30/60/90 Day COI Tracking to Prevent Coverage Gaps for Ops
30/60/90 day COI tracking that finds the gap before a claim does
A certificate of insurance (COI) tracking system collects each vendor's certificate, checks it against what your contract requires, and requests a renewed one 90, 60 and 30 days before the policy expires. Then it keeps watching, because a policy can be cancelled mid-term and nobody is obliged to tell you. If you run more than a few dozen vendors from a spreadsheet, that last part is the reason to automate.
This guide covers what a certificate does and doesn't prove, how the tracking loop works week to week, a rollout order that won't stall, and what to test before you sign with any vendor.
A certificate is evidence of cover, not the cover itself
A COI is a one-page summary that a vendor's insurance agent issues. In the US it's usually the ACORD 25 form. It lists the insurer, policy numbers, limits, effective and expiry dates, and whether you've been named as an additional insured.
Read the small print on it. The ACORD certificate says it "is issued as a matter of information only and confers no rights upon the certificate holder" and that it "does not amend, extend or alter the coverage" in the policies listed. A New York Insurance Department opinion on that form also points out that state law requires cancellation notice to go to the first-named insured and its agent or broker. You, the certificate holder, aren't on that list.
So two things go wrong in practice. The certificate can claim something the policy doesn't back up, like a ticked additional insured box with no endorsement behind it. Or the vendor stops paying in month four, the policy is cancelled, and you only find out at the next renewal. Or after their crew floods your basement.
What a tracking system does that a shared drive can't
You'll see the category called insurance tracking software, COI management or insurance compliance management. The job is the same: turn a folder of scanned PDFs into a monitored record that tells you who's covered today.
Intake has to be easy for the vendor. Certificates arrive as email forwards, uploads through a link, straight from the vendor's broker, or through an API. Every extra step you add for a roofing contractor's office manager is another week you'll wait.
Extraction reads the document. Most platforms now use OCR to pull out the carrier, policy numbers, limits, dates and endorsement wording. The endorsements matter most. A general liability policy with the right limit but no additional insured endorsement still leaves you exposed if that vendor damages your property, and the limit is the only thing a quick glance checks.
Requirement templates set the bar per vendor type. An electrical subcontractor working on your roof needs different limits than a software vendor who never visits. Good systems let you set rules per vendor category, contract type or project, so each certificate is checked against the clause that applies to it.
Renewal requests go out on a schedule. Instead of a coordinator keeping a tickler file, the system emails the vendor at 90, 60 and 30 days before expiry. If they don't respond, the tone and the recipients change.
Monitoring continues after the certificate is filed. A certificate that was fine on upload can be worthless in June. Some platforms can flag mid-term cancellations or changes. Ask exactly how they do it, because a system that only checks at renewal won't catch the June problem.
The audit trail answers the awkward question. Every check, exception and reminder gets a timestamp. When a claim lands and someone asks whether you knew the vendor's cover had lapsed, you can answer in minutes, not after a week of searching old email.
How the tracking loop runs week to week
Once you're off spreadsheets, the work follows the same loop for every vendor: bring the certificate in, read it, check it, chase the renewal, keep watching, record what happened.
- Load your existing certificates first, starting with the vendors who'd hurt most if uncovered: anyone with site access, high-risk trades like electrical and roofing, and anyone on a critical contract.
- Turn your contract insurance clauses into requirement templates. Typical fields are general liability limits, auto, workers' compensation, and endorsements such as additional insured or waiver of subrogation.
- Let the automated check flag mismatches, such as a limit that's $500,000 short of the contract or a missing endorsement.
- Send the odd cases to a person. Unusual endorsement wording is where full automation gives false confidence, so someone who reads policies (often your broker) should make the call.
- Escalate when a vendor ignores three requests or refuses to fix a gap. That goes to whoever owns vendor risk, with authority to stop the vendor working, not to another automated email.
- Close the renewal only when the new certificate is in and checked. A reminder that was sent isn't a renewal that happened.
