You can run a first accessibility audit yourself, and doing so before you buy one changes the conversation entirely: you arrive knowing which templates are broken and roughly how many issues there are, so the quote is for judgement rather than discovery. This page is the method in the order it is done, with the figures the audit sheet works out along the way. On the worked example that is nineteen pages opened out of 240, eleven hours of testing, and 401 issues across the site once the templates are counted.
Pick the sample, and write down why
List the templates, then pick two pages of each plus every page with a form, a search, a media player or a checkout. Write the list down with the reason beside each entry. That list is what makes the audit repeatable next year, and it is what a supplier's own sample should be measured against when they quote.
Run four passes on every sampled page
Automated scan first, to clear the cheap failures. Then keyboard-only: tab through the whole page and confirm you can reach and operate everything and always see where you are. Then a screen reader pass on the main flow. Then 200% zoom at 320 pixels wide, where most layouts break. Thirty-five minutes a page is a realistic budget once you have done a few.
Write findings a developer can act on
Each finding needs the page, the component, the WCAG criterion, what happens, what should happen, and a screenshot or a two-line reproduction. Record it against the TEMPLATE where it belongs: on the worked example 126 of the 401 issues are template issues, and each one fixed reaches 26 pages.
Questions people ask about how to conduct an accessibility audit
Do we need a screen reader licence?
No. Every major platform ships one, and the free options are what most testers use daily.
How do we know when the audit is finished?
When every sampled page has had all four passes and every finding carries a criterion. Coverage, not issue count, is the completion test.
Is a self-audit good enough for a bid?
Usually not on its own: a buyer asking for a conformance report generally wants an independent one. It is good enough to fix the site before that report is written.