An electronics or technology customer has asked you to complete an RBA Self-Assessment, and possibly a VAP audit. Before starting, establish which step you are at: the SAQ is a risk screen completed online; the VAP is an on-site audit that follows where the risk rating or the customer requires it.
| First question | Short answer |
|---|---|
| What is the RBA? | The Responsible Business Alliance, the electronics industry's responsible supply chain initiative, with a Code of Conduct members expect suppliers to meet. |
| What is the SAQ? | A self-assessment questionnaire completed in RBA-Online. It produces a risk rating and is valid for 12 months. |
| What is the VAP? | The Validated Assessment Program: a 2–5 day on-site audit by an RBA-approved firm, shareable across member customers. |
| Which Code version? | The v8.0 series at the time of checking. Ask which version your audit runs against. |
| What else will they ask? | Conflict minerals reporting (tin, tantalum, tungsten, gold, increasingly cobalt), usually a CMRT. |
Platform details and links checked 14 July 2026. The Code, SAQ, and VAP protocol are versioned and updated; check the RBA assessment pages for current documents.
What the RBA is
The Responsible Business Alliance is the main responsible supply chain initiative for the electronics and technology industry; its members include many of the largest electronics brands and manufacturers. At its center is the RBA Code of Conduct: standards covering labor, health and safety, environment, ethics, and management systems that members expect suppliers to meet.
"Do the RBA" means: demonstrate that your facility meets the Code. The path is a self-assessment first, then, where the risk picture warrants, an on-site audit.
Step 1: the SAQ
The request almost always starts with the Self-Assessment Questionnaire, the RBA's structured self-assessment of your facility against the Code. It works as a risk screen: the answers produce a risk rating the customer uses to decide what follows.
- Where. The SAQ is completed in RBA-Online, the RBA's platform, not in an emailed spreadsheet. Your customer or the RBA provides access. It is available in English, Chinese, Japanese, Korean, and Spanish (RBA assessment tools).
- Validity. A completed SAQ is valid for 12 months. One accurate, evidenced SAQ serves every RBA member customer who asks during that year. It is an annual rhythm.
Answer completely and accurately. An inflated SAQ contradicted by a later audit is worse than an accurate one that shows gaps. Have evidence behind every answer. To plan the work, the free time estimator gives an hours figure for a questionnaire of this kind.
Step 2: the risk score decides whether a VAP follows
A lower-risk facility may go no further than the questionnaire. A higher-risk rating, or a customer wanting deeper assurance, triggers the VAP — the Validated Assessment Program, the RBA's standardized on-site audit by RBA-approved firms.
The VAP produces a score and a findings report recognized by multiple RBA member customers; one audit can satisfy several buyers. Members can also commission Customer-Managed Audits (CMAs) or Auditee-Managed Audits (AMAs), run under the same VAP protocol with approved firms but arranged and paid for differently (RBA assessment tools). On the factory floor the experience is the same; who commissions it mainly affects who sees the report first.
The audit days
A VAP audit of a single facility typically runs 2 to 5 days on site, depending on size and complexity. Three strands, usually in parallel:
- Document review — policies, payroll and working-hour records, permits, training logs, management-system documentation, against the Code.
- Interviews — managers and, critically, workers, usually in private without supervisors. Worker interviews are where inconsistencies between paper and practice surface.
- Site survey — a physical walk-through of production areas, warehouses, and where applicable dormitories and canteens, checking safety, hygiene, and conditions.
The current protocol is the v8.0 series, aligned to Code of Conduct version 8.0. Know which Code version your audit runs against; it defines what is checked.
The five Code sections
Both SAQ and VAP are organized around:
- Labor — freely chosen employment (no forced or bonded labor), no child labor, working hours, wages and benefits, humane treatment, non-discrimination, freedom of association
- Health and safety — occupational safety, emergency preparedness, machine safeguarding, industrial hygiene, sanitation, dormitory and canteen conditions where applicable
- Environment — permits, hazardous substances, wastewater and solid waste, air emissions, and increasingly energy and greenhouse gas data
- Ethics — anti-corruption, no improper advantage, responsible minerals sourcing, privacy, whistleblower protection, no retaliation
- Management systems — policy, accountability, risk assessment, training, corrective action, documentation. Weak management systems pull down otherwise adequate facilities.
Findings, CAP, closure
VAP findings are classified by severity: priority (the most serious) and major or minor non-conformances. Priority findings — forced-labor indicators, an imminent safety danger — demand immediate attention. After the audit you receive a corrective action plan.
- Fix priority findings first. They carry the heaviest consequences and often trigger a re-audit.
- Document every correction with evidence, not only a revised policy.
- Meet closure deadlines. Closure is typically verified through a follow-up audit.
- Keep the evidence. It feeds next year's SAQ and other customers' requirements.
Conflict minerals
RBA-driven customers almost always ask electronics suppliers about responsible minerals sourcing: tin, tantalum, tungsten, and gold, increasingly cobalt. Expect to complete a minerals reporting template such as the CMRT, identifying the smelters in your supply chain. If you use these materials, start mapping sub-suppliers early; it is the item that most often stalls an electronics supplier's response. The wider picture is in ESG for electronics suppliers.
The document library
- Labor — contracts, age verification, payroll and working-hour data, recruitment-fee and voluntary-employment evidence
- Health and safety — risk assessments, training logs, machine-safety and emergency-preparedness records, incident log
- Environmental — permits, hazardous-substance inventory, waste and wastewater records, energy and emissions data
- Ethics — anti-corruption policy, whistleblower mechanism, conflict-minerals reporting
- Management systems — policies, responsibilities, internal audit and corrective-action records
If energy and emissions figures are the gap, the free carbon calculator produces Scope 1 and 2 numbers from a year of utility bills.
What not to do
- Do not inflate the SAQ. A later VAP exposes the gap.
- Do not coach workers or back-date records. Falsification and interview inconsistencies are among the most serious findings.
- Do not neglect conflict minerals. Sub-supplier mapping takes time.
- Do not treat it as a one-day event. The SAQ renews every 12 months; conformance is an operating standard.
The bottom line
The RBA route follows the customer's risk logic: an accurate SAQ in RBA-Online, valid for 12 months, screens the facility; where the score warrants, a 2–5 day VAP checks the five Code sections through documents, interviews, and a site walk-through. The result is shareable across RBA member customers. Prepare labor, safety, environmental, ethics, and management-system evidence, map the conflict-minerals supply chain early, and close priority findings fast.