- Keep watching. A twelve-month policy cancelled in month four won't surface again until the annual renewal unless something is looking for it.
Don't try to backfill every vendor on day one. It sounds thorough and usually stalls the project. Get the workflow clean on your riskiest vendors, then load the rest in batches.
Build the business case on hours you can count
Start with time. Ask whoever chases certificates today to log it for two weeks: emails sent, PDFs opened, limits checked, follow-up calls. That's your baseline, and it's usually bigger than the team expects.
Then do plain arithmetic: weekly hours, times 52, times the loaded hourly cost of the person doing the work. Compare that with the subscription. Leave avoided claims as a sentence rather than a figure, because you can't defend a guess about a lawsuit that didn't happen.
Risk reduction is harder to price and matters more. Finding a lapsed policy the week it lapses, rather than after a loss on your site, is the whole point. Track three numbers after go-live to see whether it's working:
- Current-certificate rate: the share of active vendors with a checked, unexpired certificate on file today.
- Exception resolution time: days from a flagged gap to a compliant replacement certificate.
- Audit export: whether you can produce a full, timestamped record for any vendor on request without rebuilding it by hand.
Roll it out in this order or it stalls in month two
Name one owner first. Someone in compliance, procurement or risk has to own the COI process end to end, including the right to reject a vendor who won't comply. Without that person, exceptions pile up because nobody can close them.
Write down how it works now. Where do certificates arrive, who opens them, who decides? You can't fix a process you haven't drawn, and the drawing usually shows two people doing the same check.
Build requirement templates before you switch on automated checks. Construction subcontractors, professional services firms and facilities contractors each get their own rules. A single generic minimum either rejects good vendors on technicalities or waves through ones who don't meet your real threshold.
Pick a default intake route before you invite vendors. Upload link, dedicated inbox or broker feed: a mix is normal, but vendors need one clear instruction in the first email.
Pilot one vendor category. Run construction subcontractors through the whole loop, measure the current-certificate rate and resolution time, fix what broke, then expand.
What to test before you buy COI software
Test extraction first. Bring your own scanned certificates to the demo, including the faxes and the handwritten endorsements, and watch what comes back. A marketing page can't tell you how it reads your documents. A live test can.
Use this table as your demo script. The right column is the answer that should end the conversation.
| Area | What to test in the demo | Red flag |
|---|---|---|
| Extraction | Upload your own worst certificates, including endorsement pages | They only show clean sample documents |
| Requirement rules | Build one template per contract type while you watch | One global requirement set for every vendor |
| Exceptions | Follow a flagged certificate from alert to fixed | Flags land in a list with no owner or next step |
| Monitoring | Ask how mid-term cancellations are detected | A vague answer, or "we check at renewal" |
| Exports | Ask for a sample PDF and CSV export of one vendor's history | Exports locked behind a higher tier |
| Security | Ask for their current SOC 2 report | Nothing available on request |
| Support | Ask who helps during onboarding and how fast they reply | Help only starts after go-live |
| Pricing | Ask for the price at your vendor count and next year's | No breakdown of per-vendor or per-seat costs |
Integration and security questions worth asking
A COI platform that sits apart from everything else becomes one more list to reconcile by hand. Check whether it connects to your procurement tool, your ticketing system for exception hand-offs, and your single sign-on provider, so you control who can approve or reject a vendor.
If you onboard vendors in volume, ask about webhooks. A webhook that fires when a certificate is approved or lapses can update the vendor's status in the system your facilities team already uses, so nobody has to check a second dashboard.
On security, ask for specifics. Data should be encrypted in transit and at rest. Role-based access should separate people who can approve exceptions from people who can only view. And the logs should be detailed enough to rebuild any decision later.
Asking for a SOC report is normal procurement practice. A vendor that can't produce one, or goes quiet when asked, is telling you something about how it runs.
