Skip to main content
Audit Scope & Limitations

Audit Scope and Limitations

Understand what each Auditzo review path can include, what it does not include by default, and when a manually scoped evidence audit is needed for deeper testing or supporting files.

This page explains audit boundaries so teams understand the difference between automated reports, manual evidence audits, monitoring, remediation support and WCAG accessibility reviews.

Scope clarity Buyer Guide
Automated reports provide initial visibility
Manual audits provide scoped evidence depth
WCAG reviews verify accessibility findings
No legal advice or certification claims
Why this matters

Clear scope protects buyers and keeps reports useful

The same website can be reviewed in different ways. Auditzo keeps each path clearly separated so automated visibility is not confused with manual evidence collection or accessibility verification.

Scope before interpretation

Auditzo separates what was reviewed from what was not reviewed, so findings are understood inside the correct context.

Automated reports have boundaries

Self-generated automated reports provide structured initial visibility, but they are not the same as human-reviewed evidence audits.

Manual work is scoped

Manual Evidence Audits can include deeper testing, raw evidence and consent-state review where those items are included in the agreed scope.

No unsupported claims

Auditzo provides technical observations and evidence-linked findings. It does not provide legal advice, compliance certification or guarantees.

Scope definition

What “scope” means in an Auditzo review

Scope is not just the website URL. It includes the review path, tested states, evidence depth, deliverables and known exclusions.

Domains and URLs

The websites, subdomains, public pages, page templates or URLs included in the review.

Journeys and states

The user paths, consent states, interaction states or accessibility interactions included in scope.

Evidence depth

Whether the output is an automated report, a manual evidence package, screenshots, HAR/network evidence or a scoped findings register.

Time and environment

Testing date, browser, region, profile state, device context and other conditions that can affect observed behavior.

Review category

Whether the review is privacy/tracking-oriented, consent-state-oriented, remediation-oriented, monitoring-oriented or WCAG accessibility-oriented.

Exclusions and limitations

Known boundaries such as untested pages, blocked regions, login-only areas, third-party platform limits or legal conclusions.

Review paths

Auditzo review paths have different boundaries

Automated reports, manual evidence audits, monitoring, remediation and WCAG audits are not interchangeable. Each path has a different purpose and evidence depth.

Automated initial visibility

Free Privacy Scan

A quick no-interaction scan that helps teams see initial website privacy and tracking signals.

Can include

  • Public initial page observation
  • Cookies, storage and third-party signals where detected automatically
  • Basic risk and review indicators
  • Useful starting point before deeper review

Does not include by default

  • Human verification
  • Accept or Decline consent-state testing
  • Manual user journeys
  • Downloadable raw evidence package
Automated report for quick review

Standard Report

A self-generated automated report for teams that need a clearer report format than the free scan.

Can include

  • Automated initial-state report output
  • Structured privacy and tracking observations
  • Cookie, storage, request and tracker signals where detected
  • Report format for internal review

Does not include by default

  • Human review or legal interpretation
  • Consent-banner interaction testing
  • Custom user journeys
  • Raw HAR, cookie or storage evidence package
Expanded automated initial-state report

Detailed Automated Report

A self-generated automated report with deeper structured visibility into the initial website state.

Can include

  • Expanded automated technical observations
  • Initial-state cookies, browser storage and request signals
  • Tracker, script and third-party domain indicators
  • Framework-style review signals for privacy team review

Does not include by default

  • Human verification
  • Accept or Decline consent comparison
  • Manual consent-state testing
  • Downloadable raw evidence files or evidence package
Scoped human-reviewed evidence work

Manual Evidence Audit

A manually scoped review for teams that need deeper technical evidence, consent-state comparison or supporting files.

Can include

  • Human review of agreed pages, states and journeys
  • Screenshots, HAR/network evidence and request-level notes where scoped
  • Cookie and browser-storage comparisons where scoped
  • Raw evidence handoff and evidence index where scoped

Does not include by default

  • Unlimited pages or unlimited user journeys by default
  • Legal advice, legal opinions or compliance certification
  • Fiddler/Wireshark-style packet capture unless quoted separately
  • Guarantees that every possible issue has been found
Recurring change visibility

Website Privacy Monitoring

A monitoring path for teams that want to track meaningful changes in website privacy and tracking signals over time.

