Certificate of Insurance Tracking for Contractors

Certificate of insurance tracking is the ongoing process of collecting contractors' certificates of insurance, reviewing them for accuracy and adequate limits, and monitoring expiration dates so no vendor works for you with lapsed coverage. It matters because a certificate of insurance is only a snapshot: it shows coverage on the day it was issued, not whether the policy is still active next month. When a contractor's policy lapses and something goes wrong, the claim can land on your company.

This guide covers what to check on every COI, how to build an expiration-monitoring routine that actually catches lapses, and when a spreadsheet stops being enough. It pairs with our contractor onboarding checklist, where the COI is one of seven checks every contractor should clear before approval.

Last reviewed September 28, 2026. This is an operational framework, not legal advice. Confirm insurance requirements with counsel or compliance professionals familiar with your jurisdictions and contracts.

What is a certificate of insurance?

A certificate of insurance, usually the industry-standard ACORD 25 form, is a one-page summary of a contractor's insurance policies. A typical COI lists general liability, workers' compensation, and commercial auto coverage, plus any umbrella or excess policies. For each policy it shows the carrier, policy number, policy period, and coverage limits.

Two facts about COIs catch teams off guard:

1. A COI is evidence, not the policy. It does not create coverage. The named insured's actual policy controls what is covered, and the certificate holder generally has no rights under the policy unless they are also named as an additional insured.
2. A COI can be stale the week after you receive it. Policies get cancelled mid-term for non-payment, limits get reduced, and endorsements change. A certificate issued in January says nothing reliable about coverage in September. That is the whole reason certificate of insurance tracking exists as an ongoing discipline rather than a one-time collection step.

What should you check on every COI?

Do not file a certificate without reading it. A careful review takes about five minutes and catches most problems. Check these items:

• Named insured matches the legal entity. The name on the COI must match the business entity in your contract. A dba, a trade name, or the owner's personal name is not the same thing.
• Policy dates are current and continuous. Confirm the policy is effective on your project dates. Watch for gaps between the effective date and the last policy's expiration.
• Limits meet your contract minimums. Commercial GCs commonly require $1 million per occurrence and $2 million aggregate in general liability, plus workers' comp at statutory limits. Your contracts set the floor; the COI proves the contractor cleared it.
• Additional insured status is real. Being listed as the certificate holder is not the same as being an additional insured. Additional insured status extends coverage under the contractor's policy and requires an actual endorsement to the policy, the common ISO forms being CG 20 10 (ongoing operations) and CG 20 37 (completed operations). Ask for the endorsement, not just the certificate.
• Primary and noncontributory wording is present when required. Many contracts require the contractor's policy to respond first and without seeking contribution from your own policy. Confirm the endorsement rather than assuming the checkbox on the certificate means it exists.
• Waiver of subrogation, if your contract requires it. The standard ISO form is CG 24 04. It prevents the contractor's insurer from coming after you to recover claim payments.
• Description of operations is accurate. The operations box should reflect the work being performed. A stale or generic description is a sign nobody reviewed the certificate.
• Producer contact info is present. When you need to verify directly with the broker, the producer's name, phone, and email on the form are your starting point.

Why expiration monitoring is the core of certificate of insurance tracking

Most teams are good at collecting COIs at onboarding and bad at everything after. The failure mode is always the same: a subcontractor renews annually, the renewal certificate never arrives, the policy lapses, and nobody notices until a claim or an audit surfaces the gap. During the lapse, your firm can be the deepest pocket in the room if an injury or property damage occurs.

A working expiration-monitoring routine has four parts:

1. Log every policy's expiration date at intake. Not the certificate issue date, the policy expiration date. Track each coverage line separately, since general liability and workers' comp often renew on different schedules.
2. Send tiered reminders. A common cadence is 90, 60, 30, and 7 days before expiration, with the first reminders going to the contractor and the later ones escalating to your project team. The 90-day notice gives the contractor time to renew and the broker time to issue a new certificate.
3. Block non-compliant vendors. The reminder system only works if an expired COI has consequences: no new work assignments, no dispatch, no payments released until the updated certificate is on file.
4. Re-verify, don't just re-file. A renewal certificate deserves the same five-minute review as the original. Limits change, carriers change, and additional insured endorsements sometimes do not carry over to the new policy term.

