Client & Context
An accessibility audit and VPAT together answer two different questions: “what is broken?” and “what can we claim?” Between October and December 2025, client Sam Donnelly engaged HalfAccessible across three consecutive contracts to answer both for a SaaS web application — and then to fix what the audit found.
Choose Your Next Step
Need the same audit, fixes and VPAT for your SaaS product? Pick how you want to start.
Free 30-Minute Call
Best for: SaaS teams getting their first ACR request, or anyone not sure where to start.
Tell us about your product, platforms and the buyers asking for a VPAT. We explain where you stand and quote a fixed-price next step.
Book a Free 30-Min Call (opens in new tab)
1-Hour Technical Consultation ($100)
Best for: teams that need expert technical answers now.
A working session to walk through an audit or an existing ACR, talk with your developers, or review issues in your app live.
VPAT / ACR Quote
Best for: products with a buyer, RFP or security review asking for an ACR.
Share the edition, platforms and user journeys. Most quotes come back within 1 to 2 business days.
The Challenge
The sequence matters. A VPAT written before remediation documents failure; remediation without re-testing leaves claims unproven. The engagement needed a full accessibility audit first, code-level fixes second, and an honest conformance report third — finishing with a landing page redesign that applied the same accessibility standards to the marketing surface.
Accessibility Audit and VPAT: Audit, Remediate, Document
The audit covered the application’s core flows with manual testing: NVDA, JAWS, and VoiceOver passes, complete keyboard-only journeys, and review of forms, modals, and dynamic content against WCAG 2.2 success criteria (see also the WCAG 2.2 Quick Reference). Findings shipped severity-ranked with exact locations and fix guidance.
Rather than handing the report over a wall, we carried out the remediation ourselves under the second contract: semantics, ARIA states, focus management, and contrast, re-testing each fix against the original finding before closing it. Only after that verified re-test did we author the VPAT/ACR — conservative claims, documented exceptions — so the conformance report reflected the remediated product, not the pre-fix backlog.
The Results
- Full accessibility audit and VPAT delivered for the web application
- Findings remediated at code level by the same team that reported them
- Accessible landing page redesign completing the engagement
- All three contracts rated 5.0 out of 5.0 on Upwork
One accountable partner across audit, documentation, and fixes removes the most expensive failure mode in accessibility work: findings that never become fixes.
Why the Order of Operations Matters
Teams that buy a VPAT before auditing get a document that catalogues their failures for procurement to read. Teams that remediate before auditing fix what they guess is broken instead of what is. The sequence that works is unglamorous: audit, then remediate, then document — each step feeding verified evidence into the next.
The audit produced the findings backlog. Remediation worked that backlog at code level. And because the same specialists held both phases, nothing was lost in translation between report and repair — the issue numbering, the test contexts, even the screen reader versions stayed consistent end to end. That same evidence trail is what buyers expect when they ask for an Accessibility Conformance Report (ACR) built on the current ITI VPAT 2.5Rev template (April 2025).
What Each Deliverable Contained
| Deliverable | What it contained | Why buyers care |
|---|---|---|
| Audit report | Severity-ranked findings with WCAG mapping, exact locations, reproduction steps and code-level fix guidance | Developers can fix issues without guessing. See a sample audit report. |
| VPAT/ACR | Per-criterion conformance levels with testing-based remarks and documented exceptions | Procurement and security reviewers get an honest, current answer. |
| Remediation log | Each finding closed with its fix, re-test result and date | An audit trail for the next enterprise buyer. |
| Landing page redesign | An accessible-by-default marketing page matching the application standard | The first page buyers see meets the same standard as the app. |
The remediation log deserves special mention: when the next enterprise buyer asks “how do you handle accessibility?”, a dated record of found-fixed-verified issues answers more convincingly than any policy statement. It demonstrates process, not intention — and process is what procurement is actually evaluating. For SaaS teams facing similar procurement reviews, see our related VPAT for SaaS case study and the SaaS accessibility specialty overview.
Our Accessibility Audit and VPAT Process for SaaS Products
This engagement followed the same six steps we use on every SaaS accessibility audit and VPAT project. The order is what keeps the final report honest:
1. Scope the product and the VPAT edition
We agree the product version, platforms and user journeys in scope, and which edition of the VPAT your buyers need.
- Journeys: sign-up, login, core workflows, settings and billing
- You get: a fixed scope and the right edition before testing starts
2. Audit against WCAG 2.2 AA
Specialists test every in-scope screen with NVDA, JAWS and VoiceOver, keyboard only, and with automated checkers for coverage.
- Why manual: the W3C notes that evaluation tools “can not determine accessibility, they can only assist in doing so”
- You get: each issue ranked by severity, mapped to a WCAG success criterion and given fix guidance
3. Remediate in code
Fixes go into shared components first, so one change clears the same issue across the app.
