While a business itself can be sold, the AOC held by a business is not something that can be bought or sold, and a purchaser of the business would not automatically acquire the right to operate under that business's AOC.
There are important safety reasons for this. An AOC is issued to an operator who has demonstrated they have the people, systems and infrastructure in place to conduct safe operations. That assurance does not move with a change in ownership of the AOC holder's business.
If a purchaser of a business that holds an AOC wishes to continue operations, they'll need to satisfy CASA that those arrangements (people, systems, infrastructure) underpinning the AOC remain in place or apply for a changed or new AOC. Otherwise, the validity of a current AOC ceases when the current holder ceases to exercise full operational control.