WCAG 2.2 AA Accessibility Audit Checklist

Setup & Pre-flight

Confirm scope, tools, roles, and working files before any testing begins.

Roles & Responsibilities

Role	Responsibility
Accessibility Tester	Execute automated and manual testing; document findings; triage false positives; write bug reports.
Development Team	Remediate identified issues; retest fixes; flag implementation questions.
Project Manager	Track remediation progress; prioritize fixes; coordinate timelines.
QA Lead	Review bug reports for completeness; verify severity ratings; sign off on retests.
Design Team	Address color contrast, focus indicator, and touch target issues at the design system level.
Content Team	Review and update alt text, link text, and other content-level fixes.

Confirm pages in scope and staging URLList all pages: URLs, purpose, and key interactive components (forms, modals, tables, iframes)
Confirm WCAG standard: WCAG 2.2 Level AAWCAG 2.2 adds 9 new criteria vs 2.1 — includes 2.4.11 Focus Not Obscured, 3.3.7 Redundant Entry, 2.5.7 Dragging Movements
If audit covers more than 5 pages, define tiered sampling strategyTier 1: high-traffic / high-risk pages tested every cycle. Tier 2: rotate in. Tier 3: as time allows. Promote any area with recent dev changes to Tier 1 for that cycle.
Open or create the Bug Log Excel workbook{Client}_A11y_Audit_{Project}.xlsx
Review any pre-existing DevOps accessibility tickets (DO prefix)
Create evidence screenshots folder{Client}_A11y_Evidence_Screenshots/
Confirm valid credentials available for all user roles in scope

RBA Standard Tool Stack

Primary: axe DevTools (Pro), IBM Equal Access Checker, Screaming Frog + axe-core

Conditional: Siteimprove or another tool the client has already licensed — use if available, document which version

axe DevTools (Pro) installed and updated — WCAG 2.2 AA ruleset, Best Practices ON, Experimental OFF
IBM Equal Access Checker (Chrome extension) installed and updated
Screaming Frog configured with axe-core integration
Siteimprove or client-licensed tool confirmed (if applicable)Document tool name and version used for this audit
Chrome High Contrast extension installed
VoiceOver accessible on macOS test machine (Cmd+F5)
NVDA (latest) installed on Windows test machine with Chrome
JAWS (latest) accessible on Windows test machine with ChromeIf JAWS is not available, NVDA + Chrome is the minimum required. Document which was used.
Access to staging environment confirmed

Why baseline first?

Capture the visual and functional state of the application before any accessibility settings are activated or testing begins. This supports before/after evidence in reports and helps identify regressions across audit cycles.

Screenshot all in-scope pages at default state (desktop viewport)
Capture interactive states: buttons, links, inputs (default, hover, focus, active, disabled)
Capture forms in empty and filled states, including validation and error messages
Capture modal dialogs, overlays, and tooltips in open state
Capture navigation menus in expanded and collapsed states
Note any animations: page load effects, transitions, carousels, loading indicatorsThese will be retested under Reduce Animations in the OS-Level Settings phase
Record key brand color values using browser color picker (text, background, semantic states, borders)

Automated Testing

Run automated tools across all pages in scope. Log all findings before manual testing.

Automated Tool Confidence Levels — Triage Before Logging

Confidence	Examples	Action
High	Missing required HTML attributes, invalid ARIA roles, duplicate IDs, invalid nesting	Log directly as bugs
Medium	Color contrast on gradients/images, heading level skips	Verify manually before logging
Low	Alt text accuracy, ARIA label clarity, semantic appropriateness	Requires human judgment — do not log based on automation alone

Common false positives: hidden images flagged for missing alt text; skip links reported as empty when they contain screen-reader-only text; visually ambiguous links that have proper ARIA labels.