- Typical fixes: names, roles and states, focus management, form errors and contrast
- Who: the same team that wrote the findings
4. Re-test every fix
Each finding is re-tested with the same steps and assistive technology that found it.
- Closed with: its fix, result and date in the remediation log
- Why it matters: the log becomes your audit trail for future buyers
5. Write the ACR from verified results
Every criterion gets a conformance level and a remark that explains any remaining exception.
- Levels: Supports, Partially Supports, Does Not Support or Not Applicable
- Based on: the re-tested product, not the first audit
6. Review and hand over
A second specialist reviews the report before delivery.
- Your teams get: the ACR together with the remediation log for sales and compliance
- After releases: we re-test and update the report
Which VPAT Edition Does a SaaS Product Need?
The Information Technology Industry Council (ITI) publishes the current template, VPAT 2.5Rev (April 24, 2025), in four editions. The edition decides which standards, and which version of WCAG, the report covers:
| Edition | Standards covered | Choose it when |
|---|---|---|
| WCAG | WCAG 2.0, 2.1 and 2.2 | You sell to private-sector buyers, answer security reviews or RFPs. The usual choice for SaaS. |
| 508 | Revised Section 508 Standards (WCAG 2.0 Level A and AA) | You sell to US federal agencies. |
| EU | EN 301 549 (WCAG 2.1) | You sell to European public-sector buyers or customers working toward the European Accessibility Act. |
| INT | All three standards in one report | Your product is sold in several markets. |
ITI does not review or approve VPATs, and there is no official VPAT certification. When buyers ask for a “VPAT audit”, they usually mean independent testing behind the report: ITI says a third-party review is optional, but a government or other solicitation may require one. A VPAT completed for a specific product is called an ACR, and Section508.gov recommends that vendors generate one for any ICT they market to the federal government. US universities and state agencies ask SaaS vendors for ACRs too, because the ADA Title II web rule requires WCAG 2.1 AA for their web content and mobile apps, including what they provide through vendors, by April 26, 2027 (populations of 50,000 or more) or April 26, 2028 (smaller entities and special district governments). Buyers judge an ACR on the testing behind it, which is why this client’s report was written only after the re-test. For more detail, read our VPAT for SaaS guide.
What an Accessibility Audit and VPAT Cost
Our audits are fixed-price, and the VPAT/ACR is quoted on top after a short scoping review, usually within 1 to 2 business days:
| Option | Price | Best for / what you get |
|---|---|---|
| Free 30-minute call (opens in new tab) | Free | A first conversation: where your product stands, which VPAT edition your buyers need, and a fixed-price quote. |
| 1-hour technical consultation | $100 | A technical session: review an existing ACR, a buyer’s questionnaire or another vendor’s quote, talk with your developers, or check issues live. |
| Quick Accessibility Audit | $500 | Up to 5 page templates and a top-10 issues report. Finds the blockers before you commit to an ACR. |
| Complete Accessibility Audit | $2,000 | Up to 25 templates or key user flows, full manual testing in JAWS, NVDA and VoiceOver, a re-test of fixed issues and an accessibility statement draft. The usual starting point for a SaaS web app. |
| VPAT/ACR documentation | Quoted | Priced by edition, platforms and user journeys. See what our VPAT/ACR documentation includes. |
| Accessibility remediation | Quoted | Priced from the audit findings if you want our developers to make the fixes. |
Compare the packages on our accessibility audit pricing page, or read the accessibility audit cost guide to see what drives the price.
Who Does the Work
Our VPAT and ACR projects are led by founder Mohammad Shadab Saifi, who holds the IAAP CPACC, WAS and CPWA credentials and is a DHS Section 508 Trusted Tester, with 10+ years of accessibility experience. The same team audits, fixes and documents, so nothing gets lost between the report and the repair. See more of our team and our other case studies.
Want the Full Cycle Handled?
If you need an accessibility audit and VPAT for a SaaS product, and a team that can also do the fixing, request a VPAT quote, get a free accessibility needs assessment or start a $500 Quick Audit. Prefer to talk first? Book a free 30-minute call to scope the project, or book the $100 one-hour technical consultation if your developers want to walk through issues with a specialist now. You can also see our accessibility audit services, VPAT documentation, accessibility remediation and the Happeo VPAT case study. US buyers evaluating ADA Title III risk can also review ADA.gov web guidance alongside WCAG 2.2.
Why This Matters
SaaS procurement reviews increasingly ask for both evidence of testing and a completed VPAT, and this engagement was structured to produce both from the same underlying work: a full manual audit against WCAG 2.2, hands-on remediation of what the audit found, and a VPAT built from the same verified findings rather than a separate desk review. Delivering all three under one six-week engagement meant the client’s sales and compliance teams received a conformance report that accurately reflected the product’s tested state at handoff — the detail enterprise buyers and security reviewers tend to check first. All three contracts in the engagement, spanning audit, remediation, and VPAT delivery, closed with a 5.0 rating from the client.