To turn an audit report into a finished VPAT, you map each WCAG success criterion from the audit findings into the VPAT template, assign a conformance level for every criterion, and write remarks that explain the rationale. The audit report supplies the evidence. The VPAT translates that evidence into a structured document that procurement teams can read at a glance. The completed file becomes the Accessibility Conformance Report (ACR).
This works only when the audit was fully manual and covered the full standard claimed on the cover page. A scan-based report cannot support a credible ACR because scans flag approximately 25% of issues. The remaining evidence has to come from a (manual) accessibility audit conducted against WCAG 2.1 AA or WCAG 2.2 AA.
| Input | Purpose in the ACR |
|---|---|
| Audit findings per success criterion | Drives the conformance level assigned to each WCAG row |
| Scope definition | Lists the product, version, and pages or screens evaluated |
| Evaluation methods | Documents assistive technology, browsers, and devices used |
| Issue descriptions | Source material for the Remarks and Explanations column |
| VPAT edition selection | WCAG, Section 508, EN 301 549, or INT based on buyer requirements |
Start With the Right VPAT Edition
The VPAT comes in four editions: WCAG, Section 508, EN 301 549, and INT. The WCAG edition is the default for most SaaS companies and most Accessible.org clients. Section 508 is requested when selling to U.S. federal agencies. EN 301 549 covers procurement in the European Union. INT combines all three.
Pick the edition that matches what the buyer asked for. Filling in the wrong edition produces a document that does not satisfy procurement, even if the underlying audit work was correct.
Define Scope Before You Fill in Any Row
The scope section at the top of the VPAT is the single most consequential part of the document. It names the product, the version evaluated, the pages or screens covered, and the date of evaluation. If the audit covered a representative sample of 20 unique templates, the scope must say so. If only the marketing site was evaluated, the application is not in scope and cannot be claimed.
Vague scope is the most common red flag procurement teams find when reviewing an ACR.
How Do You Map Audit Findings to Conformance Levels?
Every WCAG row in the VPAT gets one of these conformance levels: Supports, Partially Supports, Does Not Support, or Not Applicable. The audit report tells you which to assign.
Supports: No issues identified for that success criterion across the evaluated scope.
Partially Supports: Issues identified on some pages or components but not others.
Does Not Support: The criterion is not met across the evaluated scope.
Not Applicable: The criterion does not apply to the product (for example, prerecorded video criteria when the product contains no video).
Auditors who use a structured spreadsheet make this step faster because each finding is already tied to a specific success criterion.
Write Remarks That Reflect the Audit, Not Marketing
The Remarks and Explanations column is where credibility is won or lost. For criteria marked Partially Supports or Does Not Support, the remark should briefly state what was identified and where. For criteria marked Supports, a remark is optional but can confirm how the product meets the criterion when relevant.
Avoid marketing language. Procurement reviewers read hundreds of ACRs and recognize hedging immediately. A short, factual sentence pulled directly from the audit issue description is the right pattern.
Document Evaluation Methods Accurately
The Evaluation Methods Used section lists how the assessment was conducted. This includes assistive technology (NVDA, JAWS, VoiceOver, TalkBack), browsers, and devices. If the audit was 100% manual, state that. If automated checkers were used in addition to manual evaluation, list them with the caveat that conformance was determined manually.
Accessible.org audits are always fully manual, which makes this section simple to complete.
Review the Document Before Issuing
Once the rows are filled in, the document is read end to end against the audit report. Every conformance level should trace back to evidence. Every remark should match a finding. The scope, version, and date should be consistent across the cover page, scope section, and document footer.
Accessibility Tracker is being used by accessibility companies and consultants to auto-generate the VPAT from audit data, which removes most of the manual transcription work and reduces the chance of a row not matching its underlying finding. Accessible.org Labs is actively researching how real AI can support this workflow without replacing the human review step.
Common Mistakes That Sink an ACR
Filling in the VPAT without a (manual) audit underneath it is the most frequent problem. Listing a scope broader than what was actually evaluated misleads procurement teams. Marking criteria Supports when issues were identified undermines the entire document. Using the wrong VPAT edition for the buyer creates a mismatch that delays procurement. Leaving remarks blank on Partially Supports and Does Not Support rows raises immediate questions. Forgetting to update the document after significant product changes makes the ACR outdated and unreliable.
Frequently Asked Questions
Can I complete a VPAT without an audit report?
Technically yes, but the result will not be credible. The VPAT is a structured claim about WCAG conformance. Without audit evidence behind each row, the document cannot be defended if procurement or legal review asks how each conformance level was determined.
How long does it take to turn an audit report into a finished VPAT?
For a single product with a clean audit report, the document can be completed in a few days. The actual writing is fast when the audit findings are organized by success criterion. Most of the time is spent on scope definition, edition selection, and review.
Does the ACR expire?
ACRs do not have a formal expiration date. The recommendation is to update the document after significant product changes, after major releases, or annually for actively developed products.
Should the audit team and the VPAT author be the same?
It helps. When the same team evaluated the product and authored the ACR, the rationale for each conformance level is consistent and the remarks reflect what was actually identified during evaluation.
A finished VPAT is only as strong as the audit report behind it. Build the audit correctly and the ACR follows from it.
See how the Accessible.org VPAT process works or Contact Accessible.org to get started.