Run axe DevTools on each page in scope — WCAG 2.2 AA rulesetBest Practices: ON · Experimental: OFF · Do not include AAA rules
Log all Violations as AXE bugs — apply confidence level triage before loggingHigh confidence = log directly. Medium/Low = verify manually first.
Log all Needs Review items as AXE-I bugs (Investigate), Severity: Investigate
Cross-reference axe findings with IBM — merge into single bug where same element/issue confirmed

Crawl all pages in scope, export Accessibility tab
Log Confirmed Violations as SF bugsAAA contrast items are out of 2.2 AA scope — log but mark for closing
Log Needs Manual Review items as SF-I bugs
Cross-reference iframe findings with axe and IBM — merge if same issue

Run IBM on each page in scope — log all Violations and Needs Review
Log Recommendations separately — not WCAG violationsGoes in a separate Recommendations tab, not the Bug Log
Apply -I suffix to all Needs Review items, Severity: Investigate
Key IBM rule patterns to watch: label_name_visible (2.5.3), label_ref_valid (1.3.1), element_orientation_unlocked (1.3.4), style_focus_visible (2.4.7), style_viewport_resizable (1.4.4), fieldset_label_valid (1.3.1)IBM flags 2.4.11 (Focus Not Obscured) under WCAG 2.2 — this IS in scope for WCAG 2.2 AA audits

Confirm whether client has access to Siteimprove or another supplemental toolIf not available, mark this card complete and move on
Run supplemental scan on all in-scope pages
Cross-reference findings with axe/IBM — log net-new findings only, merge duplicates
Document tool name and version used in the Bug Log header

Keyboard Testing

Tab-only navigation across all pages in scope. No screen reader.

Test Tab from browser chrome — can you reach main content on all pages in scope?If focus loops in nav: keyboard trap (2.1.2, Critical) — log as KBD prefix bug
Check for skip navigation link (first Tab press)If absent: log KBD bug (2.4.1). If keyboard trap also exists, both must be fixed together — note interdependency in Dev Notes on both bugs.
Tab through all interactive elements — confirm visible focus ring on each
Confirm focus ring meets WCAG 2.2 Focus Appearance (2.4.11, 2.4.12)2.4.11: Focus indicator not fully obscured. 2.4.12: Minimum size and contrast requirements for focus indicator. Both are new in WCAG 2.2.
Confirm no focus lands on static content (headings, paragraphs, divs)

Count Tab passes to reach action controls in data tables (edit/delete/export)More than 1 pass = broken tab order (2.4.3)
Open Add/Create modal — Tab through all fields, confirm focus stays inside
Open Edit modal — Tab through all fields, Escape to close, confirm focus returns to trigger
Delete confirmation — confirm focus returns correctly after action
Tab to any third-party iframes — confirm reachable, navigable, and exits cleanlyCross-origin iframes (e.g. Power BI, embedded charts) often block keyboard access entirely

WCAG 2.2 — Multi-Step Form Criteria

3.3.4 Error Prevention (AA): For forms with consequential submissions, at least one of the following must exist: a review screen before final submission, a confirmation dialog, or an undo mechanism after submission.

3.3.7 Redundant Entry (A): Information entered in earlier steps must not be asked again in later steps without a way to reuse it. This is a new criterion in WCAG 2.2.

Tab through all steps of any multi-step form — confirm logical focus order at each step transitionFocus should move to the new step's heading or first field on advance, not stay on the Next button
Confirm a review screen or confirmation dialog exists before final submission on consequential forms (3.3.4)
Verify information entered in earlier steps is not re-requested in later steps without a prefill or reuse option (3.3.7)Log as High severity if same data is required twice with no copy/prefill mechanism
Confirm error messages describe what is wrong AND how to fix it (3.3.3)
Confirm required field indicators are announced to screen readers, not just visible visually
Test Back navigation — confirm previously entered data is preservedData lost on back navigation = failure of 3.3.4

Screen Reader — VoiceOver (macOS)

Enable VoiceOver (Cmd+F5) with Safari. Test all pages in scope systematically.

