On Demand: VPATs and ACRs

Lori Litz

Welcome everybody to today's Accessibility.com presentation on VPATs. Voluntary Product Accessibility Templates. We are so excited to have with us today Sheri Byrne-Haber and Clyde Valentine from QualityLogic. Sheri will be talking with our president, Mark Shapiro, about VPATs and ACRs, Accessibility Conformance Reports. We'll take a deep dive into QualityLogic with Clyde, and then we'll take questions from the audience.

So please go ahead and type those into the Q&A section, and let's leave the chat open for networking. Immediately following the discussion today, there will be a breakout session presented by QualityLogic titled Accessibility in Action: Live Testing Your Sites! So you don't want to miss that. Today's sessions are recording, recorded, and the recording and transcript will be available later this evening.

You'll receive an email when it's ready. Again, if you have any questions for the panelists, please type them into the Q&A section. That's where they'll be looking for them. If we don't get to your question today, we will follow up on it. Use the chat for discussions and networking, and then don't forget to visit the Expo Hall.

So head on out and you can visit with QualityLogic and learn a little bit more about them and how their accessibility services can help your business. And now I'm going to turn it over to Mark, Sheri and Clyde.

Mark Shapiro

We're pleased to have with us Sheri Byrne-Haber. Sheri is a leading expert in digital accessibility. She's guided Fortune 200 companies in developing accessibility strategies, improving product design and user experience. Her deep knowledge makes her a go to advisor for organizations looking to ensure their digital products meet accessibility and legal standards. As a Co-Chair of the Information Technology Industry Council, she was instrumental in shaping the standards for Accessibility Conformance Reporting and the Voluntary Product Accessibility Template.

Sheri, we truly appreciate you joining us today and sharing your valuable insights.

Sheri Byrne-Haber

Well, thanks. I'm really glad to be here, Mark. Just one small correction. I'm actually the former Co-Chair of ITI. I am currently working on short term accessibility projects, looking for my next permanent accessibility home. And I have a book that on frictionless user interface flows that includes a lot about accessibility. That'll be coming out next May.

Mark Shapiro

Sheri, to start with, there is quite a bit of confusion between a VPAT and an ACR. So what is a VPAT and what is an ACR?

Sheri Byrne-Haber

So in the beginning, there were only VPATs. So VPAT stands for Voluntary Product Accessibility Template. And you know it's from the it's for the government. The government loves its acronyms. ACR stands for Accessibility Conformance Report. So the VPAT part is now the table inside the overall ACR. So we frequently refer to them as ACR slash VPATs because you can't have an ACR without a VPAT.

Mark Shapiro

And why do you need this?

Sheri Byrne-Haber

Well, for starters, the government is getting a lot more serious about how it's spending its money. 508, Section 508 of the Rehabilitation Act has existed for, I believe, more than 16 years at this point. And we're only getting to the point now where the government is really cracking down and saying, make it accessible, damn it. so the ACR VPAT is for vendors, meaning software providers, to disclose where their software is accessible and also where it's not accessible.

And then the government is supposed to use that information when they're doing request for proposals to choose an accessible solution that solves the business problem that they're looking for.

Mark Shapiro

Okay. Are there different versions for a mobile site or mobile application versus a desktop?

Sheri Byrne-Haber

There are four different formats for the templates. There's the WCAG, W C A G, Web Content Accessibility Guidelines format. There's a 508 format that specific to the US government. There's the International format. I always recommend using the International format only because then you're good everywhere. It's not just American governments that are asking for this. The European Accessibility Act, I think is only 12 months away, maybe less, from taking effect.

And so it's starting to become required more over there. Now, in terms of desktop versus mobile, you can disclose both if the behavior is equivalent on a single VPAT. I don’t recommend doing that. Typically one of the formats will have come first, and one of them will have come second. One will have had more accessibility love than the other.

And so what that means is that, by combining them, you may have a ton of mobile bugs, but desktop looks good. You don't want to come all situation. It makes your desktop accessibility look worse because you're just disclosing mobile accessibility bugs in it. If your VPAT is super clean, then yeah, if you want to, limit the number of times you're updating your paperwork.

Sure. Just do one. But, until your VPAT has way more supports than partially supports and doesn't support, you probably want to keep them separate. There is something called WCAG 2 ICT. And and it's W C A G, and then the number two, I C T, which tells people how to do things like which WCAG requirements apply to mobile.

So if you're doing a mobile disclosure on a section 508 or international VPAT, you probably also want to look at WCAG 2 ICT. Oh, ICT stands for Information and Communications Technologies. So it's yet another government acronym.