How should you collect COIs from contractors?

Set the rule before work starts, not after. Send a written certificate request with your exact requirements: which policies, minimum limits, additional insured language, waiver of subrogation, and the certificate holder name and address. Request the certificate from the contractor's insurance broker or agent directly whenever you can, since brokers issue certificates faster and more accurately than contractors do.

Ask for certificates per project or per renewal, not once and forever. A certificate tied to a specific job with the right additional insured wording is worth more than a generic one filed three years ago.

When is manual certificate of insurance tracking enough?

A spreadsheet works for a handful of contractors and one owner. It breaks around 30 to 50 vendors, or the moment project managers start saving certificates in personal email threads.

Automated COI tracking software adds three things a spreadsheet cannot do at scale: OCR extraction that reads policy numbers, dates, and limits out of uploaded certificates; rule engines that compare each certificate against your requirements and flag gaps automatically; and expiration monitoring with tiered alerts and compliance flags that block dispatch. For teams with hundreds of subcontractors or strict contractual insurance requirements, that automation is the difference between tracking and hoping.

Either way, pair insurance tracking with license monitoring. Insurance and licensure go stale on the same schedule, and a contractor who lets coverage lapse often lets the license slide too. Our guide on how often to recheck contractor licenses covers the cadence that pairs well with COI expiration monitoring.

FAQ

How often should contractors provide updated certificates?

At minimum, with every policy renewal, which for most contractors is annually. Many owners and GCs also require a fresh certificate for each new project. Because a certificate is only a snapshot, treat every renewal as a new review, not a formality.

What is the difference between a certificate holder and an additional insured?

A certificate holder is the party named on the certificate to receive it, often with a right to notice of cancellation. An additional insured is a party actually added to the contractor's policy by endorsement, with coverage under that policy. Certificate holder status alone does not extend coverage. If your contract requires additional insured status, get the endorsement.

Does a certificate of insurance guarantee the policy is active?

No. The certificate states that the policy was in force when issued. Policies can be cancelled mid-term, and a contractor can send you a certificate for a policy that lapses the following week. This is why direct verification with the broker and continuous expiration monitoring matter.

What happens if a subcontractor's insurance lapses mid-project?

The contractor loses coverage for your project, and any claim during the lapse can flow upstream to your firm. Standard practice is to stop the subcontractor's work until coverage is reinstated and an updated certificate is on file.

Who should own COI tracking?

Vendor management or compliance, not individual project managers. One owner, one system of record, and clear escalation rules keep certificates from scattering across inboxes.

Certificate of insurance tracking checklist

Use this as the operational takeaway for your team:

1. Issue a written certificate request with exact policy, limit, and endorsement requirements before any contractor starts work.
2. Review every COI on receipt: entity name, policy dates, limits, additional insured endorsement, primary and noncontributory wording, waiver of subrogation.
3. Log each policy's expiration date separately by coverage line in one central system.
4. Run tiered reminders at 90, 60, 30, and 7 days before expiration, escalating to the project team on late renewals.
5. Block non-compliant vendors from new assignments until an updated, verified certificate is on file.
6. Re-verify renewal certificates with the same review; do not assume endorsements carried over.
7. Verify directly with the broker for high-risk trades or large projects rather than trusting the certificate alone.
8. Pair COI tracking with license monitoring so credentials and coverage stay current together. StateLicense automates contractor license verification across CA, FL, NYC, OR, TX, VA, and WA via API and dashboard, which complements the insurance side of a vendor file.

Sources: ACORD forms library for the ACORD 25 certificate standard; MyCOI on COI best practices on collection and expiration reminders; TrustLayer on COI tracking on centralized tracking and automated alerts.