What is the best way to create a district-wide edtech accessibility audit in 2027?

What a real district faces when the complaint arrives

Picture a district of 18,000 students across 24 schools. A parent of a ninth grader who uses JAWS files an OCR complaint because the math platform the district bought in 2025 renders equations as unlabeled images. The district's technology director pulls a list of licensed products and discovers it has 340 distinct edtech tools in active use — 62 centrally purchased, the rest adopted by individual schools, departments, or teachers using building budgets and free tiers.

That gap is the actual problem. The complaint names one product, but OCR resolution agreements routinely extend to the full digital ecosystem, and the district cannot describe its own ecosystem. Nobody owns the list. The curriculum office knows about the reading intervention platform; the athletics department has its own scheduling tool; three high schools independently licensed different AI tutoring products during the 2026 school year. Single sign-on covers maybe 90 of the 340. The rest authenticate with Google Classroom links, class codes, or nothing at all.

When districts try to respond to this reactively — auditing only the product named in the complaint — they end up in a rolling cycle of complaints, because the underlying condition (uncontrolled adoption, no accessibility gate at purchase) never changes. The district that resolved a complaint about its math platform in 2026 gets a new complaint about its library catalog in 2027.

A district-wide audit exists to break that cycle. It has two products: a defensible snapshot of where the district stands today, and a governance change that makes the snapshot stay accurate. If you only produce the first, you have bought a document. If you produce both, you have bought a system. The audits that hold up under legal scrutiny are the ones where the district can show not just findings but a dated remediation plan with owners, and a procurement process that blocks new violations at the front door.

The scenario matters because it sets the scope honestly. You are not auditing a website. You are auditing a sprawl of licensed software, teacher-adopted free tools, district-authored documents, LMS course shells, videos, and PDFs — each with a different owner, a different contract, and a different remediation path.

How the audit mechanism actually works

The audit is a pipeline, not an event. Each stage feeds the next, and each stage produces an artifact you can hand to a lawyer, a vendor, or a school board.

Stage one: discovery. You cannot audit what you have not found. Three data sources, combined, give you a defensible inventory. First, the finance system — every purchase order and P-card transaction coded to software or instructional materials for the trailing 24 months. Second, network and identity telemetry — SSO logs from Google Workspace or Microsoft Entra, plus DNS or web-filter logs showing which domains students actually hit during school hours. Third, a teacher survey, which catches free-tier tools that never touched a budget and never used SSO. Districts consistently find that telemetry surfaces 2–4× more tools than the purchase record alone.

Stage two: tiering. Not every tool gets the same depth of review. Tier the inventory by three factors: number of students required to use it, whether use is mandatory or optional, and whether it touches graded work or assessment. A platform that every ninth grader must use for graded math homework is Tier 1. A club sign-up form used by 40 students is Tier 3. Tier 1 gets full manual review. Tier 2 gets automated scanning plus a targeted keyboard pass. Tier 3 gets a VPAT review and a documented risk acceptance.

Stage three: evidence collection. For each tool, gather the vendor's Accessibility Conformance Report (the ACR, produced using the VPAT template maintained by ITI), any third-party audit the vendor commissioned, and the vendor's published accessibility statement with a remediation roadmap. Read the ACR critically — "supports" claims are self-reported, and a report that marks every criterion as fully supporting with no exceptions is a red flag, not a green light.

Stage four: testing. Automated tooling first, because it is cheap and fast, then manual, because automation catches a minority of real barriers. Then human testing with assistive technology on the actual workflows students perform.

Stage five: findings and remediation. Every issue gets a WCAG success criterion reference, a severity, a screenshot or recording, a reproduction path, and an owner. Vendor issues go into a remediation agreement with dates. District-created content issues go to the staff who created it.

Stage six: governance. Procurement language, a review gate, and a recurring re-audit cycle.

The loop back from re-audit to inventory is the part districts skip. Without it, the inventory is stale within a semester, because teachers keep adopting tools.

The testing method that produces defensible findings

Automated scanning is the starting point and the weakest link. Open-source engines like axe-core and the WAVE tooling from WebAIM catch programmatically detectable failures — missing alternative text, form inputs without labels, insufficient color contrast, missing document language, duplicate IDs. That is genuinely useful, and it is a fraction of the real barrier surface. Automated tools cannot tell you whether alternative text is *meaningful*, whether focus order matches visual order in a way that makes sense, whether a custom dropdown announces its state correctly, or whether a timed assessment gives a student using a switch device enough time.

So layer the testing.

Keyboard-only pass. Unplug the mouse. Complete the core student workflow start to finish: log in, open an assignment, enter an answer, submit, view feedback. Watch for focus traps (you tab into a modal and cannot get out), invisible focus (you cannot see where you are), and unreachable controls. This single pass finds more high-severity issues in edtech than any automated scan, and it requires no specialized software.

