Our audit report has more than a hundred findings. Where do we start?

With the findings that sit in templates and components and affect many pages at once. Across the web those are typically low contrast text, missing alternative text, missing form labels, empty links, empty buttons and a missing document language - 96 percent of all detected errors fall into these six categories (WebAIM Million, 2026). Interaction logic follows, and the video and document libraries come last. How an official audit unfolds, and how your plan feeds into it, is described in the article on [BFSG market surveillance](/en/blog/bfsg-market-surveillance-audit-process-2026/).

Is it enough to fix the findings on the audited pages?

Typically not. The audit works with a sample - at least three pages for simple, consistently designed offerings, five to ten or more for complex ones (BIK BITV-Test) - extended by a random sample amounting to ten percent of the structured sample set (W3C, WCAG-EM 2.0). A finding therefore usually stands for a pattern in a template or a component. Fix it there, not page by page. What that looks like for input is shown in the article on [accessible forms and validation](/en/blog/accessible-forms-validation/).

How long may the remediation take?

The law does not name a fixed number. Where the market surveillance authority concludes that the requirements are not met, it sets an appropriate deadline for suitable measures (Section 29 (1) BFSG); if corrective measures fail to appear, a second request follows under the threat of prohibiting the service (Section 29 (2) BFSG). Administrative offences can be fined up to one hundred thousand euros in the cases named there, and up to ten thousand euros in the remaining cases (Section 37 (2) BFSG). What is required in substance is set out under [BFSG requirements](/en/bfsg-requirements/).

Who should own the remediation plan?

Someone with access to the templates and to content maintenance, not the evaluation body. The audit supplies place, element and point in time (BIK BITV-Test); translating that into tasks, roles and dates belongs in your organisation, because that is where the effort arises and where budgets are decided. A fixed handover session after the report works well, giving every finding a role and a due date. We moderate that handover on request; the way there runs through [contact](/en/contact/).

From Audit Report to Remediation Plan: Ranking Findings

Q: Can we turn the findings into a score to show progress?

It is possible, but it rarely holds up. The BITV-Test does not provide for scoring or weighting of individual test steps (BIK BITV-Test), and WCAG-EM 2.0 states that there is currently no single metric known to address the required reliability, accuracy and practicality (W3C, WCAG-EM 2.0). The share of closed findings per wave, together with the number of open component findings, says more. We supply that view with every [WCAG audit](/en/wcag-audit/).

Q: Do we need a full audit again after remediation?

A retest scoped to the affected requirements and pages is usually enough. A full audit pays off when templates, components or the payment flow have been rebuilt. Keep in mind that the conformance of a web page can be confirmed for the time of the test alone and that later changes can affect it (BIK BITV-Test). Between two audits, ongoing [accessibility monitoring](/en/accessibility-monitoring/) keeps the current state visible.

A WCAG audit report ends where the actual work begins. It tells you which requirement fails where, and it does so thoroughly: the BIK BITV-Test covers 88 requirements in 98 test steps (BIK BITV-Test), and a report lists the outcome for every audited page separately. What it does not tell you is where your team starts on Monday. This article shows how a list of findings becomes a remediation plan with a ranking, clear roles and a retest - and why no single score should decide the order.

Key takeaways

An audit report is a snapshot of the audited pages (BIK BITV-Test) and not a remediation plan: the order of implementation is not part of it.
Scoring and weighting of individual test steps are explicitly not part of the BITV-Test (BIK BITV-Test); WCAG-EM 2.0 warns that aggregated scores can be misleading (W3C, WCAG-EM 2.0).
96 percent of all detected errors fall into six categories (WebAIM Million, 2026). Clearing those six patterns in templates and components reaches many pages with few changes.
Four axes carry the ranking: user impact, spread across pages, legal position and implementation effort. Their interplay produces the order, not a formula.
Where a service fails, the market surveillance authority sets an appropriate deadline for suitable measures (Section 29 (1) BFSG). A dated remediation plan is then the basis of your answer.
A finding counts as closed only after a retest in the same place: conformance can be confirmed for the time of the test alone (BIK BITV-Test).

What an audit report delivers and what it leaves open

An audit report is organised by test step and by audited page. That is correct for the audit and unsuitable for the work that follows: the structure follows the numbering of the standard, not your source code. A single error in the header of a template shows up as six separate findings on six pages, while a costly rebuild of the checkout sits in a single line. Working the list from top to bottom means working in the order of the success criteria - and that order has little to do with the benefit for your visitors. What is tested are the requirements of EN 301 549; on 1 March 2021, 32 test steps from chapters 5, 6, 7, 11 and 12 were added, and six more on 12 February 2022 (BIK BITV-Test). How the standard is built is explained in the article on EN 301 549.

