Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AACP-02
A national contract audit authority, or a NATO acquirer, arranging a cross-border cost audit on a non-competitive defence contract
AACP-02 sets out how NATO nations' contract audit authorities request and provide each other cost audits of non-competitive defence contracts, and how to handle national differences in audit practice, cost allowability and profit calculation.
AACP-02 is the NATO Allied Acquisition Publication that sets out how contract audit authorities in different NATO countries help each other audit costs on non-competitive, sole-source defence contracts. It exists because a NATO acquisition programme routinely runs through a contractor, or a chain of subcontractors, based in a different country from the one buying the equipment, and the purchasing government has no standing to audit accounts on foreign soil itself. The guidelines are "offered for use by countries and NATO organisations that do not have existing agreements on contract audit services with each other" and are promulgated to NATO nations under STANREC 4812, a Standardization Recommendation rather than a ratified obligation. The current edition is Edition C Version 1, promulgated July 2019; the document does not state what it superseded.
Two government roles carry the whole arrangement. The requesting authority is "the agency of a NATO country or a NATO organisation making the request for the provision of contract audit services"; the performing authority is "the agency of a NATO country providing contract audit services" in the country where the contractor operates. The contractor itself, defined broadly as "any commercial enterprise or government Organisation undertaking work under a contract or a prospective contract", is the subject of the audit rather than a party to the arrangement between the two governments.
Five kinds of audit are in scope, each with its own expected reporting time: costs already claimed as incurred on a contract (180 calendar days), cost estimates behind a tender or proposal (90 days), specific cost elements or price-variation indices (90 days), a financial assessment of a potential contractor (120 days), and claims on a terminated contract (90 days). Audits are not normally requested below a contract value of 1 million EUR, and only for non-competitive contracts already placed, or contracts the requesting authority has decided to place subject to what the audit finds.
A request goes in writing, covering what Annex A lists: the company to be audited, the nature and scope of the audit, the deadline, a copy of the contract, and anything else that would help. Major programmes with several tiers of contractors, potentially spread across different countries, need the requesting authority to plan ahead for coordinating several national audit authorities and folding their results into the higher-tier audit in time. On receiving a request, the performing authority notifies its acceptance promptly in writing - with comments, proposed amendments or an estimated charge - or declines if the request would contravene its own domestic law.
The performing authority then audits under its own accounting standards, conventions and national law, "as if the audit were being carried out for its own Government" - not the requesting authority's rules. Reports are advisory only: the requesting authority stays responsible for negotiating and agreeing the actual price with the contractor, and is not meant to duplicate or second-guess the performing authority's work. Contract and cost data are treated as commercial in confidence, classified material follows whatever rules already govern it, and a report on a subcontractor's costs has to separate out what a higher-tier contractor may not see.
The guidelines flag the friction points a procuring authority should check before it contracts with a foreign supplier, not after: whether the performing country even runs a national audit authority or has outsourced the function to a private firm; which cost categories - interest and finance costs, independent research and development, depreciation, public relations, entertainment - a country treats as unallowable; whether profit is open to audit comment at all; and what an audit report actually contains. The advice throughout is the same: agree the treatment of anything that varies with the contractor up front, rather than let it surface mid-audit.
A shared vocabulary backs all of this. The guidelines define commercial in confidence, contractor, higher-tier contractor, non-competitive defence contract, performing and requesting authority, and reciprocity - "the performing authority and the requesting authority have every expectation that ... there will be a balance in the number and effort expended on the audit requests received and made", which is a mutual-aid arrangement between government audit bodies rather than a fee-for-service one. An annexed lexicon adds a cost-accounting vocabulary - allowable cost, direct and indirect costs, general and administration costs, facilities capital cost of money and more - because terms like these do not mean the same thing in every country's regulation.
As a general principle, and subject to reciprocity, the two governments waive repayment charges for auditing each other, though national law may require a case-by-case charge applied equally to every requesting authority. Each side waives claims against the other for loss or damage arising from the audit, except wilful misconduct or gross negligence, and requests and reports are meant to be in an official NATO language unless agreed otherwise. What the guidelines do not do is create any right of audit access on their own: that has to already be written into the requesting authority's solicitation and contract documents before a request can be processed, and nothing here reaches the contractor as a direct obligation.
AACP-02 describes an arrangement between two governments, not something a supplier implements as a management system, and ComplyTrain has no part in the audit itself - that stays between the requesting and performing authorities. What the guidelines do put on a contractor is a readiness expectation: their own reporting-time estimates assume the supplier under audit is "generally responsive to the performing government's inquiries within one to two weeks", which only works if the underlying cost records - direct and indirect costs, and the treatment of items like independent R&D or depreciation - are already organised rather than assembled once a request lands. That is the kind of evidence discipline ComplyTrain supports generally: a controlled place to hold pricing and contract-administration procedures, cost documentation and training records, so a cross-border audit request can be answered promptly.
What ComplyTrain does not do: it does not conduct the audit, act as either the requesting or performing authority, or decide what costs are allowable or how profit should be treated - those stay matters of national regulation and of what the procuring authority and contractor agree between themselves.
Which audit obligations actually attach to a given defence contract is set by the contract and the customer's quality clause, not by us. See what else sits alongside AACP-02 in the standards explorer, and talk to us about the evidence trail behind a cost or contract audit.
Tell us how you need to work with AACP-02 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
No. AACP-02 is a set of guidelines, offered for countries and NATO organisations that do not already have their own audit-assistance arrangements, and covered by STANREC 4812, a recommendation rather than a ratified obligation. It governs what happens between two governments, not a duty that reaches a contractor directly.
No. The audit report is advisory only. The requesting authority, the government that asked for the audit, stays responsible for negotiating and agreeing the actual price with the contractor itself.
Non-competitive (sole-source) defence contracts, generally valued above 1 million EUR, that are either already placed in the performing authority's country or that the requesting authority has decided to place subject to what the audit finds.
As a general principle, and subject to reciprocity, the two governments waive charges for auditing each other's contractors. A performing authority may still levy a charge case by case if its own national law requires it, applied on the same basis to every requesting authority.
The request cannot be processed. The guidelines treat the right of audit access as something that has to be in place in the original solicitation and contract documents before an audit request is made, not something added afterwards.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.