Provision of external audit services

The European Union Agency for Cybersecurity (ENISA) intends to award a single framework service contract (procedure ENISA/2026/MVP/0023-EXA) for external audit services to provide opinions on the reliability of its provisional and final annual accounts for financial years 2026–2029. The contract duration is up to 48 months and audits must comply with International Standards on Auditing (ISA) and International Standards of Supreme Audit Institutions (ISSAI). The procurement is published as a planned negotiated procedure for a middle/low value contract and the estimated total value is not disclosed. Expressions of interest must be submitted electronically via the EU Funding & Tenders Portal using an EU Login account between 18/09/2026 and 30/09/2026 23:59 Europe/Athens with the negotiated procedure indicative launch on 02/10/2026.

Opportunity summary

Essential facts

ENISA intends to award a single framework service contract (planned negotiated low/middle value procedure) for external audit services covering ENISA's provisional and final annual accounts for the financial years 2026, 2027, 2028 and 2029. Audits must comply with ISA and ISSAI standards. ¹

Who can apply:Qualified service providers / audit firms able to deliver statutory-style audits in line with ISA and ISSAI; electronic submission via EU Login is required.

1. 1Contracting authority: European Union Agency for Cybersecurity (ENISA).
2. 2Procedure: planned negotiated procedure for low/middle value contract; framework agreement without reopening.
3. 3Maximum duration: 48 months; covers audits for 2026–2029.

No estimated total value is published in the notice. SMEs suitability indicator:false. Further procurement documents and formal call will be published on the EU Funding & Tenders Portal Tender page. ¹

Footnotes

1. 1Tender notice and future tender documents available at the EU Funding & Tenders Portal: ec.europa.eu

Opportunity summary

The European Union Agency for Cybersecurity (ENISA) intends to award a single framework service contract (framework agreement without reopening of competition) for up to 48 months to a service provider to deliver external audit services. The contract covers issuing an opinion on the reliability of ENISA's provisional and final annual accounts for four financial years: 2026, 2027, 2028 and 2029. Audits must be performed in compliance with International Standards on Auditing (ISA) and International Standards of Supreme Audit Institutions (ISSAI). The procurement is published as a planned negotiated procedure for middle/low value contract and is listed on the EU Funding & Tenders Portal. EU Login account is required to submit an expression of interest EU Funding & Tenders Portal ¹.

Lead contracting authority:European Union Agency for Cybersecurity (ENISA) (lead contracting authority).

Main procurement classification (CPV):79210000 - Accounting and auditing services.

Key facts and administrative data

1. 1Procedure identifier: ENISA/2026/MVP/0023-EXA
2. 2Procedure type: Planned negotiated procedure for middle/low value contract
3. 3Contract nature: services; framework agreement, without reopening of competition
4. 4Maximum contract duration: 48 months
5. 5Scope of work: external audit services including opinion on provisional and final annual accounts for 2026–2029; audits must comply with ISA and ISSAI standards
6. 6Main CPV: 79210000 - Accounting and auditing services
7. 7Submission method for expression of interest: Electronic via EU Login on the Funding & Tenders Portal
8. 8SME suitable indicator: false (procurement not specifically targeted to SMEs)

Structured categorisation and requirements

Eligible Applicant Types:Professional audit and accounting service providers; external audit firms; large audit networks; independent auditors; accounting practices; legal entities able to demonstrate competence and capacity to perform external audits under ISA and ISSAI standards. Universities and research institutes are not the targeted provider type unless they operate an eligible audit service entity. Public bodies or national supreme audit institutions could theoretically bid if legally permitted and qualified; consortiums are not indicated as required in the notice (single provider framework). The procurement is not specifically limited to SMEs; the SME suitable indicator is false.

Funding Type:Procurement / service contract (tender). This is not a grant, loan, or equity instrument. It is a paid services contract awarded through public procurement.

Consortium Requirement:Single framework service provider required. The notice describes awarding a single framework contract to one service provider. No requirement for multiple-applicant consortia is stated; however bidders could present consortium arrangements only if allowed under the contracting rules and if the bidder demonstrates required capacity and qualifications.

