EquiView Blog
How to Find an IAAP-Certified Accessibility Auditor: A Buyer's Checklist
Quick answer: Before hiring an IAAP auditor, verify their individual CPACC or WAS certificate number, confirm whether they also fix the issues they find (or only report them), check they test against current WCAG 2.2 standards, and ask if the auditor is a full-time employee with a team behind them or a solo freelancer. Avoid vendors that are really sales teams reselling someone else's credentials, and avoid splitting audit, remediation, and certification across three separate companies.
Digital accessibility is no longer optional. It's a legal requirement under laws like the ADA, Section 508, and the European Accessibility Act, a customer expectation for a growing share of users, and increasingly a brand reputation issue that shows up in reviews, social media, and press coverage. As demand for accessibility compliance has grown, so has the number of vendors offering IAAP-certified accessibility audits — but not every "certified" auditor, or the agency selling their services, is actually equipped to help you.
The accessibility services market has become crowded fast, and that growth has attracted a mix of genuinely skilled practitioners and businesses that are better at sales than at accessibility. Because the underlying work — manual testing, screen reader walkthroughs, code-level remediation — is technical and time-consuming to verify from the outside, buyers often can't tell the difference until well after signing a contract. That's expensive: a bad audit can leave real barriers in place, expose you to legal risk, and cost you a second round of vendor spend to fix what should have been caught the first time.
This guide breaks down exactly what to check before you sign a mandate with an accessibility auditor, why each check matters, and which red flags mean you should walk away before you've spent a rupee or a dollar.
What Is an IAAP Auditor?
An IAAP auditor is a professional certified by the International Association of Accessibility Professionals (IAAP), the leading global body for accessibility credentials. Most practicing auditors hold one or both of two core certifications: CPACC (Certified Professional in Accessibility Core Competencies), which covers foundational knowledge of disability, accessible design, and relevant laws and standards, and WAS (Web Accessibility Specialist), which is a deeper, more technical credential focused on evaluating and remediating digital products against WCAG success criteria.
These certifications require passing a proctored exam and are tied to an individual, not a company. A firm can call itself "IAAP-certified" in its marketing simply because one person on staff, or one contracted consultant, holds a credential — that doesn't mean the person actually assigned to your project holds it, or that the company has enough certified staff to handle projects at scale. This distinction between the credential and the company is exactly why the checks below matter.
4 Things to Check Before Hiring an IAAP Auditor
1. Ask for the Certificate Number Before Signing a Mandate
Anyone can claim to have "IAAP-certified staff" on a website or in a sales deck. Before you sign a statement of work or mandate, ask for the actual certificate number of the specific individual who will lead your audit — not a generic reference to the company's credentials, and not the certificate of a senior person who will oversee the account but never touch the actual testing.
Why it matters:
- Certificate numbers can be independently verified through IAAP's member records, so you're not relying on a vendor's word alone.
- It confirms the credential belongs to the person actually doing your work, not a name attached to a marketing page or a case study written by someone else.
- It prevents "credential borrowing," a pattern where an agency lists one certified expert across dozens of client pitches, but that expert is stretched thin, oversees rather than executes, or never touches your project at all.
- It gives you a paper trail: if a dispute arises later about audit quality, you have documented proof of who was accountable for the work.
Red flag: A vendor who is reluctant to share a certificate number, who only offers a company-level accreditation instead of naming the individual auditor, or who gives you a certificate for someone other than the person doing your actual project work. If they hesitate or deflect on a simple, verifiable request like this, treat it as a signal about how the rest of the engagement will go.
2. Ask Whether They Can Fix the Issues They Find — Or Only Report Them
An audit is only half the job. Identifying accessibility issues is relatively straightforward for a trained auditor; the real value — and the real cost — is in remediation: actually rewriting code, restructuring markup, fixing color contrast, adding alt text, correcting focus order, and retesting until the issues are resolved. A vendor who stops at the report has handed you a to-do list, not a solution.