On page load — confirm VO announces page heading, not logo/nav
Open Rotor (VO+U) → Headings — confirm logical hierarchy, no skipped levels
Navigate by landmark regions — confirm main, nav, and content regions announced
Test all pages in scope — confirm focus does not reset to logo/nav on navigation

Open modal — confirm title + description announced immediately on open
Navigate each input — confirm field label announced before value
Test any custom controls (steppers, date pickers, toggles) — confirm accessible name and role announcedIf VO+Cmd+Slash opens silently: Critical VOA bug (4.1.2)
Submit form with multiple errors — confirm ALL errors announced, not just the last
Open warning/confirmation modal — confirm title + description announced
Dismiss modal — confirm focus returns to trigger element, not top of page

Navigate table with VO+Arrow — confirm column headers announced with cell values
Sort a column — confirm ascending/descending state announced
Tab to first data row — confirm row identity announced before action buttons
Attempt VO+Shift+Down Arrow on any third-party embedded chart or iframeIf ping sound: Critical — chart inaccessible to screen reader
Test status/error messages that appear dynamically — confirm announced via role="alert" or aria-live

Screen Reader — NVDA/JAWS (Windows)

Primary: NVDA + Chrome or JAWS + Chrome on Windows 10/11. Document which combination was used.

AT Priority for Enterprise/Portal Clients

NVDA + Chrome and JAWS + Chrome are the primary test configurations for enterprise and portal audits — most client staff use Windows. VoiceOver (Phase 4) is secondary. Results may differ between screen readers; note discrepancies in Dev Notes.

Shortcut reference: NVDA: Insert key. JAWS: Insert or CapsLock. Browse mode: arrow keys. Forms mode: Enter. Exit forms mode: Escape.

On page load — confirm SR announces meaningful page title and first heading
Navigate by headings (H key in NVDA/JAWS) — confirm logical hierarchy
Navigate by landmarks (D key in NVDA / ; key in JAWS) — confirm main, nav, regions announced
Test skip navigation link — confirm it functions and moves focus correctly
Navigate by links (K key) — confirm all links have meaningful, non-duplicate text

Enter forms mode (Enter) on a form — confirm SR switches to forms mode automatically or prompts
Navigate each input — confirm label announced before field type and current value
Open modal — confirm focus moves into modal and title/description announced
Confirm focus is trapped inside modal — Tab should not leave the dialog
Submit form with errors — confirm error summary or individual field errors announced
Dismiss modal — confirm focus returns to trigger element
Note any differences from VoiceOver results — log as separate bugs if Windows-only

Navigate table with Ctrl+Alt+Arrow (NVDA/JAWS table nav) — confirm headers announced with cells
Confirm table is recognized as a data table (T key to jump to tables)
Test dynamic content updates (loading states, success messages) — confirm announced via aria-live
Test any third-party embedded content (charts, iframes) — note if completely inaccessibleCross-origin iframes cannot be tested from within the SR — note limitation in bug report

Verification

Manually confirm all automated flags. Close out-of-scope and false positive items.

Close all AAA contrast items (color-contrast-enhanced)WCAG AAA — outside 2.2 AA scope. Note in Dev Notes with rationale.
Note: WCAG 2.2 criteria (2.4.11, 2.4.12, 2.5.7, 3.3.7 etc.) ARE in scope — do not close theseUnlike 2.1 audits, WCAG 2.2 AA includes all new 2.2 success criteria
Close any pre-existing DO contrast tickets that pass on manual check (≥ 4.5:1) — verify with DevTools + WebAIM
Document all false positives with written rationale in Dev Notes before closingRequired field: why this is a false positive, what was manually verified

[Focus ring bug]-I — Tab through all interactive elements; confirm focus ring visible and meets 2.4.11/2.4.12IBM: style_focus_visible. Confirm visually before marking as violation.
[High contrast bug]-I — Enable Chrome High Contrast (Increased Contrast); confirm no content disappears
[Color-only bug]-I — Check any charts or data visualizations for color-only data series (no patterns or labels)
[Font scale bug]-I — Set Chrome font size to Very Large; confirm headings and body text scale proportionally
[Sticky nav bugs]-I — Confirm whether nav is sticky; if not sticky, close as not applicableIBM often flags element_tabbable_unobscured — only valid if nav is actually sticky (2.4.11)
[Heading markup bug]-I — Inspect modal or section titles; confirm element type (<div> vs <h>)
[Axe/IBM chart bug]-I — Close if screen reader testing already confirmed the element inaccessible
[SF iframe bug]-I — Close if screen reader and keyboard testing completed on iframe; cross-reference findings

OS-Level Settings Testing

Test system-level accessibility settings on all in-scope pages. Perform after baseline documentation is complete.

