Most websites should have a full accessibility audit once per year, with additional audits triggered by significant design, code, or content changes. An annual cadence keeps WCAG conformance current as the site evolves and as the standard itself is updated. Between audits, scans can flag approximately 25% of issues and help catch regressions, but they do not replace the evaluation that identifies the full set of problems affecting real users.
Sites that publish frequently, run ecommerce, or serve regulated audiences often benefit from a tighter cadence. The right answer depends on how much the site changes and how much risk the organization carries.
| Site Type | Recommended Audit Cadence |
|---|---|
| Informational website, low change | Once per year, plus any time the site is redesigned |
| Ecommerce or Shopify store | Once per year, with a re-audit after theme changes or major template updates |
| SaaS web app or mobile app | Annually, plus after significant feature releases |
| Government or regulated site | Annually at minimum, with documentation maintained between cycles |
| Sites with rapid publishing | Annual audit plus quarterly scans to catch regressions |
Why Annual Audits Are the Baseline
Websites change. Themes get updated, plugins are added, designers refresh components, and content teams publish new pages with new patterns. Each of these introduces the possibility of new accessibility issues, even on a site that was fully conformant a year earlier.
An annual audit gives the organization a reliable checkpoint. It confirms that the work done previously still holds and identifies anything that has drifted. It also produces fresh documentation, which matters for procurement, legal defense, and internal reporting.
WCAG itself evolves. Moving from WCAG 2.1 AA to WCAG 2.2 AA, for example, means new criteria apply. An annual audit is the cleanest way to keep the site aligned with the standard you claim to meet.
When Should You Audit More Often Than Once a Year?
Certain events warrant an additional audit outside the annual cycle. A full redesign is the clearest one. If the visual design, navigation, or underlying code changes significantly, the previous audit no longer reflects the current site.
Other triggers include switching ecommerce platforms, adopting a new CMS, launching a customer portal, or adding authenticated areas that were not in the original scope. New templates, new component libraries, and new third-party integrations all introduce risk that a prior audit did not cover.
Organizations facing a demand letter or lawsuit also need a current audit, both to guide remediation and to support legal documentation.
What About Sites That Change Constantly?
High-velocity sites, think news publishers, large ecommerce catalogs, or active SaaS products, can develop issues faster than an annual cycle catches them. For these, the pattern is an annual audit paired with continuous scans between cycles.
Scans cannot determine WCAG conformance. They flag roughly 25% of issues and miss the rest, which is why they never replace an evaluation. What they do well is catch regressions: alt text that went missing after a template edit, color contrast that slipped after a brand refresh, form labels that disappeared in a component update.
The combination works: the audit establishes the full picture once a year, and scans hold the line between audits.
How Audits, Scans, and Monitoring Fit Together
Audits and scans are separate activities with separate purposes. An audit, conducted by a qualified auditor, identifies issues across all WCAG success criteria that apply to the site. A scan is automated and surfaces a narrow band of detectable issues.
Ongoing monitoring sits between audits. It is the routine of running scans on a schedule, reviewing flagged items, and assigning fixes before they accumulate. Monitoring does not verify conformance, but it keeps small issues from becoming large ones.
The work of verifying conformance and producing evidence, such as an ACR, always comes back to the audit.
Documenting the Audit Cadence
An accessibility statement or policy should reflect how often the site is audited. This tells users, customers, and procurement teams that the organization maintains its commitment over time rather than treating accessibility as a one-time project.
For companies that issue ACRs, the audit cadence also informs when to refresh the report. ACRs do not formally expire, but updating after significant product changes, or at least annually, keeps the document credible.
How often should a Shopify store be audited?
Once per year, plus any time the theme is changed or heavily customized. Shopify themes vary widely in accessibility quality, and template edits are a common source of new issues.
Do I need to audit after every content update?
No. Routine content updates, new blog posts, product additions, page edits, do not require a full audit. Scans and content guidelines cover day-to-day publishing. Audits are for the site’s underlying patterns and any structural changes.
Is a one-time audit enough if the site rarely changes?
A one-time audit documents the site at a single moment. Even a low-change site drifts over time as browsers, assistive technology, and WCAG itself evolve. An annual cadence remains the safer baseline.
How long does an accessibility audit take?
Turnaround depends on scope, but most audits complete within a few weeks from kickoff to delivered report. Larger sites and more complex web apps take longer.
The right cadence for most websites is annual, with additional audits when the site changes in meaningful ways. That pattern holds across informational sites, ecommerce stores, SaaS products, and government properties. Accessibility audits conducted by Accessible.org are fully manual and built to give organizations a clear picture of where the site stands and what to address next.
Contact Accessible.org to discuss an audit cadence that fits your site.
