AACP-02 guidelines for mutual provision of contract audits

What it is

AACP-02 is the NATO Allied Acquisition Publication that sets out how contract audit authorities in different NATO countries help each other audit costs on non-competitive, sole-source defence contracts. It exists because a NATO acquisition programme routinely runs through a contractor, or a chain of subcontractors, based in a different country from the one buying the equipment, and the purchasing government has no standing to audit accounts on foreign soil itself. The guidelines are "offered for use by countries and NATO organisations that do not have existing agreements on contract audit services with each other" and are promulgated to NATO nations under STANREC 4812, a Standardization Recommendation rather than a ratified obligation. The current edition is Edition C Version 1, promulgated July 2019; the document does not state what it superseded.

Who asks, who audits, and what gets audited

Two government roles carry the whole arrangement. The requesting authority is "the agency of a NATO country or a NATO organisation making the request for the provision of contract audit services"; the performing authority is "the agency of a NATO country providing contract audit services" in the country where the contractor operates. The contractor itself, defined broadly as "any commercial enterprise or government Organisation undertaking work under a contract or a prospective contract", is the subject of the audit rather than a party to the arrangement between the two governments.

Five kinds of audit are in scope, each with its own expected reporting time: costs already claimed as incurred on a contract (180 calendar days), cost estimates behind a tender or proposal (90 days), specific cost elements or price-variation indices (90 days), a financial assessment of a potential contractor (120 days), and claims on a terminated contract (90 days). Audits are not normally requested below a contract value of 1 million EUR, and only for non-competitive contracts already placed, or contracts the requesting authority has decided to place subject to what the audit finds.

Requesting, accepting and performing an audit

A request goes in writing, covering what Annex A lists: the company to be audited, the nature and scope of the audit, the deadline, a copy of the contract, and anything else that would help. Major programmes with several tiers of contractors, potentially spread across different countries, need the requesting authority to plan ahead for coordinating several national audit authorities and folding their results into the higher-tier audit in time. On receiving a request, the performing authority notifies its acceptance promptly in writing - with comments, proposed amendments or an estimated charge - or declines if the request would contravene its own domestic law.

The performing authority then audits under its own accounting standards, conventions and national law, "as if the audit were being carried out for its own Government" - not the requesting authority's rules. Reports are advisory only: the requesting authority stays responsible for negotiating and agreeing the actual price with the contractor, and is not meant to duplicate or second-guess the performing authority's work. Contract and cost data are treated as commercial in confidence, classified material follows whatever rules already govern it, and a report on a subcontractor's costs has to separate out what a higher-tier contractor may not see.

Where national practice pulls in different directions

The guidelines flag the friction points a procuring authority should check before it contracts with a foreign supplier, not after: whether the performing country even runs a national audit authority or has outsourced the function to a private firm; which cost categories - interest and finance costs, independent research and development, depreciation, public relations, entertainment - a country treats as unallowable; whether profit is open to audit comment at all; and what an audit report actually contains. The advice throughout is the same: agree the treatment of anything that varies with the contractor up front, rather than let it surface mid-audit.

A shared vocabulary backs all of this. The guidelines define commercial in confidence, contractor, higher-tier contractor, non-competitive defence contract, performing and requesting authority, and reciprocity - "the performing authority and the requesting authority have every expectation that ... there will be a balance in the number and effort expended on the audit requests received and made", which is a mutual-aid arrangement between government audit bodies rather than a fee-for-service one. An annexed lexicon adds a cost-accounting vocabulary - allowable cost, direct and indirect costs, general and administration costs, facilities capital cost of money and more - because terms like these do not mean the same thing in every country's regulation.

Charges, liability and what the guidelines do not settle

As a general principle, and subject to reciprocity, the two governments waive repayment charges for auditing each other, though national law may require a case-by-case charge applied equally to every requesting authority. Each side waives claims against the other for loss or damage arising from the audit, except wilful misconduct or gross negligence, and requests and reports are meant to be in an official NATO language unless agreed otherwise. What the guidelines do not do is create any right of audit access on their own: that has to already be written into the requesting authority's solicitation and contract documents before a request can be processed, and nothing here reaches the contractor as a direct obligation.