Validated Assessment Program Glossary
The Validated Assessment Program (VAP) has been created to increase efficiency and reduce redundancy of onsite CSR compliance audits in industry supply chains. Below is a glossary of commonly used VAP terminology.
First-Party Audit: An audit usually performed by the company or department within a company upon itself. A first-party audit is usually conducted by the organization’s internal audit group, however employees within a department or company may also conduct an assessment similar to a first-party audit. In such an instance this "audit" is generally referred to as a "self assessment." First-party audits are tools for gauging an organization’s continuous improvement efforts as well as measuring the return on investment for sustaining that effort.
Second-Party Audit: An audit of another organization’s program not under the direct control or within the organizational structure of the auditing organization. Second-party audits are usually performed by the customer upon its suppliers (or potential suppliers) to ascertain whether or not the supplier can meet existing or proposed contractual requirements.
Third-Party Audit: An objective assessment of an organization’s system conducted by an independent, outside auditor or team of auditors. The term "third party" is synonymous with the VAP APM and VAP audit firms whose primary responsibility is to assess an organization’s system for conformance to the Code.
VA: Validated Audit
Validated Audit: RBA-approved, third-party onsite audit managed in accordance with approved quality processes and overseen by the selected Audit Program Management firm to meet “RBA Validated Assessment Program Quality Requirements.”
Validated Assessment Program (VAP) FAQs
- What is the Validated Assessment Program (VAP)?
- How does the VAP process work?
- What is the scope of a Validated Audit?
- Who owns the Validated Audit Report?
- Can the Validated Audit Report be shared with multiple customers?
- How is confidential information protected?
- Who pays for the Validated Audit?
- How much does a Validated Audit cost?
- What are the payment terms for a Validated Audit?
- How long will an audit of a facility take?
- How long is the Validated Audit Report valid?
- When can I purchase or request a Validated Audit?
- In which countries can Validated Audits be conducted?
- When will the audit date be scheduled?
- What level of quality can be expected from a Validated Audit?
- How are the independent third-party auditors that conduct the RBA VAP certified?
- Will a certificate be issued once all the corrective actions have been adequately addressed?
- Who are the VAP contacts?
- What are the roles and related RBA contracts of the parties in the VAP?
- Who administers the VAP?
- Where can I obtain a copy of the RBA Insurance Certificate?
- How many companies have undergone a Validated Audit?
- I have more questions about the VAP; who should I contact?
The Validated Assessment Program is an industry solution for improving business practices by providing companies assurance in identifying risks and driving improvements and robust management systems for labor, ethics, health, safety and environmental conditions in the supply chain. An RBA-approved, independent third-party audit firm provides an onsite audit of a supplier, potential supplier, and/or a company’s own facilities.
The end-to-end process and the audit firm are independently managed by the RBA Audit Quality Manager (AQM) to ensure process integrity and adherence to the RBA VAP Quality Management Guidelines. The Auditee is required to provide necessary Corrective Action Plans following the release of the Validated Assessment Report (VAR) and undergo a closure assessment as needed.
There are five primary steps to the RBA VAP process, all of which are guided by the APM.
- Step 1: Initiate Request - company requests an onsite audit of a supplier or its own facility and gets started with contracts.
- Step 2: Scheduling - finalize cost and scheduling with a selected audit firm.
- Step 3: Onsite audit
- Step 4: Report - ensure quality assurance and the release of the VAR. This step covers planning for Corrective Action Plan (CAP) management.
- Step 5: Follow Up - CAP management and Closure audit verification.
Additional details are available on the main VAP page.
The scope of a Validated Audit includes all common and customer-specific areas of a facility or portions as defined in the VAP Operations Manual, latest version.
The VAR is always owned by the Auditee. The Auditee Agreement obligates the Auditee to provide access to and distribution of the VAR to interested Audit Buyers who are approved by the Auditee and to ensure the VAR results are available for industry-wide aggregation and reporting. The Auditee is free to provide the VAR to additional customers at no cost beyond the initial cost of the assessment.
See the main VAP page to view the Auditee Agreement.
By design the VAP provides for sharing of the VAR at the discretion of the Auditee. There are three primary functions that allow for this:
- RBA VAP Contract agreements ensure approved customers will receive the VAR.
- RBA VAP Quality Management guideline ensures that a confidentiality review is conducted as part of the quality assurance process.