Can include

  • Recurring checks based on the selected monitoring setup
  • Change visibility for observed cookies, storage, scripts or third-party signals
  • Month-over-month or recurring comparison where included
  • Useful for keeping visibility after site updates

Does not include by default

  • Replacement for a manual evidence audit
  • Legal review or compliance certification
  • Every possible visitor journey or region by default
  • Raw evidence package unless separately scoped
Technical fix support

Website Tracking Remediation

A remediation support path for teams that need help understanding and fixing tracking, consent, cookie or third-party script issues.

Can include

  • Technical review of selected findings
  • Implementation guidance for tags, cookies, scripts or consent behavior
  • Developer-oriented remediation notes
  • Retest support where included in scope

Does not include by default

  • Legal policy drafting or attorney review
  • Guarantee that third-party platform limits can be fully changed
  • Unlimited development work by default
  • Certification that the website is compliant
Custom scoped evidence workflow

Law Firm / Enterprise Package

A custom path for multi-domain, urgent, legal-support, enterprise or special-format evidence needs.

Can include

  • Custom scope definition and evidence planning
  • Multi-domain or priority workflows where agreed
  • Specific evidence formats or delivery structure where feasible
  • Coordination with client, agency, privacy or legal-review teams

Does not include by default

  • Legal advice or litigation strategy
  • Unscoped domains, pages, apps or environments
  • Guarantees of outcome, compliance or legal sufficiency
  • Unlimited follow-up work unless agreed separately
Human-reviewed accessibility findings

WCAG Accessibility Audit

A WCAG-oriented accessibility review with human verification, evidence, affected components and remediation guidance.

Can include

  • Automated candidate discovery plus human verification
  • Keyboard, focus, semantic, form, visual and component review where scoped
  • Screenshots, affected pages, reproduction context and WCAG-oriented mapping
  • Remediation guidance and retest priorities

Does not include by default

  • WCAG certification or ADA certification
  • Legal advice or legal compliance determination
  • Privacy consent-state testing unless separately scoped
  • Guarantee that every accessibility issue on every page is identified
Quick comparison

Automated visibility is not the same as manual evidence depth

This is the most important distinction on the page. Automated reports are useful for structured visibility. Manual Evidence Audits are used when human review, consent-state testing, screenshots or raw evidence files are needed.

Explore Manual Evidence Audit

Capability comparison

Comparison of automated reports, manual evidence audits and WCAG accessibility audits
Capability Automated Reports Manual Evidence Audit WCAG Audit
Initial website privacy visibility Yes Yes, where relevant Not the primary purpose
Human review No Yes Yes
Consent Accept / Decline comparison No Yes, where scoped Not included unless separately scoped
Screenshots Report visuals only where available Yes, where scoped Yes, where relevant
HAR / network evidence handoff No raw evidence handoff Yes, where scoped Usually not relevant
Cookie and storage comparisons Initial-state observations Yes, where scoped Not the primary purpose
WCAG-oriented issue mapping No No, unless accessibility is scoped Yes
Legal advice or certification No No No

“Where scoped” means the item must be included in the agreed review path, proposal, order or custom engagement terms.

Finding interpretation

What Auditzo findings mean — and what they do not mean

Auditzo reports are designed for technical review and remediation planning. They should not be treated as legal conclusions or compliance certifications.

What findings can mean

  • A cookie, request, tracker, storage item, accessibility issue or technical behavior was observed
  • A finding may need remediation, disclosure review, consent review or developer investigation
  • A finding can help internal, agency, privacy or legal-review teams understand what happened
  • Evidence can support more focused review and remediation planning

What findings do not mean

  • A final legal conclusion has been made
  • The website has been certified compliant or non-compliant
  • Every possible page, user journey, region, browser or login state was reviewed
  • A lawsuit, complaint, penalty or legal outcome will be prevented
Default exclusions

What is not reviewed by default

These items can often be reviewed, but only when they are specifically included in the selected report path or manually agreed scope.

  • Login-only dashboards, customer portals or authenticated user areas unless credentials and scope are agreed
  • Every page, subdomain, language version, app screen or third-party hosted flow unless included in scope
  • Every geography, VPN location, device, browser, consent-management configuration or returning-user state
  • Backend source code, tag manager workspaces, server logs or vendor contracts unless separately provided and scoped
  • Legal policy drafting, attorney review, litigation strategy or final legal applicability analysis
  • Fiddler/Wireshark-style packet capture or advanced forensic capture unless quoted separately
  • Post-remediation verification unless retesting is included in the engagement
  • Continuous monitoring unless a monitoring plan is selected
Before a manual audit

What buyers should clarify before a scoped review

Manual Evidence Audits work best when the expected pages, journeys, consent states and evidence outputs are clear before testing begins.