High Contrast / Contrast Themes (both light and dark)Verify: all text, interactive elements, focus indicators, icons, and form fields remain visible and operable
Text Scaling (Make Text Bigger — Settings → Accessibility → Text Size)Verify: layout does not break; no content is clipped or hidden at larger text sizes (1.4.4)
Reduce Animations (Settings → Accessibility → Visual Effects → Animation Effects OFF)Verify: prefers-reduced-motion is respected; entrance animations, transitions, and loops suppressed (2.3.3)
Color Filters (Settings → Accessibility → Color Filters — enable Grayscale)Verify: information is not conveyed by color alone; content remains usable without color (1.4.1)

Increase Contrast (System Settings → Accessibility → Display → Increase Contrast)Verify: borders appear around buttons and inputs; focus indicators are stronger and clearly visible
Reduce Transparency (System Settings → Accessibility → Display → Reduce Transparency)Verify: solid backgrounds replace blur effects; text remains readable on all surfaces
Reduce Motion (System Settings → Accessibility → Display → Reduce Motion)Verify: parallax, slide transitions, and autoplaying animations are suppressed (2.3.3)
Large Text (System Settings → Accessibility → Display → Large Text)Verify: layout does not break; no content overlaps or is clipped at larger system font sizes (1.4.4)

Bug Log Completion

Ensure every bug has all required fields before export.

Severity Definitions

Severity	Definition
Critical	Blocks access to core functionality entirely for AT users; no workaround exists
High	Significantly impairs access to important content or workflows; workaround is difficult or unclear
Medium	Causes confusion or extra effort for AT users but does not block task completion
Low	Minor issue or best practice violation with minimal real-world impact
Investigate	Automated flag requiring manual verification before confirming — use -I suffix on Bug ID

Bug ID — correct prefix (AXE/IBM/SF/VOA/KBD/DO) and sequential number; append -I if unverified
Page URL — full staging URL for every bug
WCAG Criterion and Level — format: "2.5.3 Label in Name" | "A"
Steps to Reproduce — numbered, reproducible, references specific elements
Current Behavior — describes what happens, not what should happen
Expected Behavior — describes WCAG-compliant outcome + specific fix approach
Dev Notes — tool rule ID, element code snippet, cross-references, fix guidance, false positive rationale if closed
Severity — Critical / High / Medium / Low / Investigate — no blanks for open bugs
Cross-references added — related bugs noted in Dev Notes of both bugsEspecially: keyboard trap + skip nav bugs that must be fixed together; duplicate VOA/keyboard findings; related IBM/axe pairs

WCAG Conformance Tab

Manually update all WCAG 2.2 AA criteria. This tab does not auto-populate.

Mark all criteria with at least one open bug as Fail
Mark criteria explicitly tested and confirmed passing as Pass
Mark remaining as Not Tested with reason if applicable
Fill Bug ID(s) column for every Fail row
Fill Notes column with plain-language summary of each failure
Confirm WCAG 2.2-specific criteria are included: 2.4.11, 2.4.12, 2.5.7, 2.5.8, 3.2.6, 3.3.7, 3.3.8, 3.3.9These are new in WCAG 2.2 and not in the 2.1 conformance table — add them if using a 2.1 template
Confirm AAA-only criteria are NOT in the conformance table (e.g. color-contrast-enhanced 1.4.6)

Dashboard

Verify all formulas exclude closed bugs. Apply RBA branding.