Beneficiary Scope (Geographic Eligibility):The contracting authority is an EU agency (ENISA). The notice is published on the EU Funding & Tenders Portal and requires EU Login. Implicit geographic eligibility is EU/EEA participants and legal entities able to contract with EU institutions; the notice does not explicitly limit bidders to Member States only. The timeline references Europe/Brussels and Europe/Athens timezones. Applicants should assume EU-wide eligibility unless the formal tender documents specify further nationality or establishment rules.

Target Sector:Accounting and auditing services; public sector financial audit; public sector financial assurance. Sector context: cybersecurity agency client, but the work is financial audit rather than an ICT or cybersecurity technical project.

Mentioned Countries:No specific countries named as bidders. The publication context identifies EU and Europe timezones (Europe/Brussels, Europe/Athens). Lead authority is ENISA, an EU agency. Therefore the relevant region is the European Union (EU).

Project Stage (expected maturity):Operational delivery stage: ready for procurement of professional service delivery. The activity requires mature, fully operational audit capability and demonstrated experience in statutory and/or external audits in accordance with ISA and ISSAI standards.

Funding Amount:Estimated total value: not specified in the published notice. The procurement is described as middle/low value (planned negotiated procedure for middle/low value contract). No monetary ceiling or budget figure is provided in the scraped content.

Application Type:Planned negotiated procedure: initial public publication announcing the contracting authority's intention to launch a future negotiated low or middle value procedure. The immediate step is an open expression of interest submitted electronically via the Funding & Tenders Portal using EU Login. Following the expression of interest period, the authority will launch the negotiated procedure (indicative date provided).

Nature of Support:Monetary payment in exchange for services under a procurement contract. The successful bidder will be paid under the contractual terms for providing audit services. The opportunity does not offer non-monetary services as the main support; it is a paid contract.

Application Stages:Two main stages are indicated: (1) Expression of interest (electronic submission via EU Login during the specified period); (2) Launch and conduct of the negotiated procedure (selection and award). Further internal selection or evaluation phases will occur during the negotiated procedure as defined in the forthcoming tender documents.

Success Rates:Not indicated. As a single-award negotiated procedure for a middle/low value contract, success rates cannot be determined from the notice. Competition level depends on number of expressions of interest and participants in the negotiated procedure.

Co-funding Requirement:No co-funding is required. This is a procurement of services; the contractor will be remunerated under the contract. The notice contains no requirement for financial contribution or co-financing from bidders.

Application and documentation — practical details

How to express interest and next steps:Interested bidders must submit an electronic expression of interest via the Funding & Tenders Portal. An EU Login account is required. The published milestones set the expression of interest window: start 18/09/2026 (Europe/Brussels) and deadline 30/09/2026 23:59 (Europe/Athens). The negotiated procedure is indicated for launch on 02/10/2026 (Europe/Athens). The notice explicitly states this publication is an announcement of intent and not the final call for tenders. Full procurement documents, technical specifications, evaluation criteria, selection and award sub-criteria, contract terms and estimated budget will be made available at the planned launch of the negotiated procedure.

• Submission channel: Funding & Tenders Portal (electronic) using EU Login
• Required standards: audits must comply with ISA and ISSAI
• Scope: opinions on provisional and final annual accounts for 2026–2029
• Contract form: single framework agreement, up to 48 months
• CPV classification: 79210000

Templates and application form structure (what to prepare)

The published notice does not include full tender documents or application templates. Typical procurement documentation for an external audit services tender from an EU agency will include: request to participate or expression of interest form (electronic), standard forms for legal and financial identification, declaration on exclusion and selection criteria (eligibility, capacity and financial/technical solvency), a technical offer template (methodology, team composition, quality assurance, compliance with ISA/ISSAI), and a financial offer template (rates, estimated fees, timesheets, potential travel and subsistence). Bidders should prepare the following documents in advance in electronic format for upload to the portal once the negotiated procedure is launched:

1. 1Company legal registration documents and proof of establishment
2. 2Professional and statutory auditor registration or certificates demonstrating eligibility to issue audit opinions under ISA/ISSAI
3. 3List of references and past experience in auditing public sector entities or EU institutions, including scope and dates
4. 4Curricula Vitae of key audit team members showing professional qualifications (e.g., certified public accountants), years of experience, and roles in comparable audits
5. 5Quality assurance and audit methodology statement referencing ISA and ISSAI compliance and approach to audit planning, risk assessment, sampling and reporting
6. 6Organisational capacity statement (staffing plan, back-up arrangements, confidentiality and independence safeguards)
7. 7Financial offer covering fees, rates, and invoicing modalities
8. 8Declarations on conflicts of interest, independence and compliance with procurement rules
9. 9Completed standard portal forms for exclusion and selection criteria when provided

