An evaluator gets access to your product and tests each unique screen template against WCAG, with automated checks and by hand with a keyboard and a screen reader. You get back the findings and a conformance report (ACR). Your part is access, answers and fixes. On a Harbor Standard engagement the signed ACR lands on day 14.
Key Takeaway
Your team’s involvement is minimal: provide access, answer questions, and fix what gets flagged. The biggest timeline risk is slow access provisioning, so have a point person ready before kickoff.
Before the Audit Starts
You’ll need to provide access to your product. For most SaaS products, that means:
- A staging or production URL the evaluator can access
- Test accounts for each user role (admin, standard user, read-only, etc.)
- Any setup steps needed to reach key workflows (sample data, feature flags)
The evaluator will also confirm scope, which pages, flows, and roles are being tested. Not every screen in a large product needs individual evaluation. The focus is on distinct templates and critical user paths.
What the Evaluator Does
A proper audit combines multiple testing methods:
| Method | What It Catches |
|---|---|
| Automated scanning | Color contrast failures, missing alt text, improper heading structure, missing form labels. Fast, but it can decide only a handful of WCAG criteria on its own. |
| Keyboard testing | Focus traps, unreachable controls, invisible focus indicators, illogical tab order. |
| Screen reader testing | Missing announcements, confusing reading order, unlabeled regions, broken ARIA patterns. |
| Manual inspection | Zoom/reflow behavior, motion and animation issues, timeout handling, error recovery flows. |
6 of 55
WCAG 2.2 A and AA criteria an automated tool can decide on its own
The evaluator tests each WCAG 2.2 Level AA success criterion against your actual product and documents what they find.
What You Get Back
The primary deliverable is a completed ACR, the filled-out VPAT template with your product’s results. Each criterion includes a conformance level (Supports, Partially Supports, Does Not Support, Not Applicable) and specific remarks explaining the finding.
Depending on your engagement, you may also receive:
- A detailed findings report with screenshots and fix guidance
- Follow-up reviews after your team remediates issues
- A re-issued ACR showing what now passes, after your team lands its fixes
How Long It Takes
| Phase | Timeline |
|---|---|
| Discovery | Days 1 to 2 |
| Audit | Days 2 to 11 |
| Signed VPAT/ACR | Day 14, committed at signing |
| Remediation and Re-issue | Typically to ~Day 45, on your team’s clock |
The signed ACR lands on day 14, committed at signing, or day 21 on Professional. Remediation runs after that, on your team’s clock, and the full cycle usually wraps around day 45.
What Your Team Needs to Do
Your involvement is minimal but important: provide access, answer questions about intended behavior, and (if your engagement includes remediation) fix the issues your evaluator flags so the final report reflects your product’s actual state.
What reliably slows an audit down is waiting on access, and waiting on answers when the evaluator has a question. It is usually an approvals queue rather than anyone dragging their feet. Name a point person before kickoff and both mostly take care of themselves.
Common Questions
- What happens during an accessibility audit?
- The evaluator confirms which screens, flows and user roles are in scope and gets access to the product. They then test each unique template against the WCAG success criteria, with automated checks and by hand with a keyboard and a screen reader, and report the results as a findings report and a conformance report (ACR).
- What do I need to provide for an accessibility audit?
- A staging or production URL the evaluator can reach, a working test account for each user role, any setup needed to reach key workflows such as sample data or feature flags, and one named person who can answer questions about how the product is meant to behave.
- How long does an accessibility audit take?
- On a Harbor Standard engagement, which covers up to 10 unique templates, discovery runs days 1 to 2, testing days 2 to 11, and the signed ACR is delivered on day 14, a date committed at signing. Fixes and re-testing follow on your team’s schedule, and the full cycle typically lands around day 45.
- Can an automated scan replace an accessibility audit?
- No. A scan catches some failures, such as missing form labels or low color contrast, but most WCAG criteria need a person to judge them: whether the focus order makes sense, whether a screen reader announces a control correctly, whether an error message helps someone fix the problem.