Interpreting Vendor Accessibility Responses

An accessibility statement can provide insight that will help purchasers understand other responses provided by vendors.

An accessibility statement typically has three components:

• The vendor’s commitment to creating an inclusive product.
• A declaration of conformance to a technical specification.
• Contact information to report accessibility barriers or provide feedback.

A strong accessibility statement might contain additional information, such as:

• Known limitations that may present barriers to disabled users.
• Steps the vendor takes to illustrate their commitment to accessibility.
• Test environments and methodologies used during audits.
• Any policies, regulations, and laws the vendor works to comply with.

Voluntary Product Accessibility Templates (VPATs) provide an overview of a product’s digital accessibility conformance. A VPAT should have a table that includes every WCAG success criteria, the product’s level of conformance for each criteria, and notes that explain the conformance level. The reports can be difficult to interpret, especially for larger or more complex products.

• Criteria: The WCAG success criteria, linked to the criteria’s official documentation.
  • Conformance Level: A VPAT typically uses the same four terms to report conformance levels:
  • Supports: The product meets the criterion without known defects or through equivalent facilitation.
  • Partially Supports: Some functionality does not meet the criterion, and known defects do not present a significant barrier.
  • Does Not Support: Several defects have been identified, or known defects present a significant barrier.
  • Not Applicable: The criterion is not applicable to the product.
• Remarks and Explanations: Remarks are used to justify answers provided in the Conformance Level column. When a criterion is not fully supported, remarks should identify the functions or features with issues and how they are not fully supported. If an accessible alternative is used, it should be described.

Consider this example VPAT row:

A purchaser may ask what “some” means in this context. The response does not indicate if the issue is present on a single, critical feature, such as a link to log in or an important piece of information. While “some” would be technically correct, this response does not accurately reflect the severity of the barrier presented by the issue.

A good response will detail where the issue occurs, and if there any known workarounds, and the issue’s impact on disabled users. The VPAT structure can make it difficult to provide detailed responses for large or complex products. A vendor may generalize their responses for the sake of organization.

Purchasers should ask the vendor to provide more details to vague or generalized responses. In some cases, a vendor may be able to provide the results of a full audit report upon request.

A note on “Fully Accessible”

Sometimes, a VPAT will report that every criteria is fully supported. This is often a sign that the VPAT results need further scrutiny. Most products, especially those that are large or complex, will not be perfect. Purchasers are encouraged to ask vendors for more information to support the claims of full accessibility. The purchaser should highlight any inconsistencies that are discovered in the vendor’s audit documentation or an internal audit.

Inconsistencies are not always due to malicious intent. Simple mistakes or product updates can contribute to outdated VPATs. A vendor’s response to these inconsistencies can act as another way to measure potential risk of using their product.

Audit reports

Unlike VPATs, an audit report should provide detailed information about issues that were discovered during testing. These reports should include information about where an issue occurred, the circumstances that lead to the issue presenting itself, and possible barriers presented by the barrier. Audit reports should provide information about the methodologies and environment used for testing:

• Who performed the audit? (Internal testing versus an independent audit)
• What tools were used? (JAWS, NVDA, ANDI, etc)
• Which operating systems or web browser were tested?
• How much manual testing was involved relative to automated testing?
• What was the scope of testing? (Web pages, user flows, etc.)
• If severity ratings are used, how did the tester determine those ratings?

A vendor may provide responses to industry questionnaires, such as the “IT Accessibility” section of the HECVAT. These questions are designed to help purchasers understand the risk associated with a given product by evaluating the processes that a vendor uses to ensure compliance with applicable laws and regulations. Each HECVAT question provides an opportunity for vendors to supply additional information. Good responses will provide details and supporting evidence when possible.

The questionnaire response provides operational information about the vendor. It typically does not provide accessibility information for a specific product.

Most contracts will require that vendors provide a timeline and roadmap to remediate known accessibility issues. Whether a purchaser is evaluating an existing roadmap or negotiating with the vendor to create one, here are some points to consider:

• How has the vendor historically responded to reported violations?
• Do proposed timelines address the needs of impacted users?
  • Will students be able to take tests or turn in assignments on time?
  • Will staff be able to access important records before deadlines?
  • Can community members complete registration in time for a scheduled event?
• Does the vendor provide an alternative resource or a workaround to complete the impacted function?
• Is the vendor aware of the violation? How much priority has the vendor placed on the violation?

There may be times when a vendor does not respond within the agreed upon time frame, their response is negative, or they do not respond at all. These vendors and their products present a high level of risk to the university. In many cases, this response from a vendor may represent a breach of contract. For assistance reacting to insufficient vendor responses, please contact the ADA Coordinator.