How to choose suppliers and partners

An illustrative scene. The keys are due to be handed over in three weeks, and the occupancy permit still has not been issued. The firm hired to deal with city hall calls with an offer: a cash "boost" to speed up the inspection. Nothing was authorized in writing. The expediter was chosen two years earlier because he was cheaper and answered the phone quickly.

If that payment is made, the bill does not stay with the expediter. Brazil's Clean Company Act holds companies strictly liable for wrongful acts committed in their interest or for their benefit, with fines ranging from 0.1% to 20% of gross revenue for the year before proceedings begin, net of taxes. Since July 2022, the decree that regulates it has listed "appropriate, risk-based due diligence" in hiring and supervising third parties, such as suppliers, expediters and consultants, among the criteria used to assess an integrity program.

The contract picks the partner. The law decides who pays when the partner fails. Partner due diligence brings those two decisions together before anyone signs. At the high end of the market, every firm that speaks to the buyer or to city hall becomes an extension of the brand, and the weakest delivery sets the ceiling of the whole experience.

A third party acts in your name, and the law treats the risk as yours

Article 2 of the Clean Company Act is brief: a legal entity is strictly liable for wrongful acts committed "in its interest or for its benefit, exclusive or not". Nobody has to prove that the board knew. It is enough that the act benefited the company, even if the money passed through the hands of an intermediary.

In real estate development, that bridge to the public sector is routine. Building permits, environmental licenses, design approvals and occupancy permits often go through outside firms. Article 57 of the decree acknowledges this by requiring procedures for dealings with the government "even when intermediated by third parties", naming licenses, authorizations and certificates. That is where vetting a third party stops being a formality and becomes a control.

There is an economic argument too: the same decree allows up to five percentage points to be subtracted from the fine's calculation base when a company proves it has and applies an integrity program. The maximum reduction, however, only applies if the program existed before the wrongful act. Diligence done after the scandal is worth little. Diligence documented before the contract is the kind that counts.

On site, the contractor's debts change address

Brazil's Outsourcing Law, reformed in 2017, allows any activity to be outsourced, including a company's core business. In return, it makes the hiring company secondarily liable for labor obligations arising while the service was provided. If the contractor stops paying the crew, the claim can land on whoever hired it.

The same law offers a filter that many selection processes overlook. It requires service providers to hold share capital compatible with their headcount, in brackets that run from R$ 10,000 for up to ten employees to R$ 250,000 for more than a hundred. Comparing the articles of association with the promised workforce takes minutes.

Two more instruments complete the labor screen. The social security funding law requires anyone hiring services that involve the assignment of labor to withhold 11% of the gross invoice and pay it on the provider's behalf. The Labor Code created the Labor Debt Clearance Certificate: free, electronic, valid for 180 days and covering every branch of the company. It does not prove good people management, but it flags unpaid labor judgments.

The gravest risk is reputational. The Ministry of Labor publishes a register of employers found to have subjected workers to conditions analogous to slavery. The version we consulted reports an update on September 28, 2026 and holds about 580 entries. By our count, more than 40 of them carry construction activity codes, divisions 41 to 43 of the national classification. The sector is not off the map.

117

The first screen is public and nearly free

In 2024, Brazil's Office of the Comptroller General (CGU) published the second volume of its integrity guidelines for private companies. In its section on third parties, the guide points to public databases for the first check: the register of disreputable and suspended companies (CEIS), the register of punished companies (CNEP), the register of barred non-profits (CEPIM) and the CGU's own certificate system.

Each database answers a different question. According to the Transparency Portal, CEIS lists companies and individuals under sanctions that bar them from public tenders or government contracts. CNEP publishes penalties imposed under the Clean Company Act. The guide also recommends looking at human rights and environmental harm, and it sums up the rule: the higher the business risk, the deeper the diligence should go.

Staying off these lists is a floor, not proof of excellence. The check removes those already punished, but says nothing about technical capacity, financial health or culture. The CGU also suggests looking for positive signals, such as the partner's own integrity program or a place in the Pró-Ética listing.

Score the criteria before opening the bids

The weak point of traditional selection is not a lack of information. It is the way decisions are made. When the choice rests on the impression of whoever ran the meeting, the result cannot be repeated or defended before a board.

Multi-criteria scoring separates what disqualifies from what ranks. The disqualifying gates are objective: an active sanction, a listing in the slave labor register, an unpaid labor debt, capital out of line with headcount, refusal to sign the code of conduct. Whoever fails a gate is not scored. Ranking criteria carry weights fixed before the bids are opened: technical capacity, financial health, reputation, compliance, scale, and past projects checked on site rather than in a brochure.

The CGU guide asks companies to define each partner's integrity risk profile once the checks are done. We work with three tiers: low risk, with standard diligence; medium, with expanded document review; high, with a site visit, analysis of financial statements and an interview with the partner's leadership.

Diligence is not distrust of the partner. It is the proof, written before the signature, that the choice was deliberate.

A five-year warranty is worth what the warrantor owns

Article 618 of the Civil Code makes a building contractor who supplies materials and labor answerable for the soundness and safety of the work for five years. The contract cannot shorten that period, and it covers both materials and soil. The owner has 180 days from the appearance of the defect to file suit.

