines your website across multiple dimensions:
GDPR Cookie Compliance
We review your cookie consent implementation against the requirements of GDPR Article 7 and the ePrivacy Directive. This includes verifying that no non-essential cookies are set before consent is given (which requires executing the page in a real browser), that the consent mechanism offers genuine choice between cookie categories, that the consent preference centre is accessible and functional, and that consent records are being maintained correctly.
Privacy Policy Assessment
We review your privacy policy against the eight categories of information required by GDPR Article 13 — identity of the data controller, purposes and legal basis for processing, retention periods, third-party sharing, international transfers, user rights, and complaint mechanisms. We check whether the policy is accurately linked from relevant points on the site and whether it accurately describes your actual data processing activities.
Full Cookie Audit
We identify all cookies set by your website — including those set by third-party scripts, embedded tools, booking platforms and social media integrations — and categorise them by type, purpose and consent requirement. We check whether each category is correctly handled by your consent mechanism.
WCAG 2.1 Level AA Assessment
We manually test your website against the 50 success criteria that constitute WCAG 2.1 Level AA conformance. This includes keyboard navigation testing, screen reader testing for specific elements, colour contrast verification, heading structure review, form label verification, and assessment of ARIA implementation.
ADA Compliance Review (where applicable)
For US-facing websites, we assess compliance against ADA obligations — which reference WCAG 2.1 as the relevant technical standard.
What You Receive
A Veritron audit delivers a comprehensive written PDF report documenting every finding with:
- A plain-language description of each issue and why it matters
- The specific legal standard or accessibility criterion it violates
- A concrete, developer-ready recommendation that can be acted on immediately
- A severity rating (Critical, High, Medium, Low) based on legal risk
- A priority action plan with specific timeframes
- A complete compliance checklist showing pass/fail status for every check
- A section documenting what is already working correctly
The report is written to be handed directly to a web developer. Every recommendation is specific enough that your developer can implement it without requiring further clarification. The priority action plan tells them what to address first and gives them the business context they need to understand why each fix matters.