What the report does deliver reliably is the basis of every prioritisation. As soon as a rating comes out worse than met, a note is mandatory that describes the defect and states which element of the view is affected (BIK BITV-Test); wherever possible, recommendations for implementation should be added (BIK BITV-Test). On top of that come the list of audited pages, screenshots that locate the defects, and the audit date. Exactly these details - place, element, point in time - are what you need to turn findings into tasks. Which testing approaches contribute what share is covered in the article on testing methods and tools.

The scoring trap

An overall grade looks convenient and leads you astray. In the BIK BITV-Test, scoring and weighting of individual test steps are explicitly not provided for (BIK BITV-Test). WCAG-EM 2.0 puts it even more clearly: there is currently no single metric known to address the required reliability, accuracy and practicality; aggregated scores can be misleading and do not provide sufficient context to understand the actual accessibility of a digital product (W3C, WCAG-EM 2.0). No order can be derived from an overall grade - it can be derived from notes that name a place.

The four axes of prioritisation

Prioritising means asking four questions of every finding and putting the answers side by side. None of the four replaces the others, and none can be cast into a formula. Together they produce a ranking you can justify to your management, to an authority and to the people affected. That is the difference between a plan and a sorted list.

The first axis carries the most weight. A missing alternative text on a decorative image costs a screen reader user a second; a form field without a label costs her the completion. Both are deviations from the same conformance level, and both sit in the report as equals. That distinction is not made by the standard, it is made by you. The distribution across the wider web helps here: low contrast text was detected on 83.9 percent of the home pages examined, missing alternative text on 53.1 percent, missing form labels on 51 percent (WebAIM Million, 2026). How contrast is measured and where the thresholds sit is covered in the article on colour contrast in accessibility.

User impact

Does the finding block a task or merely slow it down? A control that cannot be reached with the keyboard ends the process. A vaguely worded alternative text delays it. Both need fixing, but not in the same week.

Spread across pages

Does the finding sit in a template, in a component or on a single page? WCAG-EM 2.0 considers it good practice for evaluators to indicate issues that occur repeatedly (W3C, WCAG-EM 2.0). A component defect is one change with multiplied effect.

Legal position

Does the finding affect a step an authority will look at in its sample anyway? Annex 1 to the BFSG names the home page, login, sitemap, contact, help pages and pages with legal information explicitly (Federal Ministry of Justice).

Implementation effort

A language attribute on the root element is one attribute. Captions for an existing video library are a project with a budget and suppliers. Effort does not decide whether something is fixed, only in which wave.

The fourth axis is often named first and should be weighed last. Effort is a property of your organisation, not of the finding: what costs an hour in a maintained design system costs a week in a template collection that has grown over years. That is why the order within a wave is negotiable while the assignment to a wave is not. How effort and benefit spread across an audit year is shown in the article on audit cost and return.

From rating to ranking

Test steps in the BIK BITV-Test are rated on a five-level scale: met, mostly met, partly met, mostly not met, not met (BIK BITV-Test). The evaluation body explains this gradation with the fact that developers and editors can derive priorities for improvements from graded ratings better than from a met or not met outcome (BIK BITV-Test). For the conformance result the scale is collapsed again; for your remediation plan the finer gradation is the more useful tool.

In practice this means reading the report twice. The first pass shows which requirements stand in the way of conformance. The second pass shows how far a finding sits from met. A test step rated mostly not met typically needs a correction to existing code, a test step rated not met often needs a rebuild. That distinction separates wave one from wave two more reliably than any early estimate in person days. Which criteria came with WCAG 2.2 and where they typically apply is covered in the article on the new WCAG 2.2 criteria.

Finding in the report	User impact	Effort	Wave
Document language is missing	Wrong pronunciation, entire page	One attribute in the template	Wave 1
Text contrast below the threshold	Text stays unreadable with low vision	Colour values in the design system	Wave 1
Form field without a label	Input becomes guesswork, completion at risk	Markup per field, check the template	Wave 1
Empty link, empty button	Target unclear, operation breaks off	Text alternative per component	Wave 2
Focus order jumps inside a dialog	Keyboard users lose their place	Rebuild of the dialog component	Wave 2
Video without captions	Content closed to deaf users	Production, review, integration per video	Wave 3

The order lives in the plan, not in the report

An audit report rates test steps per page. A remediation plan assigns tasks per component and per role, with a date and a place to record the proof. The transition between the two is manual work, and it is the point where an audit either pays off or disappears into a folder. We deliver that transition as part of every WCAG audit.

Three remediation waves instead of one long list

Three waves are enough in practice. More levels create coordination overhead, fewer levels create a list again. The assignment follows two of the four axes: impact and effort. Spread and legal position move individual findings up but do not form a wave of their own. This keeps the plan readable even when the report runs to several hundred lines.

Wave one clears what affects many places and costs little. This is where the leverage sits that the survey data makes visible: 96 percent of all detected errors fall into six categories (WebAIM Million, 2026). They are low contrast text, missing alternative text, missing form labels, empty links, empty buttons and a missing document language (WebAIM Million, 2026). Apart from the alternative texts, these are changes to templates and components, not to individual pages. Content shown on hover or focus belongs in the same wave when it covers text or cannot be dismissed - see the article on tooltips and content on hover or focus.

