Digital Compliance
What a Compliance Report Actually Looks Like
A Full Sample, Start to Finish
The hardest part of buying a compliance audit is that you cannot see it before you buy it. You are asked to pay for a document, sight unseen, from someone who has just told you your website has problems.
So here is a complete one. Northline Outfitters is not a real company. The findings are. Every one below is a pattern we have found on real Ontario websites, reassembled into a single example so you can see an entire report without us exposing anyone's client. The format is the format we actually deliver, with nothing dressed up and nothing held back for the paid version.
Scope
Every report opens here, because a finding without a scope is not worth much. This section says what was looked at and, just as importantly, what was not.
| Item | Detail |
|---|---|
| Organization | Northline Outfitters Ltd., Ontario |
| Property | northlineoutfitters.ca, Shopify storefront |
| Headcount stated by client | 31 employees, full time and seasonal combined |
| Customers outside Ontario | United States, roughly 20 percent of orders. No EU. No Quebec |
| Standards tested against | Web Content Accessibility Guidelines, the technical standard the AODA points at 2.0 Level A and AA, with the WCAG 2.1 additions reported separately |
| Privacy criteria | P1 to P12, Canadian lane |
| Pages reviewed | 14 routes, including cart and checkout |
| Date tested | July 14, 2026 |
| Method | Automated scan, then manual review of every criterion by hand |
Automated testing reliably catches roughly a quarter to a third of the accessibility issues on a page. The rules that exist touch only a minority of the criteria; the rest need a person to judge context, meaning or an actual interaction. That is not a caveat buried at the back of our reports, it is on the second page of every one. It is also why the method line above says what it says.
What actually applies to Northline
Before any finding means anything, we establish which obligations are live. At 31 employees in Ontario, selling into the United States, with no EU or Quebec exposure, that comes out as follows.
| Regime | Applies? | Why |
|---|---|---|
| Accessibility for Ontarians with Disabilities Act compliance report | Yes | The filing obligation starts at 20 employees. Due December 31, 2026 |
| Accessibility for Ontarians with Disabilities Act website standard | No | The Web Content Accessibility Guidelines, the technical standard the AODA points at mandate for public websites starts at 50 employees |
| Ontario's human rights law, which applies at any size and has no employee threshold | Yes | No employee threshold exists. Applies at any size |
| Personal Information Protection and Electronic Documents Act, Canada's federal privacy law | Yes | Commercial activity, any size |
| Canada's Anti Spam Legislation, which governs what you send rather than what you collect | Yes | Northline sends marketing email |
| United States Americans with Disabilities Act, which has no company size exemption | Yes | No size exemption, and roughly a fifth of orders ship there |
| Quebec's privacy law, stricter than PIPEDA and expecting tracking to be off until a visitor turns it on | Not raised | No stated Quebec customers or establishment |
| European Accessibility Act | Not raised | No EU sales |
Two of these are worth reading twice. The Accessibility for Ontarians with Disabilities Act website standard does NOT apply to Northline, so nothing in this report should be described as an AODA website violation. The December filing does apply, and it is a self attestation somebody signs.
That distinction is the one most compliance vendors get wrong, in the direction that favours them. A 31 person company is routinely told it is legally required to meet Web Content Accessibility Guidelines, the technical standard the AODA points at on its website. It is not. It is required to file a report, and the honest sale is helping them know what to put on it.
Privacy findings
Twelve criteria, tested by hand against what the site actually did on a clean first load.
| Criterion | Result | What was observed |
|---|---|---|
| P1 Notice at or before collection | Fail | Google Analytics 4 and the Meta pixel set identifiers 1.2 seconds after load. No notice appeared before that |
| P2 Consent mechanism works | Fail | A banner exists. After clicking Decline, _ga, _ga_XXXXXXXX and _fbp were all still set and 6 tracking requests still fired |
| P3 First party privacy policy | Pass | Reachable at /pages/privacy-policy, on the operator domain, naming Northline Outfitters Ltd. |
| P4 Third parties named | Fail | The policy names Google. It does not mention Meta, which receives visitor browsing data |
| P5 Purpose stated at collection | Fail | The banner says we use cookies to improve your experience. It does not say what is collected or why |
| P6 Accountable contact | Pass | A privacy contact and a monitored address are published in the policy |
| P7 Withdraw or opt out | Fail | No way to reopen the banner or change a choice once made |
| P8 Ad and profiling tags gated | Fail | Consent Mode v2 signals absent. Ad tags fire at default |
| P9 Cookie inventory accurate | Pass | No functional cookies mislabelled. Session cookies correctly excluded |
| P10 No sensitive categories | Pass | No health, financial or child directed content in tracked paths |
| P11 Quebec exposure | Not applicable | No stated Quebec presence |
| P12 EU and children | Not applicable | No EU sales. Audience is adult |
The one to read first is P2. Northline's banner offers its customers a choice, and that choice does nothing. That finding needs no statute to be worth fixing. It is a promise the business made to its own visitors that is not currently true, and it is the single most persuasive line in this report.
