The Vendor Iframe in a Standing AA Claim
Northfield University's public accessibility statement, published last term, says the student portal "conforms to WCAG 2.2 Level AA." The portal's course-evaluation step embeds a vendor iframe that 12,400 students must use each term, and evaluations cannot be submitted any other way. The vendor's VPAT marks a dozen criteria "partially supports." Your audit, covering 30 sampled pages plus the whole evaluation process, found a keyboard trap in the iframe's date picker (Escape and Tab both fail), star-rating inputs exposed as unlabeled radio groups, and helper text at 3.1:1 contrast. The registrar says the vendor cannot be replaced before the next term, and the CIO wants the statement left unchanged because "the failures are the vendor's, not ours." You have six weeks before the statement is due for its annual review.
1. The CIO argues that vendor defects should not affect the university's conformance claim. Evaluate that position and state what the claim can honestly say today.
Read the worked answer
Conformance is evaluated on full pages and on complete processes, not on who wrote the code. If the evaluation step cannot be completed by keyboard, the page fails; a conformance claim covering the portal is therefore not defensible while that trap exists. The keyboard trap is the decisive issue: it blocks a required process, so even a narrow "some pages conform" statement would mislead students who must use that step.
The practical options, in order of preference:
- Get a vendor patch for the trap and the unlabeled radios within the six weeks; both are small, well-understood fixes.
- If the patch misses the deadline, change the statement to describe the portal as not yet conforming, naming the affected step and the known barriers.
- Provide an equivalent route - a phone or email evaluation process - and say so prominently, so the barrier does not become a denial of service.
Contrast at 3.1:1 and missing radio-group labels are real failures, but they do not block the process the way the trap does; they can be scheduled rather than treated as release blockers. The claim should reflect the worst step in the process, not the average page.
2. How would you scope and evidence the next evaluation so that the claim is repeatable rather than a one-off audit?
Read the worked answer
Use a structured sampling method rather than an ad hoc page list. Define the scope as the portal plus every process a student must complete, then sample: all templates and unique page types, all steps in high-stakes processes (evaluation, registration, payment), and pages with known complexity such as forms and data tables. Thirty pages is a reasonable starting sample for a portal of this size, but the evaluation step must be tested end to end, including the iframe, because it sits inside the process.
Record for each sample: URL or screen, success criteria tested, tool or technique used (keyboard only, screen reader, code inspection, automated scan), result, and evidence. Automated scans support coverage but never substitute for manual keyboard and screen-reader checks; a page can have zero automated findings and still trap focus.
Note which content is third-party but keep it in scope. Re-run the evaluation on a schedule tied to the statement review and after any vendor upgrade, since embedded widgets can regress silently. Keep the raw evidence, because a future reviewer will ask how the claim was reached, not just what it says.
3. Draft the content requirements for the revised statement, assuming the vendor trap is fixed but the contrast issue remains open.
Read the worked answer
The statement should be specific enough that a student can decide whether the portal will work for them. Required elements:
- Scope: which sites and processes it covers, and explicitly which third-party services are included.
- Standard and level: WCAG 2.2 AA, with the date of the last evaluation.
- Known limitations: for example, helper text in the evaluation form falls below 4.5:1 contrast; state where it appears and what information it conveys, since the content is still available.
- Workarounds: alternative evaluation submission, contact route, and response time.
- Feedback mechanism: a monitored address and a commitment to respond, with an escalation path if the response is unsatisfactory.
- Review date and owner: who maintains the statement and when it is next verified.
Avoid vague "partially accessible" language and avoid claiming full conformance while a known failure remains in a required process. If the trap is fixed, AA is plausible only if the remaining failures are documented and scheduled; if they are not fixed, the statement should say the portal does not yet meet AA rather than implying it does.