VAP Audit Process
Defining each step of a VAP audit.
Table of Contents
It is recommended that auditees review the Auditee Preparation document here to familiarize themselves with the roles and responsibilities of those involved with the VAP audit, as well as the VAP audit process itself.
Step 1: Initiation
A VAP audit may be initiated by a Member Customer, the RBA APM, or the auditee themselves.
Prior to initiating a VAP audit, your facility must have a valid facility SAQ!
A valid facility SAQ meets the following criteria:
- Has been completed within the past year.
- Is the most current version.
- Has been completed to 100% and Released within the system.
Self-Initiating a VAP Audit Request in RBA-Online
To initiate an Audit request against your own facility within the RBA-Online system, go to the “My Audits” page under the Audit Tab:
You will be brought to the following screen that will hold a list of all previous audits that you have completed:
From here select the [Initiate Audit] button on the top left. This will open a window for you to enter the information that relates to the audit you would like to initiate.
Select the facility name where you would like the audit conducted, and complete all of the required fields.
Audit Category: What audit standard are you requesting.
Audit Type:
- Initial Audit (this is a biannual Audit, valid for two years from end date)
- Closure Audit (this is used to Close out any Additional Findings)
- Priority Closure Audit (this is required in order to close out any Priority Findings)
When you have finished entering data on the first page, click [Next →] to go to the next page.
Business Type: Manufacturer or Service Provider options for VAP audits. Recruitment Agency, Labor Agent or Employment site options for SVAP audits.
The scoping questions will change depending on the audit and business type. When you have finished entering data on the Scope page, click [Next →] to go to the next page.
Choose the Customer that is the primary requester for the audit, and add any additional customers that should get automated alerts related to the audit, then click [Next →] to go to the next page.
Identify who will be paying for the audit, and ensure point of contact information is accurate, then click [Next →] to go to the next page.
Choose who will be responsible for reviewing and approving the corrective action plan (CAP) for any findings of non-conformance uncovered during the audit, then click [Initiate].
From here you'll have the option to eSign or sign manually by uploading signed documents onto the RBA Online Platform. Selecting Manual will trigger the following pop-up window:
On this platform, you will have access to download the templates required for the audit process.
Once you complete the templates, you will need to sign them and upload them onto the platform. Once the signed templates are uploaded, the Audit Program Manager (APM) will review the Self-initiated VAP Audit, which triggers a review process.
After the review process is completed, the audit moves to the scoping stage. The length of the audit is based on various factors such as location, facility size, and number of workers.
Once the scoping agreement is ready, the auditee will be notified to review and sign it. All the tasks to be completed will be displayed on the RBA Online Platform under the "To-Do" section.
Step 2: Contracting
How to Sign your Auditee Agreement and Attachment B
When an Audit is initiated against your facility you will receive a notification that the audit has been initiated. For the process to move forward you will first have to log on to RBA-Online and Sign your Auditee Agreement (AA) and Attachment B Documents.
RBA online offers 2 methods of obtaining the signature:
- Manual: You will download the files and manually sign them and re upload them into the system
- E sign: This allows you to electronically sign them using DocuSign technology.
The Facility Administrator will have a To-Do on their RBA-Online dashboard noting that there is a pending action to sign the Contracting Documents.
Clicking on the Audit ID in the To-Do brings you directly to the Contracting tab for the audit record, where you may select your signing method.
E-Sign
The electronic format of the documents will appear as shown, and you will be prompted for signatures.
After you have entered your signatures in the required sections you will have to select [FINISH] to submit the signed documents to the RBA for countersignature.
Manual
If you choose to sign manually, a modal will appear where you can download the documents by selecting the link next to each document name.
Once you have downloaded and signed the Contracting Documents, you will then upload the signed documents using the file uploader.
Once the files have been uploaded, you would then click [Submit] to send the documents to the RBA for countersignature.
Step 3: Bidding & Scoping
Once the Contracting Documents are countersigned by the RBA, the audit will go through the scoping process and the RBA Audit Program Manager (APM) will send out Requests for Bids to various audit firms. The RBA APM will select an audit firm based on various criteria.
