GRCLibrary.ai

Procedure

UK AEO IT Self-Assessment Procedure

This procedure defines the process for completing the IT and cybersecurity elements of the organization's annual Authorized Economic Operator (AEO) and AEO-S (Authorized Economic Operator Security and Safety) self-assessment. Its held basis is section 12.2 of the HMRC Customs Technical Handbook (AEO), on monitoring, which says that HMRC will review AEO status periodically, that regular monitoring is the primary responsibility of the business, and that it is recommended that the business continue to self-assess its compliance with the conditions of the authorization. The annual cycle and its internal submission deadline are the organization's own schedule for that recommended, continuing self-assessment: no held section names a self-assessment submission to HMRC or an annual cycle. The held HMRC security and safety criteria (UK HMRC AEO security and safety criteria handbook, section 11) say that procedures are to be documented and made available for HMRC during the audit of the AEO criteria (section 11.1), and the only self-assessment they name is the one in section 11.2, on the security and safety risk assessment.

Type
Procedure
Version
1.0.6
Date
2026-11-07
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance: Logistics Sector
Review frequency
Annual and upon material regulatory or framework change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose and scope
  • 2. Governance
  • 3. Self-assessment trigger and timeline
  • 4. IT control evidence collection
  • 5. IT evidence package assembly
  • 6. Internal review
  • 7. Handoff to AEO compliance function
  • 8. After internal submission: retention of IT evidence package
  • 9. HMRC audit response
  • 10. Related documents and framework alignment

Frameworks it maps to

Related documents