Mark Shapiro

Can an ACR be created if a website or mobile site has not been audited?

Sheri Byrne-Haber

Honestly, no. I would say the one exception for that would be a command line interface. So there are fifty, five zero, WCAG 2.1 guidelines. If you have a command line interface, you only have to follow six of those. Because there's no mousing. There's no state changes. There’s, you know, it's it's really trimmed down and really straightforward.

I would say that that's the only exception, because it becomes so streamlined because of the limited user interface out there. Anything else? The partially supports and doesn't support commentary... The what the government calls remarks in the template, correspond to bugs, and you can't have bugs without having done an audit. So I kind of backed my way into the answer you were looking for there.

Mark Shapiro

Thanks. Who typically requires an ACR?

Sheri Byrne-Haber

So ACRs most frequently come from procurement, where they are included in the RFP. It’s the request for proposals. Occasionally they will come from human resources. Rarely. They would come from human resources, for example, if human resources is looking for something accessible that's an accommodation to an employee. I would say that's a very, very minor, exception.

For the most part, it's it's going to be from procurement, looking to buy things and wanting to make sure that they bought either that they buy something accessible or they know what they're getting into with respect to the non accessibility of the product.

Mark Shapiro

What advice would you give to a company who's looking for some assistance with creating an an ACR.? What should they look for like when selecting a company?

Sheri Byrne-Haber

So it's... ACRs started in the U.S. Although they have been adopted in the EU. So you really need a company that understands U.S. regulations and what the government's looking for in, in answering those questions. I would say it's important to look for people who are certified, because they have the right level of knowledge. It's important.

It was important to me as an accessibility manager to make sure that all of our VPATs looked like they were written by the same person. So, for example, so that partially supports on one VPAT meant the same thing as partially supports on a different VPAT. Now VMware had over 100 VPATs. So that's kind of on the the higher end of the scale.

But... So we actually wrote a VPAT authoring guide to give to all of our employees and our contracting agency. So whoever was writing the VPAT, they were using the same language, the same verb tense, the same sentence structure, and and the same definitions for things like, partially supports.

Mark Shapiro

When a company is looking to outsource this, what sort of a budget range should they be thinking about?

Sheri Byrne-Haber

So I will get a little bit vague here because I don't want to name names, but I was told by a major accessibility consultancy that for what they charged for the VPAT, $2,000 of that went to pay for insurance. And the reason for that is because authoring VPATs creates liability on the part of whoever is writing the documentation.

And if that accessibility claim that it turns out to be false, and you didn't write the VPAT, you had a third party do it. You may turn around and want to sue the the vendor that you used for negligence. To make sure that whatever money you are out because of the initial litigation gets paid for by the company that wrote the VPAT.

So another thing to add to your VPAT questions is how much insurance do you have? That that's a really important question. There's not a lot of litigation right now over that yet. But that's something that I have been projecting for a while is going to happen in the future as more and more people rely on VPATs, more and more mistakes are going to be found.

And, the company who paid the contractor to author the VPAT, they don't want to pay the legal fees for the other company’s mistakes. So got a little sidetracked there. You know, lawyers, we always worry about risk. And you asked how much they cost. So how much it costs depends on a number of things. One of the things is where is the agency located?

An agency that's located in San Francisco is going to charge about six times as much as an agency that's located in India. So that's one thing. The second thing is did you do the audit with the company who's writing the VPAT? If it's a complicated piece of software and the company did the audit, the VPAT's going to be cheaper because they don't have to train somebody else on the material that they already know because they're the ones who disclosed the bugs and they understand the bugs because they found the bugs.

So it's going to be a little bit faster for them to produce it. But I've seen, amounts for VPATs anywhere from about $2,000 for overseas vendors because their insurance isn't as much as it is in the U.S. all the way up to $20,000 for really complicated pieces of software, where the VPAT was being authored by a company that didn't do the original audit.

Mark Shapiro

What else should, what else should be in the vendors’ proposals?

Sheri Byrne-Haber

So I think how often you're going to update the VPAT is important, especially as we are moving to the cloud. Every time you change a line of code in the user interface, you are potentially doing something that is going to invalidate the VPAT that's out there right now. And do you have to reaudit at the whole thing?

Can you just audit the one small segment that changed? My recommendation is always to do at least three VPATs a year, if not more. Three would be the minimum for major cloud enterprise software. Because once you're four months out, chances are a good chunk of the user interface is either new or the code has changed, even though it looks the same.

Mark Shapiro

Right. Is it common for these vendors to actually assist with the remediation of issues they find?