Screen reader pass. Test with at least two combinations, because behavior differs meaningfully: NVDA with Firefox or Chrome on Windows, and VoiceOver with Safari on macOS or iPadOS. If your district is one-to-one Chromebook, add ChromeVox, because that is what a student will actually have. Test the same core workflow. Note whether headings create a usable outline, whether dynamic content changes are announced, and whether images carrying instructional meaning have text alternatives.

Zoom and reflow. Set browser zoom to 200% and 400% at a 1280px viewport. Content must reflow into a single column without horizontal scrolling and without cutting off controls. Math platforms and data dashboards fail here often.

Color and contrast. Check text against WCAG 2.1 AA thresholds: 4.5:1 for normal text, 3:1 for large text and for user interface components and graphical objects. Also check that color is never the only means of conveying information — a gradebook that marks late work in red and nothing else fails this.

Media. Sample the video library. Captions must be accurate and synchronized, not auto-generated and left unreviewed. Auto-captions on technical vocabulary — chemistry terms, historical names, mathematical language — degrade badly. Audio description is required for visual information not conveyed in the narration.

Documents. PDFs are where districts lose. Scanned handouts with no text layer are invisible to a screen reader. Test a sample: does the PDF have real text, tagged headings, a reading order, and alt text on figures?

Assistive technology users in the loop. The strongest evidence in any audit comes from testing sessions with students and staff who actually use assistive technology daily. A compliance checklist tells you a control is technically operable; a user tells you it takes eleven keystrokes when it should take two. Pay them, schedule them, and record their sessions with consent.

Every finding gets recorded the same way: tool name, URL or screen, WCAG 2.1 success criterion number, conformance level, severity, what a student experiences, reproduction steps, and evidence. That structure is what makes a finding actionable for a vendor and credible for OCR.

Real numbers, timelines, and what this costs

Districts consistently underestimate scope and overestimate speed. Concrete planning ranges, based on how this work actually distributes:

Inventory size. A district under 5,000 students typically surfaces 80–200 distinct tools. A district of 15,000–30,000 typically surfaces 250–500. Large urban districts routinely exceed 1,000. Expect the telemetry-derived number to be several times larger than the finance-derived number.

Tiering distribution. Roughly 5–10% of tools land in Tier 1, 20–30% in Tier 2, and the remainder in Tier 3. In a 340-tool district that is roughly 20–34 tools needing full manual review — a manageable number, and the reason tiering is worth the effort.

Time per tool. A full manual Tier 1 audit of a substantial platform runs 12–30 hours for a trained tester, covering multiple roles (student, teacher, parent portal) and multiple workflows. A Tier 2 automated-plus-keyboard pass runs 2–4 hours. A Tier 3 VPAT review runs 30–60 minutes. Multiply honestly: 25 Tier 1 tools at 20 hours each is roughly 500 hours, which is a quarter to a third of one full-time person's year on Tier 1 alone.

Total timeline. A credible district-wide audit runs 6–12 months from kickoff to a published findings report and remediation plan. Discovery takes 6–10 weeks. Testing takes 3–6 months. Findings consolidation and vendor negotiation takes 6–10 weeks. Compressing this below six months usually means the inventory was incomplete.

Cost. Two models. Internal staffing means one dedicated accessibility coordinator plus trained testers — a single coordinator position plus tooling and training is the common floor. External consulting is typically priced per tool or per audit day; districts running a hybrid model use consultants for Tier 1 platforms and legally sensitive findings while handling Tier 2 and 3 internally. The hybrid is usually the best value because it builds internal capability instead of renting it annually. Budget for recurring cost, not one-time: a re-audit cycle, license renewals for testing tooling, and captioning services are ongoing lines.

Remediation windows. Give vendors defined windows tied to severity. A common structure: critical barriers blocking access to required instructional content in 30–60 days, high-severity in 90 days, medium within two release cycles or 180 days. Put these in the contract, not in an email.

Regulatory context. The 2024 Department of Justice rule under Title II of the ADA set WCAG 2.1 Level AA as the technical standard for state and local government web content and mobile apps, with compliance deadlines that fall in April 2026 for public entities serving 50,000 or more people and April 2027 for smaller entities and special district governments. Many school districts fall into that second cohort, which is exactly why 2027 audits are urgent rather than optional. Confirm which deadline applies to your district with counsel — the population threshold refers to the population of the jurisdiction the entity serves, and districts should not assume.

Trade-offs: build it internally, buy it, or blend

There is no single right structure, and the wrong choice is usually made for budget reasons and regretted for capability reasons.