Price-based selection misses the consequence: a legal warranty is only as good as the balance sheet behind it. A contractor with no backing that closes two years after handover leaves a paper guarantee. That is why financial health and longevity carry their own weight in the score. Performance bonds and retentions are sized to the measured risk, not to a generic standard.

Whoever touches the client inherits data and anti-money-laundering duties

Partners who serve buyers, run portals or manage registries process personal data for the project. Brazil's General Data Protection Law requires the processor to follow the controller's instructions, and Article 42 makes it jointly liable for damages when it breaches the law or those instructions. To the injured data subject, the brand on display is the project's. Gauging the data protection maturity of whoever receives the client base is part of selection, not a legal annex.

The Anti-Money Laundering Law lists real estate developers and anyone who buys and sells property among those required to identify clients, keep records current, adopt controls suited to their size and report transactions to COAF, Brazil's financial intelligence unit. When part of the commercial curation runs through third parties, their ability to follow that routine must be verified in advance, not assumed. That is why diligence cannot sit entirely with procurement: each partner's file, kept on the Platform, needs legal, financial and technical eyes.

Diligence continues after the signature

The CGU guide recommends constant supervision, repeating the checks according to the contract term and the partner's risk profile. It also lists red flags during execution: payment in cash or into third-party accounts, commissions well above the going rate, advance payments without reasonable grounds, excessive discounts, vague service descriptions, a politically exposed person in a key role at the partner, and damaging news reports. The opening scene packs two of them into one phone call.

For monitoring to bite, the contract has to provide the tools. The CGU suggests clauses allowing sanctions, including termination, and indemnity if the hiring company is held liable for the contractor's acts. We add audit rights, certificates at every progress measurement and verifiable service levels.

Within the group, C&S Engenharia runs construction with its own technical staff and curated suppliers, while Valida Auditoria provides independent audits for the group and for outside clients. The split confirms a rule worth applying to any project: whoever chooses the partner should not be the one who checks it.

Numerical example: the price of diligence against the price of a breakdown

The figures below are hypotheses that illustrate the reasoning, not market data. Consider a concrete structure package for a high-end residential project.

The most useful line is the break-even point: diligence pays for itself if it cuts the probability of a breakdown by just over two percentage points (R$ 36,000 divided by R$ 1,740,000).

Now the stress test. If the cost of a breakdown falls by half, to R$ 870,000, the expected gain shrinks to R$ 33,600. If diligence only lowers the risk from 12% to 9%, the gain drops to R$ 16,200. On a package ten times smaller, assuming proportional breakdown costs, the avoided loss would be R$ 13,920, which would not cover a R$ 36,000 review. The conclusion matches the decree: the depth of diligence should follow the risk.

When it does not pay off

In some situations, in-depth diligence is not worth the same intensity.

• Low-value, easily replaced purchases. Catalog materials or one-off services that can be swapped in days need only the public screen. A full review would cost more than the possible loss.
• A supplier with no real alternative. Public utilities or exclusive holders of a technology will not be replaced because of a score. The effort goes into clauses and a contingency plan.
• A partner vetted recently, with no change in scope. Renewing an identical contract with someone who passed a full review a few months ago calls only for updated certificates and a fresh look at red flags.

Checklist for structuring partner due diligence

1. Classify each contract by risk (value, term, contact with government, access to personal data) before requesting quotes.
2. Check CEIS, CNEP, CEPIM and the Ministry of Labor register for the company and its partners, and file the dated result.
3. Require the Labor Debt Clearance Certificate and compare share capital with declared headcount.
4. Define the disqualifying gates and ranking weights before receiving bids, and record the matrix on the Platform.
5. Visit past projects and talk to the clients the partner names.
6. Include in the contract a code of conduct, audit rights, certificates at every measurement, termination for breach and indemnity for liability.
7. Schedule periodic reviews and independent audits of the highest-risk partners, in line with the contract term.

Frequently asked questions

Is third-party due diligence required by law?

There is no general duty to vet every supplier. The decree treats it as a criterion of the integrity program, which weighs in setting penalties under the Clean Company Act. Without it, the company's defense is weaker.

Are clearance certificates enough?

No. They remove those with a recorded sanction or debt, but they do not measure technical capacity, financial health or culture. They are the first screen, not the process.

How long should diligence take?

It depends on the risk. A public check takes hours; reviewing a high-risk partner can take weeks. The costliest mistake is applying the same routine to everything.

How often should the review be repeated?

The CGU recommends repeating the checks according to the contract term and the risk profile. The 180-day validity of the labor certificate suggests a minimum cycle.

Who should run the diligence?

A team that combines procurement, legal, engineering and control, with the decision on record. Periodic audits should go to people who took no part in hiring.

Legal basis

• Law No. 12,846/2013 (Clean Company Act): arts. 2, 5, 6, 7 and 22.
• Decree No. 11,129/2022: arts. 23 and 57, items VIII and XIII.
• Law No. 6,019/1974 (outsourcing): arts. 4-B and 5-A, paragraph 5.
• Law No. 8,212/1991: art. 31.
• Labor Code (CLT): art. 642-A.
• Civil Code: art. 618 and sole paragraph.
• Law No. 13,709/2018 (LGPD): arts. 39 and 42.
• Law No. 9,613/1998: art. 9, sole paragraph, item X, and arts. 10 and 11.