Sheri Byrne-Haber

So there's three different layers of things. Actually there's more than three. So, accessibility companies can start by helping you make an accessible design. Okay. They can help you write the accessible product. They can help you do the accessible audit. And they can help write the VPATs. So, and then anything that says partially supports, they can go back, you know, to layer two again and, and help the developers fix the bugs.

So consulting companies can do anywhere between one of those things and all of those things. Sometimes it's easier to have one company do it all. Sometimes you might think, oh, I want the company writing the VPAT independent of the people who are fixing the defects because each has their own, you know, interest and mindset about the set that they might be.

There might be a conflict, conflict of interest. If the same company does both.

Mark Shapiro

Are there are any specific certifications that are... that someone should look for when hiring the company?

Sheri Byrne-Haber

So there are three different certifications in the United States. There is the IAAP certification, which is the International Association of Accessibility Professionals. There's the CPACC, which is the Certified Professional in Accessibility Core Competencies. So C P A C C. There is, which is a test to see how well you understand the global rules around accessibility, accessibility basics.

You know how to run an accessibility program. Things of that nature. The second certification offered by the same organization is called the WAS. So the WAS is the Web Accessibility Specialist. And that's the test to see if the person knows everything they need to know about assistive technology and actually coding something in an accessible manner. The third certification is the Trusted Tester Certification.

So the trusted tester is free. It's offered by the U.S. government. You will find a lot of outside the U.S. people take trusted tester because it's free. They don't have to pay a IAAP to become certified. All those certifications are awesome. Don't get me wrong. They reinforce okay, the person with this certification has a, you know, an X level of expertise where X is the the core knowledge that they were tested on.

VPAT questions come up never in trusted tester. I took, I took trusted tester about five years ago. It may have changed, but, I don't think it's in there. And it would be rarely in the CPACC and probably never in the WAS.

Mark Shapiro

We're delighted to welcome Clyde Valentine. Clyde is currently serving as the Head of Growth at QualityLogic. He brings over a decade of experience in software quality assurance and digital accessibility. Clyde, thank you for joining us today. We appreciate it.

Clyde Valentine

Yeah, thanks for having me.

Mark Shapiro

To start with, can you share the background of your company and how you help with ACRs and VPATs?

Clyde Valentine

Yeah, absolutely. So, our history, QualityLogic. We've been around since the late 1980s. We got started as a quality assurance company, and that's a big part of our business still. So helping with manual functional testing, test automation, test consulting. But it was through our Director of Engineering that we got into the accessibility line of business as well.

And so it was really, you know, we got into this as a passion. He went blind back in 2010 and wanted to take his perceived disability and turn that into a way to help customers deliver accessible experiences. Primarily because it's the ethical thing to do and we know that the technology can sustain it. And so, you know, that's that was really our entry point into accessibility.

We got a lot of interest really around 2019 during the the Domino's lawsuit. And there was a lot of focus on legal compliance. And, you know, since then, we've also seen the the market mature and kind of, you know, start approaching accessibility from a more holistic perspective, which has been exciting. So, a lot of our services really focused around, you know, auditing and helping organizations understand their compliance, producing VPATs, that sort of thing.

But then recently has also grown to encompass, you know, broader aspects like remediation or training, consulting, technology selection, thinking about the overall accessibility program and policy. And so, so, yeah, I mean, that's that's really how we've gotten into accessibility and some of our background in it. Some of the other things that might be interesting.

We are totally U.S. based, about 170 employees, all distributed throughout. Then yeah, I mean, I think that's kind of it at a high level. As far as how we help organizations with with accessibility, I mean, there are multiple things that we do. I mean, obviously, the topic of this conversation is creating VPATs and helping organizations assess vendors that have produced VPATs.

And so we certainly provide those auditing services, helping organizations either understand their compliance but then also get to being compliant. But then also think about accessibility and the kind of long term holistic sense. So once you actually get accessible, how do you maintain that over the long term? And so, yeah, we could go certainly deeper on services, but just keeping things high level, that's that's our background.

Mark Shapiro

What's your ideal customer? Is there a a size? Or an industry? Or you're U.S. focused, but, is there anything that that you look for in a client?

Clyde Valentine

Yeah, it's, it's it's a fair question. So, I wouldn't say from a from a size or an industry perspective. I mean, we've we've helped organizations that are, you know, billions of dollars in revenue, globally distributed. We've also helped organizations that are, you know, 20, 30 people in size. We've done that in health care, in education and finance and retail in all sorts of industries.

So from an industry in a size standpoint, I would say probably not. But what we do look for is organizations that are either getting into accessibility for the first time and really need a partner that's going to help educate them, provide them with kind of a set of options, help them understand what the pros and cons of each are.

