Before you hire a VPAT service provider, the methodology behind their work matters more than the price tag on the engagement. A credible provider conducts a fully manual accessibility audit against the WCAG version and level you need, then maps those findings into the ACR. The right questions reveal whether the provider actually evaluates your product or skims it with automated tools. Ask about audit type, scope determination, auditor qualifications, evidence captured, and how conformance language gets assigned to each criterion. The answers will tell you whether the resulting ACR will hold up under procurement scrutiny.
| Question Area | What a Strong Answer Sounds Like |
|---|---|
| Audit type | Fully manual audit by a qualified auditor, not a scan with cleanup |
| Scope | Representative pages, screens, and user flows mapped to the product |
| Standard | WCAG 2.1 AA or WCAG 2.2 AA, plus Section 508 or EN 301 549 if needed |
| Auditor qualifications | Experienced accessibility auditors with assistive technology fluency |
| Evidence | Audit report with issues, locations, severity, and remediation guidance |
| ACR authoring | Conformance language assigned criterion by criterion based on audit data |
What kind of audit backs the VPAT?
This is the first question. An ACR is only as credible as the evaluation that produced it. A provider should confirm that the VPAT is backed by a manual accessibility audit conducted by qualified auditors, not generated from a scan output.
Scans flag roughly 25% of issues and cannot evaluate context-dependent criteria like meaningful sequence, focus order, name and role for custom components, or whether alt text actually describes the image. If a provider says their methodology is primarily automated, the resulting ACR will misrepresent conformance.
Ask directly: is every applicable success criterion evaluated by a person against the actual product?
How is scope determined?
Scope drives accuracy. A VPAT covering a SaaS platform requires evaluating the unique screens, components, and user flows that represent the product, not a token sample of marketing pages.
A strong provider walks you through how they identify representative content: authenticated and unauthenticated views, primary user flows, key components, and any platform-specific patterns. They should ask about your product before quoting, not after.
If scope feels arbitrary or page-count only, the ACR will likely overstate conformance for areas that were never examined.
Which standard and edition will be used?
The VPAT template comes in editions: WCAG, Section 508, EN 301 549, and INT. Most commercial buyers want the WCAG edition at 2.1 AA or 2.2 AA. Government buyers may need Section 508. European buyers may need EN 301 549.
Ask the provider which edition matches your buyer base and why. If they default to one edition without asking about your customers, that is a signal the engagement is being templated rather than tailored.
Who conducts the evaluation?
Auditor qualifications shape the quality of every line in the ACR. Ask about the auditor’s experience evaluating products like yours, fluency with assistive technology (screen readers, keyboard-only navigation, zoom, voice control), and how findings are reviewed before delivery.
A provider that cannot name the auditor or describe their background is outsourcing in ways you cannot verify.
What does the audit deliverable look like?
The audit report is the evidence behind the ACR. It should include each identified issue, the WCAG criterion it maps to, the location in the product, severity, and guidance for remediation.
Ask for a sample audit report before signing. The format and depth of that report tells you exactly what the engagement will produce. A short scan summary is not an audit report.
How is conformance language assigned in the ACR?
Each success criterion in the VPAT receives a conformance level: Supports, Partially Supports, Does Not Support, or Not Applicable, with remarks and explanations. The methodology question is how that determination is made.
A credible provider assigns conformance criterion by criterion based on audit findings. If issues were identified affecting a criterion, the language reflects that honestly. Inflated ACRs that mark everything Supports despite known issues lose credibility quickly during procurement review.
Is the ACR independently issued?
Buyers increasingly prefer ACRs prepared and signed by an independent accessibility firm rather than self-attested by the vendor’s internal team. Ask whether the provider issues the ACR under their own name and credentials.
How are updates handled after remediation?
ACRs do not have a formal expiration, but they should be updated after significant product changes or remediation cycles. Ask how the provider supports re-evaluation, validation of fixes, and reissuance of the ACR.
A provider with a clear path for ongoing work treats the VPAT as a living document tied to the product, not a one-time deliverable.
Does the methodology include user evaluation?
User evaluation with people who rely on assistive technology is not required for an ACR, but it strengthens the evidence base and surfaces issues a code-level audit can miss. Ask whether user evaluation is available as part of the engagement or as an add-on.
What WCAG version should I request for the ACR?
WCAG 2.1 AA remains the most common standard for VPATs. WCAG 2.2 AA is increasingly requested by buyers who want the current version. Ask the provider which version your customers are asking for and align the ACR accordingly.
How long does the full process take?
Timelines depend on product scope, but a representative VPAT engagement typically runs a few weeks from kickoff to delivered ACR. If a provider promises an ACR in days without a real audit behind it, the methodology is not sound.
What happens if my product has many issues?
A credible provider documents the current state accurately and supports remediation work that brings the product closer to full conformance. The ACR can be reissued after fixes are validated. Hiding issues to make the ACR look better is not a methodology, it is a liability.
The methodology questions above filter out providers who treat the VPAT as a form-filling exercise. The ones who answer with specificity are the ones whose ACRs hold up.
Contact a qualified VPAT provider through the AccessibilityBase directory to compare methodologies before you commit.