Evaluation and contractual aspects (anticipated)

The notice does not publish evaluation criteria or weightings. As a procurement for external audit services for an EU agency, evaluation typically combines compliance checks (eligibility, absence of exclusion grounds), selection criteria (economic and financial capacity, professional and technical capacity, relevant experience) and award criteria (quality of technical proposal, methodology, team qualifications and price). Independence and ability to comply with ISA and ISSAI will be critical. The final contract will be a framework agreement enabling ENISA to call off audit engagements for the specified financial years under the agreed terms. Renewal or extension terms are not indicated beyond the 48-month framework duration.

Risks, clarifications and recommendations for bidders

Key risks and practical recommendations:ensure professional independence from ENISA, prepare evidence of compliance with ISA and ISSAI, compile strong public-sector or EU audit references, prepare signed declarations and up-to-date professional registrations, and ensure timely EU Login setup and portal readiness before the expression of interest window. Monitor the Funding & Tenders Portal for the publication of the negotiated procedure documents and any Q&A that may clarify tender requirements.

ENISA has published a Q&A function on the portal but no public Q&A items were present in the scraped content at the time of publication. Bidders should use the portal Q&A to seek clarifications once the negotiated procedure is launched.

Concluding summary

This procurement notice announces ENISA's intent to procure external audit services through a planned negotiated procedure for a middle/low value contract. ENISA will award a single framework agreement for up to 48 months to a qualified audit firm to perform audits and deliver opinions on ENISA's provisional and final annual accounts for financial years 2026 to 2029, in accordance with ISA and ISSAI standards. Interested and qualified auditing firms should prepare to submit an electronic expression of interest via the EU Funding & Tenders Portal during the stated window (18/09/2026 to 30/09/2026) and must hold an EU Login account. Detailed tender documents, including specific selection and award criteria, contractual terms and possible estimated budget, will be published when the negotiated procedure is launched (indicative date 02/10/2026).

Footnotes

1. 1Funding & Tenders Portal opportunity page: ec.europa.eu

This is a planned negotiated procedure for a middle or low value service contract issued by the European Union Agency for Cybersecurity, ENISA. It seeks a single framework contractor to provide external audit services and to issue an opinion on the reliability of ENISA's provisional and final annual accounts for financial years 2026, 2027, 2028 and 2029, with the audit performed in line with ISA and ISSAI standards ¹.

Opportunity at a glance

What the contract covers

The service provider will be expected to deliver external audit services for ENISA, specifically the audit opinion on the reliability of the agency's annual accounts across four consecutive financial years. The notice indicates a maximum contract duration of 48 months, which aligns with the 2026 to 2029 audit cycle.

Who can apply

The published notice is an expression of interest stage and does not yet set out detailed exclusion criteria, minimum turnover thresholds, consortium rules, or professional registration requirements. In practical terms, applicants should be capable of delivering public sector external audit services and of working to ISA and ISSAI standards. Interested parties must submit electronically and need an EU Login account to do so.

Key procedural points for applicants

1. 1This notice is not yet the call for tenders, but a publication of ENISA's intention to launch a future negotiated procedure.
2. 2Expression of interest opens on 18 September 2026.
3. 3Expression of interest closes on 30 September 2026 at 23:59 Athens time.
4. 4The indicative launch date for the negotiated procedure is 2 October 2026.
5. 5Submission is electronic and must be made through the address for expression of interest provided in the portal.
6. 6The framework agreement is described as being without reopening of competition.
7. 7The public notice does not disclose the estimated contract value.

Applicant takeaways

The opportunity is relevant to audit firms and other service providers with demonstrated capability in external audit, public sector account auditing, and compliance with international audit and supreme audit institution standards. Because the notice is only a planned procurement announcement, applicants should monitor the portal closely for the actual negotiated procedure documents, technical specifications, award criteria, and any minimum eligibility evidence once the invitation is launched.

Footnotes

1. 1Official portal notice: Provision of external audit services.