All severity KPIs use COUNTIFS with <>ClosedNever plain COUNTIF for severity/total counts — closed bugs must be excluded
Closed bug count appears only in the Closed status tile — nowhere else
Area, Source, WCAG Level tables all exclude closed bugs
Charts reference correct data (active by severity, issues by status)
RBA navy (#1D366D) headers, aqua (#14BADB) accent lines only — no red/orange/yellow severity colors
Severity labels updated to Critical / High / Medium / Low / Investigate throughout

Azure DevOps Export

Export active bugs only. Provide both CSV and formatted Excel.

ADO Title Naming Convention — Keep Under 75 Characters

Format: [Area]: [Issue] (WCAG X.X.X)

Example	Chars
Nav: Keyboard trap in main menu (WCAG 2.1.2)	47
Modal: Focus not returned after close (WCAG 2.4.3)	52
Form: Error messages not announced (WCAG 4.1.3)	49
Table: Column headers missing from screen reader (WCAG 1.3.1)	62
Login: Skip link absent (WCAG 2.4.1)	38

Keep the Area short (Nav, Modal, Form, Table, Chart, Login, Global). Put the WCAG criterion at the end so titles sort consistently in ADO.

Filter to active bugs only (Status ≠ Closed)
Apply ADO title convention to all bugs: [Area]: [Issue] (WCAG X.X.X) — keep under 75 characters
Confirm priority mapping: Critical=1, High=2, Medium=3, Low=4
Confirm ADO severity format: "1 - Critical", "2 - High", "3 - Medium", "4 - Low"
Assign sprint iterations: Critical+KBD=Sprint 1, VOA/IBM/AXE=Sprint 2, Medium/Low=Sprint 3
Confirm Area Path and Iteration Path match client's ADO project structure
Save CSV with UTF-8 BOM encoding (prevents character issues on import)
Create Excel review version with DevOps Import and Instructions tabs
Create import guide markdown for client dev team

Executive Summary

HTML → PDF using WeasyPrint. Libre Caslon + Montserrat. RBA branding.

Cover: Libre Caslon Text title, gradient hero, network SVG illustration
RBA logo: white version on red block (cover), red version on white headers (interior)
Section accent lines: 50×5px aqua (#14BADB), 15px gap before heading
Footer: position:absolute; bottom:0.2in — pins to bottom of every page
KPI counts match the live bug log (verify before final PDF generation)
Severity labels in report use Critical / High / Medium / Low throughout
Remediation sprint table matches the DevOps sprint assignments
Report notes WCAG 2.2 AA as the conformance standard (not 2.1)
Save final PDF and keep HTML source for future edits

Final Deliverables

Upload all files to the client project folder in Teams.

Teams Location

[Client Channel] → Files → Accessibility

📊 {Client}_A11y_Audit_{Project}.xlsx
📋 {Client}_A11y_AzureDevOps.csv
📊 {Client}_A11y_AzureDevOps.xlsx
📄 {Client}_A11y_AzureDevOps_Import_Guide.md
📄 {Client}_A11y_Executive_Summary.pdf
📁 {Client}_A11y_Evidence_Screenshots/
🔗 {Client} A11y Executive Summary Figma.url

Setup & Pre-flight

Scope confirmation ▶

Tool setup ▶

Baseline documentation ▶

Automated Testing

axe DevTools — per page ▶

Screaming Frog + axe-core — site-wide crawl ▶

IBM Equal Access — per page ▶

Siteimprove / client tool (if available) ▶

Keyboard Testing

Navigation & global ▶

Data tables & modals ▶

Multi-step forms ▶

Screen Reader — VoiceOver (macOS)

Page structure & navigation ▶

Forms & modals ▶

Data tables & dynamic content ▶

Screen Reader — NVDA/JAWS (Windows)

Page structure & navigation ▶

Forms & modals ▶

Tables & dynamic content ▶

Verification

Close out-of-scope items ▶

Verify open -I (Investigate) items ▶

OS-Level Settings Testing

Windows settings ▶

macOS settings ▶

Bug Log Completion

Required fields for every open bug ▶

WCAG Conformance Tab

Conformance tab update ▶

Dashboard

Formula and branding QA ▶

Azure DevOps Export

Export preparation ▶

Executive Summary

Content & branding QA ▶

Final Deliverables

Files to upload / confirm ▶