And so organizations that are interested in kind of that partnership approach and getting it for the first time. We’re really good fit for those sorts of clients, as well as clients who have been around the block have are some degree into their accessibility journey, but really need help maturing their, you know, their accessibility program and thinking about how to make accessibility sustainable.

So we're a really good fit for those parts of the journey. The only other criteria I would add in there is, yeah, because of our strong U.S. presence and you noted this, we're really good fit for organizations that are primarily based in the U.S. or have a lot of overlap there. We have worked with clients based in in the EU around the European Accessibility Act.

But being predominantly here, most of our clientele is in the kind of North American time zone as it were. So that tends to be another good fit as well.

Mark Shapiro

In terms of budget, what should, in terms of your entry price, what should a company think about in 

Clyde Valentine

Yeah, there are... there are different ways that I could answer this question. So, I mean, if we're, you know, thinking of the topic of the conversation here, if we're talking just about, you know, going through an audit and receiving a VPAT at the end, that's going to vary based on the complexity of the product. Usually we think about that in terms of number of unique screens or workflows.

For, you know, and I kind of like to use this as kind of like a benchmark, I mean, for a moderately complex e-commerce website or, you know, a lighter kind of SAAS application, 10 to 20 unique screens. You might be in the range of like 5 to 20,000 USD for an initial audit and VPAT. So that's pretty typical.

If a product is much more complicated than that, obviously that price can scale. But the other way that I'll answer this is, you know, what we like to do, and this is kind of part of the idea of you know, working with customers based on where they're at, is we like to take a customer's budget and figure out, you know, what's the most impact that we can derive from that point?

Mark Shapiro

What really sets you apart from your competitors or what's your special sauce?

Clyde Valentine

Sure. Special sauce is, it's a funny term. But yeah, I mean, as far as, as far as differentiators are concerned, I mean, there are there are a couple of things that I could mention here. There is something that we, you know, kind of colloquially dubbed the QualityLogic way. And it's we've seen a lot of organizations out there that kind of approach clients with a one size fits all model.

They try to, you know, push customers down this very specific track. And we don't like doing that. We we think that every organization is unique and we want to work with with, effectively with customers on their own terms and think about their environment, their team's needs, their goals, that sort of thing. So in any conversation that we have and any approach that we take, we always tailor our services and our solutions and our approach exactly to what they're looking for.

We're big on the idea of expert guidance but not directive. So we want to bring in expert advice from the industry, give you that subject matter expertise that you're looking for, but really to equip you to, you know, make decisions that are right for your organization.

Mark Shapiro

That's fantastic. Clyde, thank you for giving us the the information about your company. That sounds like you you help out quite a number of companies, and it's nice that you’re U.S. focus is, you know, quite an opportunity here. We appreciate your time.

Clyde Valentine

Yeah, absolutely. Thank you for having me.

Mark Shapiro

So we're going to go to the Q&A section now. I'm going to go through some specific questions. First question, what level of WCAG are ACRs written on? Clyde, do want to take this?

Clyde Valentine

Yeah. No, I'd be I'd be happy to answer this one. So it, an accessibility conformance report, ACR, can be written to any WCAG standard. That can be 2.0, 2.1, 2.2... Single A through triple AA. You know, it really is just the report format. The thing I always recommend, though, is that you do it to the latest industry standard, which is currently 2.2 AA.

But failing that, at least within the U.S. context, you know, the current legal standards is is 2.1 AA. So I would say like have that have that is your bar. I know a lot of organizations are focused on that, especially with recent updates to ADA Title II. But yeah, it can be written to any standard, but I recommend 2.1 AA at a minimum, ideally 2.2 AA.

Mark Shapiro

Should we make the ACR available to our customers?

Sheri Byrne-Haber

Yeah. So I've seen some really weird commentary online lately from procurement people saying, well, I asked for an ACR and they said I had to be a customer first. Or I asked for an ACR, and they said I had to sign a non-disclosure agreement. Okay. That's bogus, for lack of a better word. ACR should always be publicly available. If somebody is hiding them, chances are there's a reason that they're hiding them, which is the results aren't very good, and they don't want their competitors to know that their results aren't very good.

So fix your code, people. Don't hide the answers.

Mark Shapiro

Can a company right an ACR if they did not conduct an audit for a company? Clyde, why don't you take this one?

Clyde Valentine

Sure. Yeah. So it's a it's an interesting framing of that question. Again, so, I mean, there there are different ways that there are different ways that I can, you know, unpack this. So certainly conducting, conducting an audit gives you the substance to populate the ACR with. So certainly like an audit does need to be conducted.