Fully internal. You hire or designate an accessibility coordinator, train a small testing team from existing instructional technology staff, and run everything in-house. Advantages: cheapest at steady state, builds durable institutional knowledge, and the testers understand your actual curriculum and workflows. Disadvantages: slow to start (training a competent manual tester takes months, not weeks), and internal findings carry less weight in a vendor negotiation or a legal proceeding than a third-party report. Districts also struggle with the conflict of interest when the person auditing a platform is the person who recommended buying it.

Fully external. You contract a specialist firm to inventory, test, and report. Advantages: fast, credible, and the report is independent. Disadvantages: expensive per cycle, and when the engagement ends the capability leaves with it. You will pay again next year. External auditors also do not know your workflows — they will test the generic student path and miss the specific way your ninth-grade math sequence uses the tool.

Hybrid. External firm handles Tier 1 platforms, the initial methodology, and tester training; internal team handles Tier 2 and 3, ongoing spot checks, and the procurement gate. This is where most districts land after one cycle, and it is generally the right default.

Vendor self-attestation only. Some districts collect VPATs and stop. This is not an audit and will not survive scrutiny. A VPAT is a vendor's own claim, often written by a sales engineer, sometimes years stale, and frequently describing a product version you are not running. Use ACRs as an input and a negotiating lever, never as the finding.

Automated-only. Some districts buy a scanning platform, run it against every domain, and call the resulting dashboard an audit. The dashboard is useful for tracking regressions over time and genuinely valuable for district-authored web content at scale. It is not sufficient, because most severe barriers in interactive edtech are not automatically detectable, and because scanners cannot log in to test the authenticated experience where students actually spend their time.

Pitfalls that sink district audits

Auditing the marketing site instead of the product. The vendor's public homepage is usually accessible. The authenticated student experience is where the failures live. Every Tier 1 test must be done logged in, as a student, on the workflows students are required to complete.

Skipping the mobile and Chromebook reality. If your district is one-to-one with Chromebooks or iPads, test on those devices with those screen readers. A tool that passes on Windows with NVDA can fail on ChromeOS with ChromeVox.

Treating the audit as a technology department project. Curriculum owns tool selection, special education owns the student needs, procurement owns the contracts, and legal owns the exposure. An audit run by technology alone produces findings nobody is empowered to fix. Stand up a cross-functional group with a named executive sponsor at cabinet level before you start testing.

No procurement gate. This is the single biggest failure. If teachers and departments can adopt new tools without an accessibility review, your audit is obsolete the day you publish it. The gate does not have to be heavy: require an ACR for any tool used by more than a threshold number of students or touching graded work, require an accessibility clause in the contract, and route exceptions through a documented review with a risk acceptance signed by an administrator.

Contract language that has no teeth. "Vendor will make reasonable efforts to conform to accessibility standards" is unenforceable. Write specific language: the product conforms to WCAG 2.1 Level AA, the vendor provides a current ACR, the vendor remediates identified critical defects within a defined window, the district may terminate without penalty for uncured material accessibility defects, and the vendor indemnifies the district for claims arising from the product's inaccessibility.

Ignoring district-created content. Teacher-made PDFs, LMS course shells, videos posted to the district site, and school newsletters are district responsibility, not vendor responsibility. In most audits this category produces more findings than the licensed platforms do. Pair the audit with staff training and accessible-document templates, or you will re-find the same issues annually.

Publishing findings with no owner or date. A findings report that lists 900 issues with no severity, no owner, and no target date is worse than useless — it documents knowledge of barriers with no plan, which is precisely the posture that turns a complaint into a finding.

Under-scoping remediation of the backlog. You will find more than you can fix at once. That is expected and defensible, as long as you have a prioritized, dated, resourced plan. Prioritize by student impact: barriers blocking a required graded activity for a student with a documented need come first, always.

Letting the inventory die. Re-run discovery telemetry quarterly. Adoption is continuous, so discovery has to be too.

Related questions

How often should a district re-audit its edtech tools?

Full re-audit annually for Tier 1 platforms, since vendors ship changes continuously and a passing result ages fast. Run automated scans monthly on district-owned web content, and re-run discovery telemetry quarterly to catch newly adopted tools before they become entrenched.

Does a vendor VPAT satisfy the audit requirement?

No. A VPAT-based Accessibility Conformance Report is a vendor self-assessment, frequently stale and sometimes describing a different product version. Use it as an input, a negotiating lever, and a contract artifact — but the district still needs its own testing evidence on the workflows students actually use.

Who should own the audit inside the district?

A cross-functional group: technology, curriculum, special education, procurement, and legal, with a cabinet-level sponsor. Technology alone cannot fix curriculum-selected tools or rewrite contracts. Name one accountable coordinator, or ownership diffuses and the remediation plan stalls after the report is published.

