RBA SAQ & VAP Audit: A Guide for Electronics Suppliers

An electronics or tech customer has asked you to complete an RBA Self-Assessment — and possibly a VAP audit. If those acronyms mean nothing to you yet, this guide gets you oriented fast: what the RBA is, how the two-step assessment works, what happens during the audit days, and how to close findings so they don't derail a customer relationship.

What the RBA is

The Responsible Business Alliance (RBA) is the main responsible-supply-chain initiative for the electronics and technology industry (its members include many of the world's largest electronics brands and manufacturers). At its heart is the RBA Code of Conduct — a set of standards covering labour, health & safety, environment, ethics, and management systems that member companies expect their suppliers to meet.

When your customer asks you to "do the RBA," they mean: demonstrate that your facility meets the RBA Code. That happens along a well-worn path — a self-assessment first, then, where the risk picture warrants it, an on-site audit. Let's walk it step by step.

Step 1: Your customer asks for the SAQ

The journey almost always starts with a request to complete the SAQ — the Self-Assessment Questionnaire. This is the RBA's structured self-assessment of your facility against the Code, and it works as a risk-screening tool: your answers produce a risk rating that your customer uses to decide what happens next.

Two practical points matter here:

• Where you fill it in. The SAQ is completed in RBA-Online, the RBA's assessment platform — not in a spreadsheet your customer emails you. Your customer (or the RBA) will get you access. The questionnaire is available in English, Chinese, Japanese, Korean and Spanish (RBA assessment tools), so your site team can usually work in a language they're comfortable with.
• How long it lasts. A completed SAQ is valid for 12 months. That's genuinely useful: one honest, well-evidenced SAQ can serve every RBA member customer who asks during that year, rather than each request starting from zero. It also means this is an annual rhythm, not a one-off.

Answer it honestly and completely — an inflated SAQ that a later audit contradicts is worse than an accurate one that flags real gaps. Have evidence behind every answer. If you're trying to plan the work, the free time estimator gives you a realistic sense of the hours a questionnaire like this takes.

Step 2: The risk score decides whether a VAP audit follows

Your SAQ result feeds a risk rating. A lower-risk facility may go no further than the questionnaire. A higher-risk rating — or a customer that simply wants deeper assurance — triggers the next step: the VAP, or Validated Assessment Program, the RBA's standardised on-site audit, conducted by RBA-approved audit firms.

The VAP's big advantage for you is shareability: it produces a score and a findings report that can be recognised by multiple RBA member customers, so one audit can satisfy several buyers instead of each running their own. Members can also commission Customer-Managed Audits (CMAs) or Auditee-Managed Audits (AMAs) — audits run under the same VAP protocol with approved third-party firms, but arranged and paid for differently (RBA assessment tools). From your side on the factory floor, the experience is much the same; who commissions it mainly affects who sees the report first.

What happens during the audit days

A VAP audit of a single facility typically runs 2 to 5 days on site, depending on the size and complexity of the operation. Expect three strands of activity, usually running in parallel:

1. Document review — auditors examine your policies, payroll and working-hour records, permits, training logs, and management-system documentation against the Code.
2. Stakeholder interviews — auditors speak with managers and, crucially, with workers, usually in private and without supervisors present. Worker interviews are where inconsistencies between paper and practice surface.
3. Visual site survey — a physical walk-through of production areas, warehouses, and, where applicable, dormitories and canteens, checking safety, hygiene, and working conditions first-hand.

The current audit protocol is the v8.0 series, aligned to RBA Code of Conduct version 8.0. You don't need to memorise version numbers — but you should know which Code version your audit will run against, because it defines exactly what auditors check.

The five Code sections auditors check

Both the SAQ and the VAP are organised around the RBA Code's core areas:

1. Labour — freely chosen employment (no forced or bonded labour), no child labour, working hours, wages and benefits, humane treatment, non-discrimination, freedom of association.
2. Health & Safety — occupational safety, emergency preparedness, machine safeguarding, industrial hygiene, sanitation, dormitory and canteen conditions where applicable.
3. Environment — environmental permits, hazardous substances, wastewater and solid waste, air emissions, and increasingly energy and greenhouse-gas data.
4. Ethics — anti-corruption, no improper advantage, responsible sourcing of minerals, privacy, whistleblower protection, no retaliation.
5. Management Systems — the backbone: how you govern all of the above — policy, accountability, risk assessment, training, corrective action, and documentation. Weak management systems drag down otherwise-decent facilities.

Findings, the CAP, and closure

VAP findings are classified by severity — commonly priority (the most serious) and major/minor non-conformances. Priority findings (for example, forced-labour indicators or an imminent safety danger) demand immediate attention. After the audit you receive a corrective action plan (CAP):

1. Fix priority findings first — they carry the heaviest consequences and often trigger a re-audit.
2. Document every correction with real evidence, not just a revised policy.
3. Meet closure deadlines — CAPs have timelines, and closure is typically verified through a follow-up (closure) audit.
4. Keep the evidence — it feeds next year's SAQ and any other customer's requirements.

Version note: the RBA Code, the SAQ, and the VAP protocol are issued in versioned editions and updated periodically — the current VAP protocol is the v8.0 series at the time of writing. Check the RBA's assessment pages for the current documents rather than relying on a fixed number.

Conflict minerals: the electronics-specific extra

RBA-driven customers almost always also ask electronics suppliers about responsible minerals sourcing — the "conflict minerals" (tin, tantalum, tungsten and gold, plus increasingly cobalt). Expect to complete a minerals-reporting template (such as the widely used CMRT) identifying the smelters in your supply chain. If you use these materials, start mapping your sub-suppliers early — it's the item that most often stalls an electronics supplier's response, and it sits alongside the broader ESG expectations electronics customers place on their suppliers.

The document library to prepare

• Labour records — contracts, age verification, payroll and working-hour data, recruitment-fee and voluntary-employment evidence.
• Health & safety — risk assessments, training logs, machine-safety and emergency-preparedness records, incident log.
• Environmental — permits, hazardous-substance inventory, waste and wastewater records, energy and emissions data.
• Ethics — anti-corruption policy, whistleblower mechanism, conflict-minerals reporting.
• Management systems — policies, responsibilities, internal audit and corrective-action records.

If energy and emissions figures are the gap, the free carbon calculator will get you defensible Scope 1 and 2 numbers from a year of utility bills.

What not to do

• Don't inflate the SAQ. A later VAP will expose the gap and damage trust; answer accurately from the start.
• Don't coach workers or back-date records. Falsification and worker-interview inconsistencies are among the most serious findings.
• Don't ignore conflict minerals. For electronics suppliers it's expected, and sub-supplier mapping takes time.
• Don't treat it as a one-day event. Your SAQ renews every 12 months and RBA conformance is an operating standard; keep records current year-round.

The bottom line

The RBA route follows your customer's risk logic: an honest SAQ in RBA-Online (valid for 12 months) screens your facility, and where the score warrants it, a 2–5 day VAP on-site audit checks the five Code sections through documents, interviews, and a site walk-through. The result is shareable across RBA member customers. Prepare your labour, safety, environmental, ethics and management-system evidence, map your conflict-minerals supply chain early, and fix any priority findings fast.