URLs and journeys

Share the domain, priority pages, templates, forms, checkout flows or journeys that matter most.

Consent context

Tell us whether Accept, Decline, preference-center or regional consent behavior needs review.

Access requirements

Provide test credentials, VPN needs, staging links or allowed test windows when non-public areas are in scope.

Evidence expectations

Confirm whether you need screenshots, HAR/network evidence, request notes, cookie/storage comparisons or a raw evidence handoff.

Stakeholder use case

Clarify whether the report is for internal review, developer remediation, agency handoff, privacy team review or legal-support discussion.

Timing and priority

Share deadlines, urgent risk areas, launch dates, remediation windows or priority findings that need faster review.

Choosing the right path

Use the right Auditzo path for the job

The right report path depends on whether you need quick visibility, internal review, raw evidence, consent-state comparison, remediation, monitoring or accessibility verification.

Compare Pricing and Audit Paths

Decision guide

  • Need quick initial visibility? Start with the Free Privacy Scan or an automated report.
  • Need a report your team can review internally? Use the Standard Report or Detailed Automated Report.
  • Need human-reviewed evidence or consent-state comparison? Use a Manual Evidence Audit.
  • Need help fixing tracking or consent issues? Use Website Tracking Remediation support.
  • Need recurring visibility after changes? Use Website Privacy Monitoring.
  • Need accessibility evidence and remediation guidance? Use a WCAG Accessibility Audit.
  • Need legal-team or enterprise-specific evidence format? Request a custom Law Firm / Enterprise Package.
Related pages

Continue from scope into the right Auditzo review path

These pages explain methodology, automated reports, manual evidence audits, pricing, sample outputs and WCAG accessibility review.

Audit Methodology

See how Auditzo defines scope, captures evidence, verifies findings and documents limitations.

Detailed Automated Report

Review the self-generated automated detailed report path and what it is designed to show.

Manual Evidence Audit

Explore human-reviewed privacy evidence work with consent-state, network, cookie and storage evidence where scoped.

Pricing

Compare automated reports, manual evidence audits, remediation and monitoring options.

Privacy Sample Report

Preview how privacy and tracking findings may be structured in an Auditzo report.

WCAG Accessibility Audit

Review Auditzo’s human-reviewed accessibility audit path with evidence and remediation guidance.

FAQs

Audit scope and limitations FAQs

Common questions about automated reports, manual evidence audits, raw evidence files, WCAG reviews and legal boundaries.

Auditzo publishes scope and limitations so buyers understand what each report path can support, what is excluded by default and when manual review or custom evidence collection may be needed.

No. Automated reports provide structured initial visibility and are self-generated. Manual Evidence Audits are scoped human-reviewed engagements that can include deeper consent-state testing, screenshots, HAR/network evidence, cookie and storage comparisons and raw evidence handoff where agreed.

No. The Detailed Automated Report is a self-generated automated report. It does not include human verification, Accept or Decline testing or downloadable raw evidence files. Manual Evidence Audits are available when human review and supporting evidence are needed.

Yes, where included in the agreed scope. Manual Evidence Audits can include initial, Accept, Decline and preference-state observations, selected journeys, screenshots, HAR/network evidence and cookie or storage comparisons.

No. Raw evidence files are not included with self-generated automated reports. Raw evidence handoff can be included in Manual Evidence Audits or custom packages when agreed in scope.

Only the pages, journeys, templates, consent states, components or environments included in the selected report path or agreed manual scope are reviewed. Findings should not be assumed to cover untested areas.

No. Auditzo provides technical evidence, observations and remediation-oriented findings. It does not provide legal advice, legal opinions, ADA/WCAG certification, privacy compliance certification or guarantees.

Yes, scope can often be expanded through a separate agreement or change request. Additional domains, journeys, regions, evidence formats, retesting or urgent review may require additional time and cost.

Not sure which Auditzo path fits your review?

Start with an automated report for quick visibility, or request a Manual Evidence Audit when you need human-reviewed evidence, consent-state testing, screenshots or raw supporting files within an agreed scope.

Auditzo provides technical evidence and observations for review. It does not provide legal advice, compliance certification or guarantees.