Third-party VPAT or self-assessed: what independence buys

Some vendors send an Accessibility Conformance Report they wrote themselves. Others send one prepared by an outside accessibility firm, sometimes with the firm's logo on the cover. Buyers tend to treat the second kind as more reliable, and some vendors commission a third-party VPAT for that reason. Sometimes the extra trust is earned. Often it is extended by default, and that is the problem.

This post covers what independence actually adds to a report, what it does not add, and how to evaluate either kind on its merits.

What the VPAT format expects

The Information Technology Industry Council (ITI), which publishes the VPAT template, is clear about who the document belongs to. Its FAQ says the original manufacturer "is likely the best source to conduct the testing necessary to complete the VPAT," and that you "complete the VPAT as the product-owner to demonstrate the accessibility of your products."

ITI also says a VPAT "shouldn't require a third party review", while noting that a solicitation may require a third-party audit or review, and that vendors should follow whatever the solicitation says.

Two other points from the same FAQ are worth knowing:

• ITI does not review or approve VPATs. It publishes the template and nothing more.
• There is no VPAT certification. In ITI's words, there is "no certification or conformance logo required or even available" to those who complete one.

So by design, a self-assessed report is the normal case. A report prepared by a third party is still the vendor's disclosure about the vendor's product. The vendor just paid someone else to do the testing and, usually, the writing.

Self-assessed vs third-party: the honest comparison

Neither kind is trustworthy by default. Each tends to fail in its own way.

	Self-assessed	Third-party authored
Knowledge of the product	Usually deep	Limited to what was tested
Accessibility testing skill	Varies widely	Usually stronger
Who sets the scope	The vendor	The vendor, who is also the client
Typical weakness	Optimistic claims, thin evidence	Narrow scope, stale build, polished prose
Who stands behind it	The vendor	Still the vendor

Self-assessed reports tend to fail through optimism. A product team that has never watched someone use their software with a screen reader can believe, quite sincerely, that everything "Supports". The giveaway is usually in the remarks: blank, restating the criterion, or describing intent ("we follow accessibility best practices") rather than a mechanism.

Third-party reports tend to fail through scope. The testing may be excellent, but it covers what the vendor asked the firm to test: a set of pages, a set of workflows, a particular build at a particular date. Whatever was left out of the engagement is left out of the conclusions, and a report with a firm's name on it is easy to read as covering more than it does.

What independence actually buys

When an outside firm is competent and the engagement is well scoped, a third-party VPAT can add real things:

• Testing skill. Experienced testers find problems product teams miss, especially with screen readers, keyboard-only use and complex widgets.
• A named method. The firm can usually say which test process it followed.
• Less pressure to round up. A tester who does not own the product has less reason to mark a borderline result as "Supports".

What it does not buy:

• Certification. There is no accreditation body for WCAG or Section 508 conformance of a product. Individuals can hold testing credentials (the Department of Homeland Security, for example, certifies individuals as Trusted Testers for web content under the Section 508 test process), but those certify the person, not the product.
• Independence from the vendor's choices. The vendor commissions the work, defines the scope, and decides whether to publish the result.
• Currency. A third-party report describes the build that was tested. Every release after that is untested by the firm unless the engagement says otherwise. See how often a VPAT should be updated.

Federal guidance makes a related point from the buyer's side. Section508.gov advises that "whenever possible, purchasers should conduct independent conformance validation testing and evaluation to verify vendor accessibility conformance claims." In other words, the government's own advice is to verify claims whoever made them, not to switch off scrutiny because a firm was involved.

How to evaluate a third-party VPAT

Start with the same checks you would apply to any report: the right edition, the right product version, a report date, and remarks that explain each claim. The procurement officer's guide to reading a VPAT covers those in order. Then add four questions specific to outside testing.

1. What exactly was tested? Look for named modules, workflows, platforms and the build or version number. "The application was evaluated" is not a scope. If the report covers the public website and you are buying the staff-facing back office, it does not describe your purchase.

2. Who wrote the remarks? Some engagements end with the firm delivering an issue list and the vendor writing the VPAT from it. That is a self-assessed report informed by a third-party audit, which is fine, but it should say so. Ask.

3. Does the evaluation methods section say anything? The VPAT 2.5 instructions ask for a description of the testing: whether testers knew the product's common flows, which assistive technologies and tools were used, and, if a published test method was used, its name, publisher and a link. A third-party report has no excuse for leaving this vague.

4. Is there a "certified" claim? A badge, seal or statement that the product is "certified compliant" is a reason for more questions, not fewer. No such certification exists for the product.

How to evaluate a self-assessed VPAT

The same core questions apply, with more weight on evidence:

• Do the remarks describe mechanisms ("form errors are announced via a live region") rather than intentions?
• Are "Partially Supports" rows specific about what fails and where?
• Does the evaluation methods section name assistive technology, or just an automated scanner?
• Is there a contact who can answer follow-up questions?

A self-assessed report written by a team that clearly tested the product, and is candid about its gaps, is more useful than a third-party report scoped to the vendor's three best screens. Candor is a better signal than letterhead.

What to ask for in a solicitation

If you want independent testing, say so in the solicitation and say what it must cover: the product version offered, the workflows your users will rely on, and the standard you name (WCAG 2.1 Level AA for ADA Title II purposes). ITI's own guidance anticipates this: vendors are told to follow the solicitation where it requires a third-party audit.

If you do not require it, do not penalize a vendor for submitting a well evidenced self-assessment. Score the content of the report, not who typed it. The RFP requirements post has starting-point wording.

Where a report review fits

Testing the product and reviewing the report are different jobs. A tester opens the software. A reviewer reads the conformance report against the standard the solicitation names and asks whether each claim is complete, consistent and supported: missing criteria, wrong edition, unexplained "Partially Supports", "Not Applicable" without a reason.

GOVvpat does the second job. It does not write VPATs, test products or certify anything. A review applies equally to a self-assessed and a third-party report, which is the point: both are claims, and both deserve the same questions before award.

---

Sources: ITI VPAT FAQ and VPAT 2.5Rev template instructions (itic.org); Section508.gov, "Understanding Vendor Claims in Accessibility Conformance Reports"; DHS Section 508 Trusted Tester program (dhs.gov). This is general guidance, not legal advice.

Vendors: have your report reviewed before you submit it, whoever wrote it. See how it works for vendors. Agencies: request a quote.