Questions to ask directly during the sales process, not after you've signed:
- "If your audit finds 50 issues, can your team fix them, or do we need to hire someone else for that?"
- "Is remediation priced separately from the audit, and roughly how much more should we expect to pay once we know the issue count?"
- "Do you retest after remediation to confirm the fixes actually resolved the issue, or is that a separate engagement too?"
- "Can you give me an example of a before-and-after fix you've implemented for a client, with code-level detail?"
Auditors who only audit — and who have no in-house development, design, or engineering capability — often hand you a long PDF of findings and walk away. You're then left sourcing a second vendor to interpret and fix what the first one found. That second vendor typically charges a premium, because they have to re-audit or re-interpret someone else's findings from scratch rather than working from their own testing. The net effect is that a "cheap" audit-only quote can end up costing more overall than an integrated audit-plus-fix engagement.
3. Confirm They Audit Against Current Accessibility Standards
Accessibility standards are not static — they evolve as the web evolves, and an audit performed against an outdated standard can give you false confidence. WCAG 2.2 (published in October 2023) is the current version most regulators, courts, and industry frameworks reference today, and it added new success criteria around things like focus appearance, dragging movements, and target size that didn't exist in earlier versions. WCAG 3.0 is still in draft and evolving, but forward-looking auditors are already tracking it.
If your auditor is still testing exclusively against WCAG 2.0 (from 2008) or 2.1, or relying on an outdated internal checklist that hasn't been refreshed in years, you could pass their audit and still fail a real-world legal review, a regulator's assessment, or an enterprise customer's own vendor accessibility questionnaire.
Ask specifically:
- Which WCAG version and conformance level — A, AA, or AAA — will they test against? (Level AA is the standard most organizations target and most laws reference.)
- Do they cover mobile app accessibility standards separately, if you have native iOS or Android apps in scope, since these have their own platform-specific guidelines beyond web WCAG?
- Do they test with real assistive technology — screen readers like JAWS, NVDA, and VoiceOver, and tools like keyboard-only navigation and screen magnifiers — or only with automated scanning tools?
- How often is their testing methodology reviewed and updated as standards and case law change?
Vague, evasive, or overly technical-sounding-but-empty answers to these questions are a sign the vendor's process hasn't kept pace with the field — or that whoever is answering isn't close enough to the actual testing work to know the details.
4. Check Team Capacity — Employee or Freelance Consultant?
This question determines whether your project actually gets delivered on the timeline you agree to, and whether it can scale if your scope grows mid-project.
- In-house employee auditors typically mean more consistency, accountability, and available bandwidth if your project scope expands — for example, if a first-pass audit uncovers far more issues than expected, or if you add more pages, apps, or product lines to scope.
- Freelance or contracted auditors aren't automatically a red flag — many excellent, highly credentialed accessibility professionals work independently. But you should ask how many other client engagements they're currently juggling, what their backup plan is if they become unavailable mid-project (illness, another contract, etc.), and who owns the relationship if something goes wrong.
- Ask how the vendor staffs larger engagements: is it one certified person doing everything, or a certified lead supported by a trained team that can handle volume without sacrificing quality?
Also ask about bench strength directly: if the audit uncovers hundreds of issues across a large site, product, or portfolio of apps, does the vendor have enough trained people — beyond just one certified individual — to deliver fixes on your timeline? A single credentialed expert supported by an untrained or thinly-staffed team is a bottleneck waiting to happen, especially under a deadline like an upcoming compliance audit, funding round, or public launch.
2 Red Flags to Avoid When Choosing an Accessibility Auditor
Red Flag #1: Generic Business-Development Emailers Fronting for IAAP Professionals
A growing pattern in this space: sales teams and agencies with no accessibility expertise of their own send templated cold outreach, then partner with — or simply name-drop — IAAP-certified professionals to win business and lend credibility to the pitch. You sign a contract with the sales team, and only later discover the actual audit work is subcontracted out to a third party, with limited visibility into who is really doing the testing, how experienced they are, or how much of your fee they're actually being paid to do the work.