- The scope of the VAP audit is arranged by the VAP APM and the Auditee to ensure it covers areas of a facility that are appropriate to the Auditee’s customers.
All parties in the VAP will sign an Auditee Agreement with the RBA which includes non-disclosure elements. The Audit Program Manager and the Audit Firms are under the same confidentiality agreements with the RBA and are the only parties with access to confidential information required throughout the VAP. Information will be available as defined by the VAP contracts and existing business agreements. Any sensitive information will be protected in compliance with all applicable legislation.
See the main VAP page to view the AA.
There are two primary ways in which Validated Audit Reports are generated based on who the Audit Buyer is:
- Scenario 1: Audit Buyer is the Auditee
- Scenario 2: Audit Buyer(s) is a customer of the Auditee. This is also called a third-party payer.
The Audit Buyer will pay the cost of services (Validated Audits, CAP Management, and/or Validated Closure Audits) in advance of the assessments being conducted. This may require audit buyers to get special permission from their purchasing and procurement departments.
The fee includes Audit Program Management and the third-party onsite assessment cost. Costs vary due to the size and complexity of a specific facility. Details will be provided as your company engages with the APM.
Audit buyers will be invoiced for the VAP audit as a part of the contracting process before the audit is scheduled. Payment terms are 60 days. Audits can be scheduled and conducted once the contracting is completed, but the final audit report will not be released until payment has been received.
The duration of a facility VA depends on the size (geographic and number of workers) and complexity (processes) of a facility, and may range from 2 to 12 person days onsite depending on the specific factors of a site. The actual planned time onsite is determined by the APM once a completed Self-Assessment Questionnaire from the Auditee has been received.
A VAR is valid up to two years. Typically a new VA would be driven by a customer risk assessment and/or significant changes in a facility such as in size or by adding additional processes, new management, etc. The reports can be obtained directly from the Auditee. The APM will ensure Audit Buyers get access to the VARs they have purchased. The APM may provide a validation check with the final released report as requested.
Validated Audits can be requested at any time by contacting the APM.
Validated Audits are conducted globally according to the availability of RBA-approved auditors. Contact the APM for specific regional details.
Once a validated audit is requested, it is up to the audit firm assigned by the APM and the auditee to confirm a mutually agreeable date. An interested customer of the auditee may request a specific target date up front directly to the auditee. Confirming the schedule is a part of the contracting process managed by the APM.
The Validated Audit Program provides the highest quality information gathering and analysis of working conditions at a facility within the industry. In order to ensure this consistent level of quality, the RBA has implemented the following key components of its program:
- Independent selection and allocation of qualified third -party audit firms and overall quality review through an expert Audit Program Manager
- Consistent governance based on the RBA Code of Conduct and the VAP Operations Manual
- Independent performance review of each audit firm and qualified/certified auditor participating in the Validated Audit Program
- Assurance of sufficient time on site with a minimum of two auditors to ensure the integrity and depth of information gathering
- Optimized scope of coverage for seamless sharing of the resulting Validated Audit Report to multiple site customers at the Auditee’s discretion
- IRCA-Recognized Labor and Ethics Auditor Training certification program for lead auditors
- Independent management of the VAP Corrective Action program
- Commitment to quality and continuous improvement per the Service Level and Quality Statement
- Expert helpdesk on RBA Code of Conduct provisions and interpretation available to auditees, auditors, and RBA members throughout the process
The APM uses a rigorous process to select the current auditors based on training and experience. The RBA also runs auditor certification and training courses. Information and class availability is posted on the RBA events page. Individual auditors are approved per the RBA Auditor Guidebook.
For information about the VAP Recognition Program, please see these FAQs.
See the main VAP page for contact information.
See the main VAP page for information about contractual documents.
The RBA is the independent administrator and central contracting organization of the VAP. Audit Buyers execute contracts with the RBA to purchase validated audits. The RBA contracts with the AQM and the independent third-party audit firms to run the VAP. Auditees execute the Auditee Agreement.
The RBA Insurance Certificate is available upon request from the APM.
Since 2009, RBA members have completed more than 4,000 VAP onsite compliance audits conducted by independent third-party audit firms that have been approved by the RBA to execute the VAP protocol.
Please see the main VAP page for additional information and contact details.