Audit Records
Accessibility audit records form the evidentiary backbone of your legal defense. Maintain them with the same rigor as financial records.
Audit Record Requirements
Each audit record should establish:
- Date and scope of the audit
- WCAG version and conformance level tested
- Testing methodology (automated, manual, AT testing)
- Tools and assistive technologies used
- Tester names, qualifications, and certifications
- Complete findings with WCAG success criterion references
- Severity classifications for each finding
- Screenshots or screen recordings as evidence
Retention Policy
Accessibility records should be retained for a minimum of seven years, or in accordance with your jurisdiction's statute of limitations for civil rights claims. Consult legal counsel for jurisdiction-specific requirements.
- Store records in a tamper-evident system
- Back up records to at least two independent systems
- Define retention periods in your data governance policy
- Apply litigation hold procedures when legal action is anticipated
VPAT Management
VPATs (Voluntary Product Accessibility Templates), also called Accessibility Conformance Reports (ACRs), document product conformance against established standards.
Producing Accurate VPATs
An inaccurate VPAT claiming "Supports" when a product does not support a criterion is far worse than an honest disclosure of limitations.
- Base VPAT claims on actual testing, not assumptions
- Use the current VPAT template version (2.5 as of 2024)
- Reference WCAG 2.2 AA or applicable standard
- Be specific about what does not support and why
- Update VPATs after every major release
- Date and version-control all VPAT documents
VPAT Version Control
- Maintain a version history of every VPAT you produce
- Store VPATs alongside the product release they describe
- Archive VPATs for discontinued products
- Review third-party VPATs annually for currency
- Flag outdated vendor VPATs for follow-up
Testing Evidence
Testing evidence provides verifiable proof that accessibility evaluation actually occurred. Assertions without evidence carry little weight.
Automated Test Artifacts
- Save axe-core reports in a searchable format (JSON, HTML)
- Archive CI/CD accessibility test results
- Retain baseline scan results for comparison
- Generate trend reports showing improvement over time
- Store reports with date stamps and product version references
Manual and AT Testing Records
- Create standardized test plans and scripts
- Record screen reader testing sessions where feasible
- Document keyboard navigation testing results
- Maintain tester logs with dates and observed behaviors
- Store screenshots and screen recordings as exhibits
Remediation Tracking
A documented remediation tracking system demonstrates that your organization responds to identified issues with urgency and discipline.
Issue Tracking Requirements
Each tracked accessibility issue should include:
- Unique identifier and date of discovery
- Source (audit, user report, automated scan)
- WCAG success criterion violated
- Severity and priority rating
- Assigned owner and target resolution date
- Current status and status change history
- Verification date when resolved
Remediation Reporting
- Generate monthly or quarterly remediation progress reports
- Track issues opened vs. closed by time period
- Report mean time to remediation by severity
- Document issues that required deferred remediation and why
- Share remediation reports with executive leadership
Accessibility Decision Logs
When your organization makes accessibility-related decisions—whether to defer an issue, accept a risk, or adopt an alternative approach—document that decision.
What to Log
- Decisions to accept or defer remediation of known issues
- Alternative solutions adopted when standard techniques are impractical
- Decisions about ARIA usage and exception rationale
- Changes to accessibility standards or policies
- Decisions made in response to user accessibility complaints
Log Format
- Date of decision
- Decision maker(s) and their role
- Issue or context requiring a decision
- Options considered
- Decision made and rationale
- Review date if the decision is time-limited
Policy Documentation
Policies are often the first documents requested in accessibility litigation discovery. Maintain them as living records with full version histories.
Policy Version Control
- Store all policy versions with effective dates
- Track who approved each version and when
- Document the reason for each policy update
- Maintain an archive of superseded policy versions
- Link policy versions to corresponding audit records
Documentation Infrastructure
Build a documentation system that supports legal needs:
- Use a document management system with audit trails
- Apply access controls that protect document integrity
- Enable full-text search across accessibility documents
- Implement backup and disaster recovery for accessibility records
- Consult legal counsel on litigation hold procedures