Step 4: Scoping Agreement
How to Sign Your Scoping Agreement (SA)
After the Bidding process for your audit has been completed, you will receive a Scoping Agreement (SA) that details out the costs associated with your audit and confirms the final audit date(s).
For the audit process to move forward you must log on to RBA Online and Sign the SA.
RBA online offers 2 methods of obtaining the signature:
- Manual: You will download the file, manually sign and re-upload to the system
- E-sign: This allows you to electronically sign the document using DocuSign technology.
Upon Logging on to the system, the Facility administrator will have a To-Do that there is pending documents to sign for the audit:
Click on the Audit ID in the To-Do which will bring you directly to the SA screen where you can choose your signing method:
E-Sign
If you choose E-Sign, the electronic format of the document will appear, and you will be prompted for a signature.
After you have entered your signatures in the required sections you will have to select Finish to submit the signed documents to RBA.
Manual
If you choose manual, a modal will appear where you can download the SA by selecting the link next to the document name.
After you have signed the document, upload it to the file uploaded and click [Submit] to send the signed file to the RBA for countersignature.
Step 5: Audit
It is recommended, but not required, that auditees utilize the “Pre-Audit Checklist” within RBA-Online to gather and share critical documents, records and policies with auditors prior to the on-site visit. The checklist can be found by navigating to Audit > My Audits, then Options > Audit Data for the applicable audit record.
Auditees must ensure all documentation requested by the auditor is available and ready for review by lunch time on Day 1 of the on site audit. If not, the audit will be cancelled.
Once the auditors are on site, the following steps will ensue:
- Opening Meeting
- Facility walk-through
- Interviews with management and workers
- Document review
- Daily wrap up / closing meeting
The auditee responsibilities include, but are not limited to, the following:
- Ensure all documents are ready for review by lunch time on Day 1.
- Provide resources to complete working hours template on Day 1.
- Assign representatives for Labor, Ethics, Employee Health and Safety (EHS) and Management Systems.
- Ensure management representative and workers selected for interviews are available at the agreed upon times.
- Ensure personnel, time and wage records for subcontracted workers in core operations are available by the end of Day 1.
- Provide required PPE and safety guidance during facility tours.
For more information and additional guidance on VAP audits, please go to https://www.responsiblebusiness.org/vap/about-vap/.
Step 6: Post Audit
Once the on-site visit has been completed, the following steps will ensue:
- Audit firm will send the signed Audit Findings Acknowledgement (AFA) document to the RBA AQM (Audit Quality Manager).
- Audit firm will prepare the draft audit report and send to AQM.
- The AQM performs a sanitation check on the draft, then sends it to the auditee for review. Auditee will receive notification of draft ready for their review, and is provided the opportunity to provide feedback via the Discussion tab on the audit record:
Draft Report
How do I view my draft report?
Before you can access your draft audit report, please ensure the following prerequisites are met:
- Active RBA Online Subscription: Ensure your subscription is up to date.
- Completed Risk SAQ: Complete the Risk Self-Assessment Questionnaire (SAQ) unless an exception applies.
- Completed Previous Audit Tabs: All previous audit tabs must be fully completed.
Notification Process
The audit Program Manager will notify all interested parties when the DRAFT Report is available to be reviewed. The message will contain the following information:
Audit ID:
Company Name:
Facility Name:
Facility ID:
Audit Date:
Auditor Name:
Audit Firm:
Just so you know, the message will give you a time frame to review the DRAFT Report and to provide any feedback you may have by following this guidance article: How to Submit Auditee Feedback.
Follow the steps below to view your draft report:
- Sing into RBA Online and find the 'Audit' button on the left Navigation menu.
- Enter the audit number to search for the appropriate record.
- Navigate to the audit record, then click on Options > Audit Data.
- Next, move to the Report tab and click on the [Download Draft Report] button at the bottom of the screen.
- The AQM performs a QC (Quality Control) check and provides input to the audit firm prior to release of final report.
- Audit firm issues final report, including QA input.
- Final VAR (Validated Audit Report) is reviewed and released to the auditee.
Important: In the case of non-member auditees, the final VAR will NOT be released by the system until and unless the audit invoice has been marked as paid by the RBA Finance department. For questions or concerns related to audit invoicing/payments, please reach out to rbafinance@responsiblebusiness.org.