Designing a Vendor Risk Monitor for Brazilian Public Spending
Public information about Brazilian government vendors exists across several systems. A company may appear in procurement notices, signed contracts, federal payments, sanctions, and agreements. Each source answers a useful question, but investigating one vendor still requires moving between systems, reconciling identifiers, and deciding which changes deserve attention.
I designed GovVendor Radar as a product prototype for that workflow. It uses the CNPJ, Brazil's company-registration identifier, to organize signals into one company profile. The goal is not to replace an official source or make a compliance decision automatically. It is to help an analyst find the relevant records, understand what changed, and know where to investigate next.
Explore the GovVendor Radar prototype.
Start with the investigation, not the dashboard
Vendor monitoring usually begins with a practical question: has anything changed that requires review? A new contract, an unusual increase in payments, or a sanctions record may be important. A static company profile is less useful if it cannot show when the underlying evidence changed.
I organized the prototype around that sequence. Search establishes the company. The profile summarizes its current signals. Recent changes direct attention to new activity. Source coverage explains which systems were checked. The interface moves from discovery to interpretation without hiding the records behind a single score.
Use the CNPJ as the organizing key
Company names are inconsistent. Legal names, trade names, abbreviations, punctuation, and spelling mistakes can all create duplicate or incomplete results. The CNPJ provides a more stable key for joining records after the correct company has been identified.
The search experience therefore supports CNPJ, legal name, trade name, partial text, and misspellings. Results can be filtered by state, signal type, risk category, and source capability. They can also be sorted by relevance, risk, name, or contract count. This separates the human task of finding the right entity from the data task of aggregating its records.
Combine signals without flattening their meaning
Contracts, payments, sanctions, and agreements are related, but they are not interchangeable. A contract describes an obligation. A payment records a financial event. A sanctions entry may require close attention to its status and effective dates. An agreement can have a different legal meaning again.
GovVendor Radar gives each signal its own category while presenting a shared snapshot. The risk score supports prioritization, but the surrounding labels and counts preserve the evidence behind it. A user should be able to ask why a vendor was marked for monitoring and trace that judgment back to specific records.
Show what the system knows and what it checked
Missing data and negative results are not the same. If the interface shows no sanctions, the user needs to know whether a sanctions source returned a clean result, could not be reached, required a token, or was never checked. Without that distinction, a clean-looking profile can create false confidence.
The source-coverage panel makes this operational state visible. The prototype identifies capabilities associated with a local CNPJ index, BrasilAPI, the Portal Nacional de Contratações Públicas, the Portal da Transparência, and dados.gov.br. Coverage filters describe the available source checks; they do not silently remove companies from the result list.
- BrasilAPI supports standardized access to Brazilian public information.
- PNCP publishes procurement and contracting records under Brazil's public procurement framework.
- Portal da Transparência provides federal spending, contracts, agreements, and integrity data.
- dados.gov.br is Brazil's central catalog for open government datasets.
Use AI to summarize evidence, not replace it
The company profile includes an AI summary organized around three questions: why the vendor matters, which agencies paid it, and what changed during the latest period. This is intentionally narrower than an open-ended compliance judgment.
The summary should help a reader orient themselves before inspecting the underlying records. It should not assign guilt, predict misconduct, or turn incomplete public data into a definitive conclusion. Keeping the source signals beside the summary makes the interpretation reviewable.
Design for two languages and different levels of detail
The interface is available in English and Portuguese. This affected more than translation. Labels need to match Brazilian administrative concepts while remaining understandable to users who are less familiar with them. CNPJ, sanctions programs, contracting records, and public-data sources cannot be reduced to generic software terminology without losing meaning.
The search page also offers detailed and compact views with selectable fields. An analyst reviewing a small result set may want signal counts and recent changes visible. Someone scanning many companies may prefer a denser table. The product keeps those needs in the same workflow instead of assuming one fixed information density.
A risk score should open a question
Scores are efficient, but they can also compress uncertainty into a number that looks more authoritative than the evidence. In this prototype, the risk score is a triage device. Labels such as high, review, monitor, and low help order attention.