Wave one, a few weeks: templates and components. Document language, contrast values, labels, text alternatives on components, visible focus. One change takes effect on every page that uses the component.
Wave two, one quarter: interaction logic. Focus management in dialogs and menus, status messages, keyboard operation of dynamic components, error messages in text rather than in colour alone. This is rebuilding, not correcting.
Wave three, annual planning: libraries and processes. Captions and transcripts for existing videos, document archives, third-party systems in the payment flow, supplier contracts. These tasks need a budget and people outside web development.

Assignment: who takes which finding

A remediation plan without roles is a wish list. The assignment follows the place in the system, not the number of the success criterion: whoever maintains the template gets the template findings; whoever publishes content gets the content findings; whoever buys gets the findings in third-party components. This split can be derived from any report, because every finding names the affected element.

The split is also a cost question. An editorial finding that lands in development costs a coordination round and comes back as a question. Conversely, a component defect that the editorial team works around page by page turns into a permanent burden. We therefore hand over the plan in two views - one for accessible web development and one for content maintenance.

Every finding carries a role, not a team: template maintenance, content maintenance, purchasing, third-party system.
Every finding carries the location from the report: address, page state, affected element.
Every finding carries a due date that matches its wave, and a field for the proof of remediation.
Findings that occur repeatedly are described once and located many times, not described many times.
Findings in third-party components carry the supplier name and the date of the request.
Content findings are accompanied by training, otherwise they reappear with the next article.

Pattern or single case: the spread decides

Spread is the axis most often overlooked. An audit works with a sample: the minimum for simple, small and consistently designed web offerings is three pages, while complex offerings can require five to ten pages or more (BIK BITV-Test). WCAG-EM 2.0 adds a random sample amounting to ten percent of the structured sample set (W3C, WCAG-EM 2.0). German law follows the same principle: Annex 1 to the BFSG requires further randomly selected pages and documents, where available, amounting to at least 10 percent of the defined sample (Federal Ministry of Justice).

Two things follow. First, a finding on an audited page typically stands for a pattern rather than a single case. Second, your remediation plan has to reach beyond the audited pages, otherwise it fixes samples instead of causes. For every finding, check whether it comes from a template, a component or an editorial habit - and fix it there. This matters even more behind a login, where the sample is smaller and access has to be arranged; see the article on auditing accessibility behind the login.

What the plan has to cover beyond the report

WCAG-EM 2.0 states that WCAG 2 conformance claims cannot be made for entire websites based upon the evaluation of a selected sub-set of web pages and functionality alone (W3C, WCAG-EM 2.0). The remediation plan closes that gap not through more testing but through work on the causes in templates and components. It should also include formats that are frequently missing from the audit scope - such as sign language videos for central explanations.

Retest: when a finding counts as closed

A finding counts as closed once it has been tested again in the same place and the rating has changed. Anything else is a status update. The evaluation body states plainly that web offerings change continuously, that an audit is therefore only a snapshot, and that the conformance of a web page can be confirmed for the time of the test alone (BIK BITV-Test). A remediation plan without a retest documents intentions, not results.

A retest rarely needs every test step. A sensible scope covers the requirements that produced findings plus the pages the change touched. Automated tools help, but they do not replace the audit: most WCAG and BITV requirements cannot be ensured or checked automatically (BIK BITV-Test), and the annual survey states explicitly that the absence of detected errors does not indicate that a page is accessible or conformant (WebAIM Million, 2026). Between two audits, ongoing accessibility monitoring keeps the current state visible.

Further randomly selected pages and documents, where available, amounting to at least 10 percent of the sample defined under double letters aa to ff.

Annex 1 to the BFSG, number 2 letter b double letter gg, translated from the German original (Federal Ministry of Justice)

This line is the reason a remediation plan should carry dates. Where the market surveillance authority concludes that a service does not meet the accessibility requirements, it requires the service provider without delay to take suitable measures within an appropriate deadline set by the authority in order to establish conformance (Section 29 (1) BFSG). Presenting a running plan with waves, roles and evidence typically gives you a basis for the conversation about that deadline; presenting a plain list of findings does not. Externally, the current state also belongs in the accessibility statement with a feedback mechanism.

Sources and studies

This article draws on: the German Accessibility Strengthening Act (BFSG), Section 29 and Section 37 as well as Annex 1 to Section 28 (Federal Ministry of Justice); WCAG Evaluation Methodology (WCAG-EM) 2.0, W3C Group Note of 23 July 2026 (W3C, WCAG-EM 2.0); the description of the test procedure of the BIK BITV-Test (BIK BITV-Test); The WebAIM Million 2026, an analysis of one million home pages from February 2026 (WebAIM Million, 2026).