This model isn't always malicious, but it does add a layer of distance, margin, and miscommunication between you and the person actually testing your product. It also makes it harder to hold anyone accountable if the work is poor, since responsibility is split between the seller and the subcontracted expert.
Ask directly: "Will I be working with the certified professional named in this proposal, or with a sales layer that outsources the actual testing to someone else?" Also ask to speak with or email the certified auditor directly before signing — a legitimate vendor will make this easy.
Red Flag #2: Fragmented Offerings — Audit, Certification, and Fixes From Separate Vendors
When audit, certification, and remediation are split across three different companies — one firm audits, a second firm implements fixes, and a third issues a certification or seal — you inherit three sets of handoffs, three invoices, three contracts, and three opportunities for miscommunication about scope, timelines, and what "done" actually means.
This fragmented model also tends to cost significantly more in total, since each vendor prices in its own margin, project management overhead, and onboarding time, and none of them is fully accountable for the end-to-end outcome. If the fix doesn't fully resolve the audit finding, or the certification body flags something the remediation team missed, you're stuck coordinating between three separate teams to figure out who's responsible for the gap.
Look instead for an integrated accessibility partner — one team that can audit your product, implement the fixes it recommends, retest to confirm the fixes work, and support you through to formal certification, all under a single point of accountability and typically a single contract.
FAQ: Hiring an IAAP Auditor
How do I verify someone's IAAP certification is real?
Ask for their certificate number directly and confirm it independently through IAAP's own verification channels rather than taking a vendor's website or proposal at face value. A genuine, confident auditor will share this without hesitation, usually within the same email thread.
Does IAAP certification mean the auditor can also fix accessibility issues?
Not necessarily. IAAP certification (CPACC or WAS) validates accessibility knowledge and testing ability, not development, design, or engineering capability. Some certified auditors work purely as consultants who identify issues, while others sit within teams that can also implement the fixes. Confirm this distinction separately before assuming a certified auditor can also close the loop on remediation.
What accessibility standard should my audit be based on?
Most current audits should reference WCAG 2.2 at Level AA, which is the benchmark most regulators, courts, and industry vendor-assessment frameworks currently expect. Some regulated industries or enterprise contracts may require Level AAA in specific areas, so it's worth confirming what standard your customers, regulators, or industry expect before the audit begins.
Is it better to hire a freelance IAAP auditor or an agency with in-house auditors?
It depends heavily on project scope and timeline. Freelancers can work well for small, one-time audits of a single site or app with a flexible deadline. Larger, ongoing, or time-sensitive projects generally need an in-house team with enough certified and trained staff to handle volume, cover for absences, and stay accountable to a fixed delivery date.
Why does it cost more to use separate vendors for audit, fixes, and certification?
Each vendor in a fragmented chain adds its own margin, project management overhead, and onboarding time, and none of them carries end-to-end accountability for the final result. An integrated provider that handles audit, remediation, and certification together typically reduces both total cost and the coordination burden on your internal team.
How long does a typical IAAP-led accessibility audit take?
Timelines vary with the size of the site or app and the depth of testing required, but a manual audit combined with automated scanning commonly takes anywhere from a couple of weeks for a small site to several weeks or more for a large, complex product. Ask any vendor for a timeline tied to your specific scope rather than a generic estimate.
The Bottom Line
Hiring the right IAAP auditor isn't just about ticking a compliance box — it's about finding a partner who can verify their credentials on request, fix what they uncover instead of just reporting it, test against current standards rather than outdated checklists, and deliver with a team that has real capacity behind the certification. Ask the hard questions upfront, insist on speaking directly with the certified professional, and push for an integrated audit-to-fix-to-certification process rather than a fragmented one. Doing this diligence before you sign will save you money, time, and a frustrating second round of vendor hunting down the line.
Looking for an integrated accessibility partner with verified IAAP-certified auditors on staff? Talk to EquiView about a single-team audit, remediation, and certification process.