That is how you're going to, you know, the ACR is effectively a statement of your product’s accessibility. It's going to look at the WCAG standard, the individual success criteria, whether that product conforms or does not conform across all of those individual success criteria, list of defects, open or closed. And so to get that information, an audit does need to be performed.

That information needs to be, illuminated, as it were. That said, I think part of the part of the question is like, can another company come along, produce an ACR based on an audit that was performed elsewhere? And so, I'll answer from our standpoint. I, you know, our organization, I personally wouldn't do that because, you know, I would want to go through and validate the findings and the way to do that is to conduct an audit.

So if you're asking like a third party company to come along and do that, more than likely, they are going to want to run it through their processes, their teams, because that's the way that they can validate the the efficacy of the findings. And that's their credibility when they go out there and they say, hey, this is the ACR. This is what, you know, we have found. It would need to be based on like what they have actually found, not what somebody has said was found.

So, that's that's the norm for us. I expect that's the norm for our, you know, a lot of other ACR companies. I'd say that's pretty typical. That said, there's certainly a lot of consulting that can be done in and around those topics. So if we got in and we took a look at findings from, you know, an audit that was done previously, we can provide feedback on that and say, hey, you know, here's some really good things that were caught.

Here's some of the gaps here, some things that maybe weren't thought about. And certainly I'm a big fan of utilizing any information that is available. So that could that could help shortcut the time to produce another audit in a VPAT, because, you know, if you're fixing issues, there's less to find. It makes that next process more efficient.

So and it is an iterative process typically anyway. So it wouldn't go to waste at least.

Mark Shapiro

How can we ensure that the company writing our ACR isn't just selling us a template that they use over and over again?

Well, they are. Because the template is available for free and it comes from ITI. So the the template that the most expensive consulting company in the U.S. uses is identical to the template that the cheapest company in India uses. Where the added value is is what goes into the remark’s section. It's not particularly difficult to figure out whether and there's only four possible outcomes for each of the requirements.

It's supports. Okay? Doesn't support. Not applicable. And partially supports. So they have to pick one of those four for each of the WCAG requirements. And then if it's not appli- if it's anything but fully supports, they have to write remarks that explain the answer. So that's where the money is. That's that's where the the genius and the knowledge of accessibility goes.

It's in writing the remarks that explain who's going to be impacted by the area in your code where WCAG is not supported.

Mark Shapiro

Okay. What are the most common mistakes companies make when completing an ACR and how can they be avoided?

Sheri Byrne-Haber

I would say the most common mistake I see is, ACRs being completed on data that is old. So if you did your audit six months ago and you're only writing your, your, your ACR VPAT now. You know, ACR VPAT data is like bread. It's not very good after a couple of weeks. So making sure that your data is current is probably and something that's really important.

Typically this happens when people are trying to save money and do the ACR VPATs in-house. So look at the audit results, check the date. Make sure especially for cloud, that the software has not deviated substantially. Make sure you put the exact version of the product into the header section before you get into the ACR VPAT results. Make sure, I personally prefer when I'm reading VPATs to see expansive discussions of testing methodology.

You know, what manual tests did you do? What automated tests did you do? You know, were your manual tests done by native users of assistive technology? All of these things add credibility to the VPAT results. Because, for example, I know for a fact in Canada, when you submit a VPAT, the government actually spot check it. And if they find it, they'll the VPAT results will actually be validated. Other places they just accept whatever you submit at face value.

Lori Litz

And that's all the time we have for questions today. I want to thank, take a moment to thank Sheri Byrne-Haber and Clyde Valentine for joining us today and sharing such valuable information on VPATs and ACRs. I want to thank you for taking the time out of your day to spend with us learning more about voluntary product accessibility templates and accessibility conformance reports.

Next, QualityLogic is hosting a interactive breakout session titled Accessibility in Action: Live Testing Your Sites! So you can head on back to the lobby and join that session. Or watch it from the lobby. Also, don't forget to visit the Expo Hall. Today's sessions are recorded and will be available later this evening. You'll receive an email from me when the recording and transcripts are available.

You can always head to Accessibility.com and then navigate to News and Events and select Past Events On-Demand, where you'll find all of our past events listed there. And then we are getting very excited about our 2025 events. If you head to Accessibility.com/upcoming-events, you'll be able to see 2025’s event calendar. And we look forward to each and every one of you joining us next year as you continue along your accessibility journey.

Thank you again so much for being here today. Have a great rest of your day and we'll we'll chat next time.