Certificate of Insurance Tracking: How to Catch Vendor Documents Before They Expire

The standard ACORD 25 certificate that most US subcontractors send you states that it is “issued as a matter of information only and confers no rights upon the certificate holder.” The certificate sitting in your files describes the vendor’s coverage on the day the broker issued it, and nothing on that page changes if the policy is cancelled, reduced, or left to lapse afterward.

That gap explains why certificate of insurance tracking breaks down in so many procurement and facilities teams. A spreadsheet with an expiry column catches renewals only when someone remembers to check it, and it never catches a missing endorsement or a mid-term cancellation. With 400 or more subcontractors, a reliable process needs renewal rules, reminders, escalation paths, and a clear decision on what happens when a document lapses.

Why Do Vendor Insurance Certificates Lapse Without Anyone Noticing?

Vendor insurance certificates lapse unnoticed because expiry dates sit in spreadsheets with no owner, renewal requests travel through one person’s inbox, and a certificate never updates when a policy is cancelled mid-term. Teams track the date on the paper while the coverage behind it changes.

Four gaps show up in almost every manual process:

• No owner for the date column: Everyone can see the spreadsheet, so nobody feels responsible for acting on it
• Inbox-dependent renewals: Renewed certificates arrive by email to whoever requested the last one, and they leave with that person
• Mid-term cancellations: A policy can end before its printed expiration date, and your copy of the certificate will still look valid
• Missing endorsements: The ACORD 25 form itself states that additional insured status requires the policy to be endorsed, so a certificate alone does not prove you are covered

Short reminder windows make all four worse. One UK engineering firm we talked to with roughly 400 vendors recently moved its insurance expiry notice from 7 days to 30 days because a week was not enough time to chase renewals at that volume. Spreadsheets struggle with this kind of operational load for structural reasons, as this look at why spreadsheets fail in TPRM explains.

Track the coverage behind the certificate, and treat the expiry date as one signal among several.

Which Vendor Documents Need Expiry Tracking?

Most teams start with insurance and discover several other documents carry the same lapse risk. Here are the documents worth tracking for construction, engineering, facilities, and shipping suppliers.

The last two rows apply mainly to IT and software vendors, where a SOC 2 report has no expiry date but loses value as its audit period recedes.

Collection at onboarding is only half the job. A strong vendor onboarding process gets the first set of documents in, while expiry tracking keeps them valid for the life of the relationship.

Every document with a validity period needs a recorded expiry date at the moment you accept it, or it will never trigger a reminder.

How Should Renewal Periods Differ by Document and Vendor Criticality?

Two variables set the rules: the document type decides how often it renews, and the vendor’s criticality decides how strictly you enforce that renewal.

Set default renewal periods by document type, such as 12 months for insurance and 36 months for ISO certifications, and override them with the actual expiry date printed on each document. That combination means a missing date never leaves a document untracked.

Pro tip: Make the expiry date a mandatory field for insurance, licenses, and certifications at upload. A document saved without a date silently drops out of every reminder you configure later.

Criticality should decide how hard you enforce a lapse, while the document type decides how often you ask for a renewal.

How Do You Request a Certificate of Insurance From a Vendor?

A clear request saves a second round of corrections. Here is a sequence that gets the right certificate the first time.

1. Send your insurance requirements in writing: List coverage types, minimum limits, required endorsements, and the exact certificate holder name and address
2. Ask the vendor to have their broker issue it: Certificates come from the insurance producer, and a broker-issued document is harder to alter
3. Request the endorsements alongside the certificate: Additional insured and waiver of subrogation status live in the endorsements, so ask for the endorsement pages
4. Check the certificate against the contract on receipt: Confirm limits, dates, named insured, and certificate holder before you file it

Keep the written requirements on the vendor record so next year’s renewal gets checked against the same standard.

A certificate request should state exactly what you need, because a broker can only issue what you ask for.

How Should Reminders and Escalations Work?

Reminders should start early enough for a broker to issue a renewal and escalate internally before a lapse becomes a site or contract problem. A cadence tied to criticality keeps the noise down for low-risk vendors.

Send every reminder to a role-based contact on your side, and keep the vendor’s broker in the loop where you can. Renewals stall most often when the only person who knows a certificate is due has moved to another project.

Trap to avoid: Sending reminders only to the vendor. If the vendor goes quiet, nobody on your side knows a critical subcontractor is about to work uninsured.

Reminders protect you only when someone inside your organization owns the response.

What Should Happen When a Document Lapses?

Decide your lapse response before it happens, write it down, and assign an owner to each step. A typical sequence runs as follows.

• Flag the vendor record so anyone raising a purchase order or scheduling site work sees the lapse
• Send a renewal request with your written requirements attached
• Escalate by criticality, moving critical vendors to the contract manager the same day
• Apply your hold policy, such as pausing site access or new work orders for critical vendors until the renewal arrives
• Record the resolution with the new document, the date it arrived, and who accepted it

Holds on work or payment are business decisions with contractual consequences, so agree them with legal and finance in advance. The tracking process should surface the lapse quickly, while a named person decides what happens next.

A lapse policy that lives in someone’s head will be applied inconsistently, so put it in writing with an owner for each step.

Which Metrics Show Your Certificate Tracking Is Working?

Five metrics tell you whether certificate of insurance tracking is actually reducing exposure:

• Compliance rate by criticality tier, with a target of 100% for critical vendors
• Documents expiring in the next 30, 60, and 90 days, reviewed weekly
• Average days overdue for lapsed documents
• Renewal turnaround from first notice to accepted document
• Non-responsive vendors who have ignored two or more reminders

Watch the compliance rate for critical vendors above everything else. A dip there means someone could be on your site today without valid coverage.

If you cannot report your critical-vendor compliance rate in under five minutes, your tracking process depends too heavily on manual effort.

How ComplyScore® Tracks Vendor Documents Before They Expire

Once your rules, renewal periods, and escalation paths are set, the remaining challenge is running them across hundreds of vendors. ComplyScore® handles that through its vendor management capabilities:

• Requirements by criticality: Vendor criticality determines the required document list, so a site subcontractor and an office supplier get different requirements automatically
• Vendor portal uploads: Vendors upload renewals directly through a secure portal, and your team can complete uploads on behalf of small vendors who will not use it
• Configurable renewal and reminder rules: Set renewal periods and reminder timings per document type, with notices to both the vendor and your internal team
• Expiry dashboard: See documents expiring in the next 30, 60, and 90 days, with each vendor marked compliant, due soon, or overdue
• Tasks and escalation: Create tasks from alerts and set SLA escalation rules, and procurement can trigger a full revalidation for any vendor at any time

Every document sits in one central vault with a timestamped audit trail, so you can show an auditor or client when each certificate arrived and who accepted it. For critical vendors, continuous risk monitoring adds sanctions, financial, and adverse media signals alongside document status.

ComplyScore® is a Representative Vendor in the 2025 Gartner Market Guide for TPRM Technology Solutions.

Keep Every Certificate Current Without Chasing It

Certificate of insurance tracking works when every document has a recorded expiry date, every vendor has a criticality tier, every reminder has an internal owner, and every lapse follows a written policy. Start with your critical subcontractors this month, because they carry the most exposure and the smallest margin for a missed renewal.

To see what that looks like on your own data, book a ComplyScore® demo, upload 50 vendors, and watch the expiry alerts appear.