Where ExpiryEdge fits in a COI process
COI tracking is mostly a deadline problem. Every certificate has an expiry date, every renewal needs someone to chase it, and every lapse is a missed date with money attached. ExpiryEdge tracks those dates, reminds the person responsible by email, SMS, WhatsApp, Slack or Teams, escalates overdue items to a manager, and keeps an exportable audit trail. It doesn't replace your broker's judgment on unusual endorsement wording.
The collection side matters as much as the reminder. Instead of emailing a vendor and waiting, ExpiryEdge sends a request link where they upload the renewed certificate. Follow-ups continue until it arrives, and a certificate that's missing an endorsement can go back to the vendor with a note saying what to fix.
It's the same logic procurement teams use to stay ahead of contract renewal deadlines, pointed at insurance instead of contract terms.
What I see go wrong in COI pilots
The most common mistake is testing extraction on clean sample certificates instead of the scanned mess your vendors actually send. Test on your worst documents first. The second is one generic template for every vendor, which rejects good vendors on technicalities and lets weak ones through. Judge the pilot on exception resolution time, not on how many certificates were uploaded. Speed to fix is what tells you whether it'll hold up at scale.
Kuldeep, ExpiryEdge
Next step: get your ten riskiest vendors under control this week
Pick the ten vendors who'd cause the most damage without cover, usually the ones with keys or site access. Collect a current certificate from each, note the expiry date and the endorsements your contract requires, and set requests at 90, 60 and 30 days. If any certificate is already past its date, stop work until you have a new one.
A spreadsheet like our insurance COI tracker template is fine for those ten. When the list grows, or the person who owns it goes on leave, that's when certificates start slipping.
If you'd rather have the requests and escalations run themselves, start an ExpiryEdge 14-day free trial (no credit card) and load those same ten vendors first. You'll see within one renewal cycle whether the workflow fits your calendar.
Sources
- New York State Insurance Department, Office of General Counsel, opinion on ACORD certificate of insurance wording (2000).
FAQ
How do you track certificates of insurance?
Log every vendor's certificate with its policy dates and endorsements, then compare it with the insurance clause in that vendor's contract. Ask for a renewed certificate 90 days before expiry and chase it at 60 and 30. If nothing arrives, the contract owner hears about it. A spreadsheet copes with a handful of vendors. Past a few dozen, software that sends the requests and keeps the history saves real hours.
How much does COI tracking software cost?
It depends on the model. Some vendors charge per vendor tracked, others per user seat, and some a flat subscription. Managed services, where trained people review complicated certificates and endorsements for you, cost more than self-serve tools. Ask for a quote at your real vendor count. ExpiryEdge has a 14-day free trial with no credit card, so you can test its reminders first.
What is COI tracking?
COI tracking means collecting certificates of insurance from vendors, contractors or tenants, checking that the coverage meets your contract, and keeping it current. It runs from first intake through renewal reminders to spotting a policy that was cancelled before its end date. The goal is simple: you should never have someone on site whose cover you can't prove.
What is an insurance tracking system, and is it the same as a tracking device?
No. In vendor compliance, an insurance tracking system is software that monitors whether your vendors' insurance is current and adequate. It has nothing to do with the telematics boxes some auto insurers fit to cars to price a policy. If you're buying for procurement or facilities, search for COI tracking or insurance compliance software instead.
Recommended
Frequently asked questions
It depends on the model. Some vendors charge per vendor tracked, others per user seat, and some a flat subscription. Managed services, where trained people review complicated certificates and endorsements for you, cost more than self-serve tools. Ask for a quote at your real vendor count. ExpiryEdge has a 14-day free trial with no credit card, so you can test its reminders first.
COI tracking means collecting certificates of insurance from vendors, contractors or tenants, checking that the coverage meets your contract, and keeping it current. It runs from first intake through renewal reminders to spotting a policy that was cancelled before its end date. The goal is simple: you should never have someone on site whose cover you can't prove.
No. In vendor compliance, an insurance tracking system is software that monitors whether your vendors' insurance is current and adequate. It has nothing to do with the telematics boxes some auto insurers fit to cars to price a policy. If you're buying for procurement or facilities, search for COI tracking or insurance compliance software instead.