What accessibility standard should a district audit against?

WCAG 2.1 Level AA is the operative technical standard under the DOJ's 2024 Title II rule for state and local government web content and mobile apps. Section 508 standards also reference WCAG for federally funded contexts. Audit against WCAG 2.1 AA and confirm your compliance deadline with counsel.

What should be fixed first when findings exceed capacity?

Barriers blocking a student with a documented need from completing required, graded instructional activity. Then mandatory-use Tier 1 platforms, then high-reach optional tools, then district-created documents and media. Publish the prioritization logic so the sequencing is defensible rather than arbitrary.

FAQ

How long does a district-wide edtech accessibility audit actually take?

Six to twelve months from kickoff to a published report and remediation plan for a district of moderate size. Discovery alone runs six to ten weeks because reconciling finance records, SSO logs, and teacher survey responses surfaces far more tools than anyone expects. Testing is the long pole at three to six months. Any timeline under six months usually means the inventory was incomplete, which is the failure mode that produces a report that does not survive its first complaint.

Can automated scanning tools do the whole audit?

No. Automated engines like axe-core and WAVE catch programmatically detectable failures — missing alt text, unlabeled form fields, contrast ratios, missing page language — and that is genuinely valuable for tracking regressions across district-owned web content. But they cannot evaluate whether alt text is meaningful, whether focus order is sensible, whether a custom widget announces its state, or whether a timed assessment is operable with a switch device. They also cannot log in, which means they never see the authenticated student experience where the real barriers live.

What do we do about the hundreds of free tools teachers adopted on their own?

Tier them and be honest about capacity. Most will be Tier 3: review the vendor's ACR if one exists, document a risk acceptance for low-reach optional tools, and focus real testing on anything that touches required or graded work. Then close the front door with a procurement and adoption policy so the list stops growing uncontrolled. Sunsetting redundant tools during this process is often the highest-value outcome — districts routinely find five products doing the same job.

How do we get vendors to actually fix what we find?

Leverage sits in the contract and the renewal. Provide a specific, reproducible finding with the WCAG success criterion, severity, and evidence — vague complaints get vague responses. Attach a remediation window tied to severity, put it in writing, and tie it to renewal. For new contracts, include a conformance warranty, a current-ACR requirement, defined cure periods, termination rights for uncured material defects, and indemnification. Districts that negotiate as a consortium get faster movement than districts negotiating alone.

Is district-created content part of the audit scope?

Yes, and it usually produces the largest volume of findings. Teacher-made PDFs, scanned worksheets with no text layer, LMS course shells, uncaptioned or auto-captioned video, and school websites are entirely district responsibility. Sample rather than attempting to audit everything, identify the systemic causes — usually a scanning workflow or an untrained template — and pair remediation with staff training and accessible templates so the same issues do not regenerate every year.

What is the minimum viable version if we have almost no budget?

Do discovery, tiering, and a keyboard-only pass on your top ten mandatory platforms. That combination is free apart from staff time and finds a disproportionate share of high-severity barriers. Add a procurement gate requiring an ACR for new purchases — that costs nothing and prevents the backlog from growing. Document what you did, what you found, and your prioritized plan. A small, honest, dated audit with a real remediation plan is far more defensible than no audit at all.

Sources

• https://www.w3.org/WAI/WCAG21/quickref/ — W3C WAI, WCAG 2.1 quick reference for success criteria
• https://www.ada.gov/resources/2024-03-08-web-rule/ — U.S. Department of Justice, Title II web and mobile app accessibility rule
• https://www.ed.gov/laws-and-policy/civil-rights-laws/disability-discrimination — U.S. Department of Education, Office for Civil Rights disability discrimination resources
• https://www.section508.gov/ — U.S. General Services Administration, Section 508 program guidance
• https://www.itic.org/policy/accessibility/vpat — Information Technology Industry Council, VPAT template and ACR guidance
• https://webaim.org/techniques/ — WebAIM accessibility testing techniques and evaluation guidance
• https://www.deque.com/axe/ — Deque Systems, axe accessibility testing engine documentation
• https://www.nvaccess.org/about-nvda/ — NV Access, NVDA screen reader
• https://www.w3.org/WAI/test-evaluate/ — W3C WAI, evaluating web accessibility guidance
• https://www.cast.org/ — CAST, Universal Design for Learning framework

Related on PULSE

• How to write accessibility requirements into an edtech procurement contract
• Building a K-12 software inventory from SSO and network telemetry
• WCAG 2.1 AA vs. Section 508: what school districts actually have to meet
• Remediating teacher-created PDFs at district scale
• How to run assistive technology user testing sessions with students
• Sunsetting redundant edtech tools after an inventory audit