How to write your own VPAT

You are allowed to. Nothing about this is restricted, and for some companies it is the right call. Here is the actual procedure, what it costs you in time, and the point at which doing it yourself starts to work against you.

The procedure

Get the template. The Information Technology Industry Council publishes it free. Pick the edition matching what your buyer named — WCAG, Revised Section 508, EN 301 549, or the INT edition that carries all three.
Fix the scope and write it down. Which product, which version, which templates or screens. A report whose scope is vague is a report nobody can rely on.
Run the automated tools. axe DevTools, Lighthouse or WAVE, on every template. Free, and takes an afternoon. Expect them to decide roughly a third of the criteria. The rest need a person.
Do the keyboard pass. Unplug the mouse. Tab through every screen. Can you reach every control? Operate it? See where you are? Escape from anything that opens? This one pass finds more real defects than any scanner.
Do the screen reader pass. NVDA on Windows is free; VoiceOver ships with macOS. Listen to a form, a table, a modal, an error message.
Fill in every row. Every criterion gets a level and an explanation. The explanation is the report. “Supports” on its own is worth nothing.
Sign and date it. A real name and a real date, or a reviewer cannot weigh it.

Budget about a week for a first one, most of it spent learning the criteria rather than testing. The second takes a day or two.

The three mistakes that get reports rejected

Fifty unexplained “Supports”. No product is perfect. A clean sheet reads as a template that was filled in rather than a product that was evaluated, and an experienced reviewer stops there.
Claiming a level you did not test. If the buyer’s own team disproves a Supports in five minutes with a keyboard, everything else in the document is now suspect. An honest Does Not Support costs you far less.
No date, or a date years old. The report describes the product on one day. Most buyers treat anything over about a year as stale.

When to stop and hire someone

Doing it yourself stops making sense at the point where you would be guessing:

Nobody here actually knows WCAG. Running a scanner is not knowing WCAG. If the honest answer is no, the report will contain guesses, and guesses in a signed document are the expensive kind of mistake.
The buyer weights independence. Federal and higher-education buyers read a self-assessment as a claim. If the deal is large enough that this matters, the cost of a third-party report is noise against it.
The deadline is inside a week and the learning curve does not fit in it.

If none of those apply, write your own. We would rather be the page that told you how than sell you something you did not need.

What a finished one looks likeA complete report on a real product, with its failures left in.
What it costs to have it doneSo you can weigh a week of your own time against the alternative.