AEO business partner management: selection, risk and monitoring

AEO business partner management is the process of selecting, verifying, contracting and monitoring companies that may affect international supply-chain security. Controls should be proportionate to risk: the greater a partner’s access to cargo, sensitive information or critical operations, the deeper the assessment should be.

Brazil’s AEO programme expects more than an approved-supplier list. The operator should show that it knows the participants in its supply chains, validated information before contracting, assigned responsibilities and continues to verify control effectiveness.

Which partners should be included?

Version 3 of Brazil’s AEO Implementation Guide, dated April 2026, includes partners that handle cargo or foreign-trade information:

• manufacturers and product suppliers;
• carriers, freight forwarders and logistics operators;
• customs brokers, warehouses and terminals;
• security, technology and maintenance providers;
• third parties that handle sensitive information, equipment or access.

Map partners by operation, route or flow. A company may be low-impact in one process and critical in another, so classification should reflect its actual role.

How should partner risk be classified?

Factor	Assessment question	Higher-risk signal
Cargo	Does it handle, store, seal or transport goods?	direct unsupervised access
Information	Can it access documents, systems or routes?	broad or privileged access
Location	Are exposed origins or routes involved?	change of origin or increased threat
Outsourcing	Are critical stages transferred?	opaque outsourced chain
Dependency	Can the partner be replaced without disruption?	weak contingency
History	Are there incidents, sanctions or recurrence?	inadequate response
Certification	Does it hold valid AEO or recognized status?	limited alternative evidence

The resulting low, medium, high or critical rating should determine checks, approvers, monitoring frequency and reassessment triggers.

How to select AEO business partners

1. Formalize the procedure

Define scope, responsibilities, criteria, records and decision rules. Explain how current partners will be monitored and exceptions authorized. Use role-specific controls: carriers and IT providers do not create the same exposure.

2. Perform due diligence before contracting

Brazil’s Guide suggests checking business address and operating history, reliable public sources, directors, commercial references and financial information. The extent depends on risk.

For non-certified partners, obtain evidence of security measures compatible with their role. This may involve self-assessment questionnaires, documents, interviews, visits or a supplier audit. Record sources, dates, risks, controls, gaps, approver and decision validity.

3. Consider AEO status

The Guide requires consideration of certification in Brazil or under a programme recognized through a Mutual Recognition Arrangement signed by Brazil. Certification should be evidenced and remain valid. It is relevant evidence, but does not remove monitoring.

4. Put controls into the contract

Requirement 13.5 provides for relevant obligations to be included in agreements when the business model allows. Clauses may address cargo and data protection, incident reporting, subcontracting, documents, access to evidence, correction deadlines and termination in response to unacceptable risk.

How should partners be monitored?

Partner	Monitoring examples
Carrier	violations, damage, seals, routes and incidents
Freight forwarder	document quality and subcontractors
Warehouse	access, inventory, inspections and incidents
Customs broker	discrepancies, corrections and deadlines
Technology	access, availability, backup and continuity

Also track document expiry, AEO status, audit findings, complaints, action plans and operational changes. The Guide recommends annual security assessment updates or more frequent reviews based on risk.

What should trigger an early reassessment?

• a security incident or cargo violation;
• changes in origin, route, facility or scope;
• a new critical subcontractor;
• loss or change of certification;
• unusual operating behaviour;
• recurring failure or increased threat;
• evidence that a control no longer works.

Record containment, cause, owner, deadline and effectiveness. The workflow can follow nonconformity management and 5W2H action plans.

What evidence demonstrates compliance?

1. partner map by chain and role;
2. risk rating and rationale;
3. selection and monitoring procedure;
4. due-diligence records;
5. certification evidence;
6. questionnaires, audits or security assessments;
7. contracts and applicable clauses;
8. indicators, incidents and changes;
9. reassessments and updated decisions;
10. corrective actions and effectiveness checks.

How Konvéz Quality supports the process

Konvéz Quality connects suppliers, documents, assessments, risks, audits, occurrences and actions. An operator can classify a partner, apply category-specific questions, control evidence and schedule the next review in the same history.

The system does not replace the analysis required by Brazil’s AEO programme; it organizes execution and evidence. See our guides to Brazilian AEO certification and QMS for foreign trade.

Official sources

• Federal Revenue Service of Brazil — AEO Implementation Guide, version 3, April 2026
• Federal Revenue Service of Brazil — How to become an AEO
• World Customs Organization — AEO

Managing AEO partners means maintaining a known, risk-based supply chain that can respond to change. Start with one critical chain and verify that every partner has a recorded risk, evidence owner and reassessment date.

Updated on 14 September 2026. Always consult current official programme materials.

Frequently asked questions

Who is considered a business partner under Brazil's AEO programme?

Partners include companies involved in the supply chain or handling cargo, information, equipment and sensitive services, such as suppliers, carriers, freight forwarders, customs brokers, warehouses and technology providers.

Does every partner need AEO certification?

No. For non-certified partners, the operator should perform due diligence and obtain evidence of controls proportionate to the risk and role involved.

How often should partners be reassessed?

Version 3 of Brazil's AEO Guide recommends annual security assessment updates, or more frequently when risk or circumstances require it.

What should be monitored after contracting?

Certification status, documents, indicators, incidents, operational changes, security clauses and corrective-action effectiveness.