Customs risk matrix: events, controls and evidence

A customs risk matrix is a record that connects foreign-trade processes to events, causes, consequences, controls, evidence and treatment decisions. Under Brazil’s AEO programme, it should demonstrate a living cycle: identify, analyse, evaluate, prioritize, treat and monitor events that may affect general and compliance criteria.

The matrix does not have to be a spreadsheet or follow a single formula. It must explain why a risk is a priority, who owns it, which controls work and what evidence supports that conclusion.

Which customs risks should be mapped?

Start with the processes and requirements applicable to the operation. For AEO-Compliance, Brazilian Customs highlights:

• goods description and tariff classification;
• preferential and non-preferential origin;
• foreign-exchange aspects;
• tax basis and customs valuation;
• immunities, tax benefits and suspensions;
• indirect operations;
• competence of the professionals involved;
• management of commercial records and information.

Map the interfaces as well. A classification error may originate in product master data, incomplete supplier information or a commercial change that did not reach the customs team. Risk rarely belongs to one department.

How should a customs risk event be written?

Avoid labels such as “HS code risk” or “import problem.” A useful description separates four elements:

Element	Question	Example
Process	Where does the risk arise?	product master data and tariff classification
Cause	What may trigger the failure?	incomplete or outdated technical specification
Event	What may occur?	incorrect tariff code in the declaration
Consequence	What may result?	incorrect duty, hold, penalty or rework

Complete formulation: because the technical specification is incomplete, goods may be assigned an incorrect tariff code, leading to incorrect duty, delays and exposure to penalties. This makes it easier to choose controls that address the cause and detect the event before filing.

How should risks be assessed and prioritized?

Define criteria before assigning scores. A simple method combines likelihood and impact, but each scale needs objective descriptions.

Criterion	What to consider
Likelihood	transaction frequency, previous events, complexity and changes
Impact	duties, penalties, disruption, customers, reputation and certification
Detectability	chance of finding the error before filing or release
Velocity	time between cause, event and consequence
Reach	products, sites, regimes, partners and periods affected

A score supports ordering but should not replace judgement. An infrequent event may require priority when it involves fraud, a legal violation or severe impact. Record the rationale and approval for the classification.

How should controls and evidence be connected?

A control reduces risk; evidence demonstrates that the control was performed and worked. An approved procedure guides work, but it does not prove implementation by itself.

Event	Control	Expected evidence	Effectiveness test
incorrect tariff code	technical review before master-data approval	opinion, approval and version history	sample items and discrepancies found
incorrect origin treatment	validation of origin documents	certificate, analysis record and approval	periodic review by agreement and supplier
incomplete customs value	reconciliation of adjustments and expenses	contract, invoice, calculation and review	comparison between transactions and accounting
benefit used outside its conditions	eligibility and balance checklist	authorization, approval and usage record	expiry and transaction review
incorrect party to the transaction	validation of the transaction model	contract, order, financial flow and decision	audit of indirect operations

Assess design and execution. A well-designed control can fail because of inadequate coverage, competence, segregation, frequency or exception handling.

What should the customs risk matrix record?

An auditable matrix should include at least:

1. process, step, site and related requirement;
2. risk event, cause and consequence;
3. inherent-risk criteria and assessment;
4. risk owner and participating functions;
5. existing controls, owners and frequency;
6. evidence and location of the original source;
7. control-effectiveness assessment;
8. treatment, deadline and approver;
9. residual risk and acceptance decision;
10. review date, indicators and reassessment triggers.

This chain creates traceability between requirement, decision and practice. It also supports evidence preparation for AEO certification.

How should residual risk be treated and reassessed?

Choose a response proportionate to priority: reduce, avoid, share or accept. For every action, record its owner, deadline, resources, expected result and effectiveness test.

Residual risk should only be reduced after the control has been implemented and tested. Approving a plan does not change exposure. Evidence should show that the cause is controlled, the event is detected earlier or the consequence has been reduced.

Bring the review forward when products, suppliers, countries, regimes, systems, laws, volumes or teams change; when an audit finds a deviation; or when customs history shows an infringement, inspection issue, amendment or recurrence.

How should the matrix be monitored in daily work?

Brazilian Customs identifies customs history, process and transaction audits, data analysis, sampling and compliance indicators as monitoring sources.

Practical indicators include:

• amendments by error type and process;
• discrepancies found before and after filing;
• high or critical risks without treatment;
• overdue or unperformed controls;
• late action plans;
• time since the last review;
• recurrence after corrective action;
• operations covered by audit or sampling.

Monitoring is more than changing a score. It verifies that procedures remain aligned with real operations and that customs-relevant information reaches declarations correctly.

How does Konvéz Quality support traceability?

In Konvéz Quality, each risk can record its process, step, cause, consequence, owner, likelihood, impact, controls and effectiveness. Teams can create treatments, attach evidence, link documents and follow residual risk on a timeline.

A classification issue, for example, may create a nonconformity, an action plan and reassessment of the related risk. Audits, documents and tasks remain connected to the same context, reducing parallel lists and lost history.

The system does not assess customs risk on the operator’s behalf and does not replace Brazil’s AEO System. It organizes the operating cycle and the evidence used to show that decisions were implemented. Also see AEO business partner management and the QMS for carriers and foreign-trade teams.

Official sources

• Brazilian Federal Revenue — AEO Implementation Guide, version 3
• Brazilian Federal Revenue — How to become an AEO
• Brazilian Federal Revenue — Risk management and customs valuation
• World Customs Organization — Customs Risk Management Compendium

A good matrix does not end with a risk colour. It shows the event, decision, evidence and what changed after treatment.

Updated on 15 September 2026. Always consult the current official rules and guidance.

Frequently asked questions

What is a customs risk matrix?

It is a structured record linking customs processes and requirements to risk events, causes, consequences, likelihood, impact, controls, owners, evidence and residual risk.

Which risks should be included in an AEO matrix?

Include events that may negatively affect applicable general and compliance criteria, such as tariff classification, origin, foreign-exchange aspects, customs value, tax benefits, indirect operations, records and professional competence.

Does Brazilian Customs require a specific risk formula?

Official materials emphasize a process that identifies, analyses, evaluates, prioritizes, treats and monitors events. The operator should define criteria suitable for its context and demonstrate how priorities were established.

What is the difference between a control and evidence?

A control is a measure used to prevent, detect or reduce risk. Evidence is the verifiable record showing that the measure was performed and produced the expected result.