Yes. You need an accessibility audit to fill in a VPAT properly. The audit identifies how your digital asset measures against each WCAG success criterion, and that information is what populates the conformance table inside the ACR. Without an audit, the VPAT is guesswork, and guesswork on a conformance document creates legal and procurement risk. A credible ACR reflects real evaluation data, not assumptions about how the product behaves for users with disabilities.
| Question | Answer |
|---|---|
| Is an audit required? | Functionally yes. An ACR without audit data is not credible. |
| What does the audit produce? | A report mapping each WCAG criterion to Supports, Partially Supports, or Does Not Support. |
| Who conducts it? | A qualified accessibility auditor evaluating the product manually. |
| What standard? | Typically WCAG 2.1 AA or WCAG 2.2 AA, depending on the VPAT edition. |
| Can scans replace an audit? | No. Scans only flag approximately 25% of issues. |
Why the Audit Comes First
The VPAT is a template. The ACR is the completed document produced from that template. The conformance claims inside the ACR, Supports, Partially Supports, Does Not Support, Not Applicable, have to come from somewhere. That somewhere is the audit.
An accessibility audit evaluates a digital asset against each applicable WCAG success criterion. The auditor reviews the product manually, documents issues, and maps findings to the relevant criteria. That mapping is the raw material for the ACR.
Skip the audit and you’re writing conformance claims without evidence. If a buyer, procurement team, or legal reviewer asks how you arrived at a Supports rating for 1.3.1 Info and Relationships, you need a real answer. An audit gives you that answer.
What Happens if You Fill in a VPAT Without an Audit?
Two things, usually. First, the conformance claims are inaccurate, sometimes wildly so. Self-assessed ACRs tend to overstate conformance because internal teams don’t catch the issues an independent auditor would identify. Second, the credibility of the document drops. Procurement teams at large organizations, especially government, healthcare, and education buyers, can tell the difference between an ACR backed by evaluation data and one filled in from memory.
Inaccurate ACRs create downstream problems. If a product is procured based on a Supports rating that turns out to be Does Not Support, the vendor relationship takes a hit. In regulated industries, it can trigger contract disputes or worse.
What the Audit Produces for the VPAT
A (manual) accessibility audit produces a report. The report lists every WCAG criterion evaluated, the conformance status for each, the specific issues identified, and remediation guidance. That report maps directly to the ACR.
For a WCAG edition VPAT, the auditor covers WCAG 2.1 AA or WCAG 2.2 AA criteria. For a Section 508 edition, the audit also covers the Revised 508 Standards. For EN 301 549, the audit covers the European standard. The VPAT edition determines the audit scope.
Once the audit report is complete, the ACR can be written. The conformance table inside the ACR pulls its ratings and remarks directly from the audit findings.
Can Automated Scans Substitute for an Audit?
No. Scans flag approximately 25% of issues. The other 75%, including most keyboard, screen reader, focus management, and semantic issues, require manual evaluation. A VPAT filled in using only scan data would miss the majority of conformance concerns, which defeats the purpose of the document.
Scans have a place in ongoing monitoring. They do not replace the evaluation work needed to produce a credible ACR.
Who Should Conduct the Audit?
A qualified accessibility auditor. Ideally someone independent from the team that built the product. Independent evaluation carries more weight with procurement reviewers because the auditor has no incentive to overstate conformance.
Internal teams can conduct audits, but the ACR that results is self-issued, which buyers often view with less confidence than an independently issued ACR. For SaaS companies selling into regulated markets, an independent audit is the stronger path.
FAQ
How much does an audit for a VPAT cost?
It depends on the product. A small SaaS web app with a focused scope costs less than an enterprise platform with dozens of user flows. Pricing scales with the number of unique pages, screens, and states the auditor has to evaluate. Get a quote based on your actual scope rather than a flat number.
How long does the audit take?
For a typical SaaS web app, two to three weeks from kickoff to report delivery is reasonable. Larger or more complex products take longer. The ACR is written after the audit report is finalized, adding a short additional window.
Does the ACR expire?
Not formally. The recommendation is to update the ACR after significant product changes, which for most SaaS products means annually or after a major release. Buyers want recent documentation, not an ACR from three years ago.
What WCAG version should the audit cover?
WCAG 2.1 AA is the most common request. WCAG 2.2 AA is becoming more frequent as procurement teams update their requirements. If you’re not sure which your buyers want, ask them, or default to 2.2 AA to be current.
Can one audit cover multiple VPAT editions?
Often yes. A single audit can produce ACRs for WCAG, Section 508, and EN 301 549 editions if the audit scope covers the criteria in each. This is a cost-effective approach for products sold into US federal, US state, and European markets.
The short version: the audit is the work. The VPAT is the template. The ACR is the deliverable. All three connect in that order.
Contact Kris for help with audits and VPATs: Contact Kris.