On P1, note what the report does not say. It does not say Northline is breaking the law. Canada permits implied consent for non sensitive tracking, but the Privacy Commissioner attaches conditions. The Office of the Privacy Commissioner of Canada's Guidelines for Obtaining Meaningful Consent, published in 2018 and in force since January 2019, ask that the purposes be obvious rather than buried in a policy, that notice come at or before collection, that opting out be easy, and that the opt out actually take effect and stay in effect. Northline currently meets none of the four. Every finding in this report is written the same way: the criterion, the guidance or standard it comes from, the page it was found on, and what was observed. That is what we mean when we say a finding is sourced rather than asserted.
Accessibility findings
The Accessibility for Ontarians with Disabilities Act points at Web Content Accessibility Guidelines, the technical standard the AODA points at 2.0, and at Level A and AA that is 38 criteria, 25 at Level A and 13 at Level AA. That is the standard the December filing references. Eleven failed. The WCAG 2.1 additions are reported separately below so that nothing gets mislabelled.
| Grouping | Tested | Passed | Failed | Not applicable |
|---|---|---|---|---|
| Perceivable | 14 | 6 | 3 | 5 |
| Operable | 12 | 7 | 4 | 1 |
| Understandable | 10 | 7 | 3 | 0 |
| Robust | 2 | 1 | 1 | 0 |
| Web Content Accessibility Guidelines, the technical standard the AODA points at 2.0 A and AA total | 38 | 21 | 11 | 6 |
| Web Content Accessibility Guidelines, the technical standard the AODA points at 2.1 A and AA additions | 12 | 9 | 3 | 0 |
Web Content Accessibility Guidelines, the technical standard the AODA points at 2.0 at Level A and AA is 38 criteria, 25 at Level A and 13 at Level AA. The 2.1 rows are counted separately on purpose. WCAG 2.1 adds 12 more criteria at these levels, which is where the widely quoted figure of 50 comes from. WCAG 2.1 is better practice and worth fixing, but it is not the standard the Accessibility for Ontarians with Disabilities Act references, and reporting a 2.1 failure as an AODA failure would not be accurate.
The four that matter most, in the order we would fix them:
-
Checkout cannot be completed by keyboard
The quantity stepper and the province dropdown both trap focus. A keyboard user reaches the cart and cannot finish an order. This is the finding with revenue attached, and it is why it is first.
-
Form errors are announced only by colour
Field validation turns the border red with no text and no programmatic association. 1.4.1 and 3.3.1. Affects anyone who cannot distinguish the colour, and anyone using a screen reader.
-
Product images have generated alt text
Roughly 200 product images carry alt text of the form IMG_4471.jpg. 1.1.1. High volume, mechanical to fix, and it also affects search.
-
Focus is never visible
The theme removes the focus outline site wide with an outline none rule. 2.4.7. One line of CSS created it and one line removes it.
Every finding in the full report carries a screenshot, the page it was found on, the criterion it maps to, and the specific element. A finding you cannot locate is a finding you cannot fix, and it is not worth what you paid for it.
What this report does not do
It does not tell Northline whether they are compliant. That is a legal conclusion, and we are not lawyers. What follows is what the regulations actually say and what we found on the page. For a view on your own obligations, talk to a lawyer.
What it says instead is what was tested, on what date, by what method, and what the results were. Whoever signs the December filing can read it, see the evidence, and reach their own conclusion with their own counsel. That is a document they can rely on precisely because it does not overreach.
It also does not test what it cannot see. Data retention settings, back end systems, vendor agreements and anything behind a login were outside this scope, and the report says so in the same place it says what was tested.
That boundary is where the bigger piece of work starts. A website scan sees the front door. It cannot see your CRM, your email platform, your booking system, your point of sale or anything sitting behind a login, and every one of those collects personal information your privacy policy is supposed to account for. If you want the whole picture, a systems and vendor review maps what you actually run, what each one collects, who it goes to, and where your policy has gaps it does not yet know about. Reach out below and we can scope it.
What happens next
Remediation is quoted separately, after the audit, because scoping a fix before you know what is broken is guesswork and both of us end up unhappy with it. Northline's list came to seventeen items across the two lanes, eleven on the accessibility side and six on the privacy side, with the checkout keyboard trap and the broken consent banner as the two we would do first regardless of budget.
Then it gets retested, and the report is reissued with the same criteria and a new date, so there is a before and after pair on the record.
If you want to go deeper on any of this
If you want one of these for your own site, that is what we do. Fixed fee, quoted before we start, and you see the scope before you agree to anything.
Where the standards and guidance come from
Every standard, criterion count and piece of guidance this report leans on is public. Here is where each one lives, so you can check the numbers rather than take our word for them.
- W3C, Web Content Accessibility Guidelines 2.0
- W3C, How to Meet WCAG (quick reference, filterable by version and level)
- Ontario, how to make websites accessible
- Ontario, accessibility rules for businesses and non profits
- Ontario, completing your accessibility compliance report
- Ontario Human Rights Commission, the Ontario Human Rights Code
- Privacy Commissioner, Guidelines for Obtaining Meaningful Consent
- Privacy Commissioner, the PIPEDA fair information principles
Want to know where your own site stands? See what we do, or reach out and we'll get the ball rolling.
Reach outJUMP BACK
All Audit Services ArticlesDiscover more content by us
