COI Tracking: How to Manage Certificates of Insurance

You're three weeks into a roofing job when your general contractor calls. They need proof that your subcontractor's insurance is current. You dig through your email, find a certificate from last year, and realize you have no idea if it's still valid. Now you're scrambling to track down a new one while the job sits.

That's the moment most service owners realize they need a COI tracking system.

COI tracking isn't complicated, but it's easy to mess up. A lapsed certificate of insurance can cost you tens of thousands of dollars if something goes wrong on a job. It can also get you shut down from work until you fix it. The good news? You can build a system that works in the next 30 minutes, and it doesn't require new software or more office staff.

Here's what you need to know.

What Is COI Tracking?

COI stands for certificate of insurance. It's a one-page document that proves a vendor, subcontractor, or employee has active insurance coverage. Think of it as a snapshot of their policy at a specific moment in time.

The standard form is called ACORD 25. It shows the insured person's name, the insurance company, the policy number, what types of coverage they have (general liability, workers comp, auto), the coverage limits, and when the policy expires. It's the document your GC asks for before letting you on a job. It's also what your own insurance company might ask for if you hire a subcontractor.

Here's the critical part: a certificate of insurance is just proof that coverage existed on the day it was issued. It's not a guarantee that the policy is still active. Policies can be cancelled mid-term. Coverage can lapse. That's why you need to track them.

If you're running an HVAC company with a handful of techs and a couple of subcontractors, COI tracking might feel optional. If you're a general contractor managing a couple dozen subs across multiple job sites, it's essential. Same goes for a pest control owner with recurring service agreements or a roofing crew that hires specialty contractors for structural work.

The stakes are simple: if an uninsured or underinsured vendor causes damage or gets hurt on your job, you absorb the cost. Learn more about business dashboard. Your insurance might not cover it. Your GC might hold you liable. Your business could take a hit that puts you in the red for months.

Why Does COI Tracking Matter for Service Businesses?

Let's walk through a real scenario. You can also explore unpaid invoices.

You're a roofing contractor. You hire a subcontractor to handle the structural work on a large job. You ask for a COI. They send one dated March 2025. You file it and move on. In July, while the sub is working, they cause major property damage to the client's home. You file a claim with their insurance company.

The insurer denies it. The policy was cancelled in May for non-payment of premium. The sub never told you. You never checked. Now you're liable for the full amount, and your client is furious.

That's not a worst-case scenario. It happens.

Here's another one. You're a pest control owner with recurring service contracts. One of your subcontractors' workers comp insurance expires in April. You don't notice. The following month, the worker gets injured on a job. Your state's workers comp law says you're the "statutory employer" - meaning you're liable for the injury even though the sub was uninsured. Your insurance company denies coverage because you failed to verify active coverage. You're out a significant chunk of money in medical bills and lost time.

These aren't edge cases. They're the reason GCs require COIs before work starts. They're the reason your insurance company asks about your vendor compliance. And they're the reason you need a system.

When you're managing a meaningful number of vendors or subs, each one renewing annually on a different schedule, you're looking at a steady stream of expirations to track throughout the year. Without a system, every one of those is an opportunity to miss a renewal and create liability.

The fix isn't hiring an office manager. It's building a simple tracking workflow that catches expirations before they happen.

What Should a COI Include? Key Fields to Verify

When you receive a certificate of insurance, here's what to look for:

Named Insured: The legal name of the person or company that holds the policy. This must match exactly the entity doing the work. If the certificate says "John's Roofing LLC" but the company is registered as "John Roofing Services LLC," that's a red flag. The policy might not cover the actual working entity.

Insurance Company (Carrier): The name of the insurer. Verify it's a real, licensed carrier in your state. If you don't recognize the name, ask the vendor to confirm.

Policy Number: The unique identifier for the policy. Write this down. You'll need it if you ever need to verify coverage directly with the insurer.

Coverage Type: What kind of insurance is it? The main ones are:

• General Liability (covers bodily injury and property damage caused by the vendor)
• Workers Compensation (covers employee injuries)
• Commercial Auto (covers vehicle-related incidents)
• Umbrella/Excess Liability (additional coverage above the base limits)

Coverage Limits: How much will the insurance company pay if something goes wrong? Standard minimums for general liability are $1 million per occurrence and $2 million aggregate. Workers comp limits vary by state and payroll. If the limits are too low for your job, ask the vendor to increase them or decline the work.

Effective Date and Expiration Date: When does the coverage start and end? Make sure today's date falls between these two dates. If the expiration date is in the past, the certificate is expired.

Certificate Holder: The party to whom the certificate is issued - usually you or your GC. Being listed here means you'll receive a copy of the certificate, but it does NOT mean you're covered under their policy.

Additional Insured Status: This is the one most owners miss, and it's critical. Being an "additional insured" means you're actually covered under the vendor's policy if something goes wrong. Without this endorsement, you're just a bystander. The certificate should note "Additional Insured – [Your Company Name]" or reference an ISO CG 20 10 or CG 20 37 endorsement. If it's not there, ask the vendor to add it.

Waiver of Subrogation: This prevents the vendor's insurance company from suing you to recover money after they pay a claim. It's less critical than additional insured status, but it's worth requesting.

Red Flags to Watch:

• Expiration date is today or in the past
• Named insured doesn't match the vendor's legal entity name
• No additional insured endorsement listed
• Coverage limits are below your contract requirements
• Certificate is more than 30 days old (some GCs require fresh certificates)
• Missing workers comp or auto coverage when the vendor needs it

If you see any of these, don't accept the certificate. Ask the vendor to fix it before work starts.

How Do You Build a COI Tracking System?

Here's the step-by-step process to set up a system that actually works. For more details, see technician onboarding process.

Step 1: Centralize Collection

Pick one place to store all COIs. This could be a shared Google Drive folder, a dedicated email folder, or a spreadsheet with attachments. The key is that everyone on your team knows where to find them. If your office manager stores them one place and your project manager stores them another, you'll miss expirations.

Step 2: Create a Master Tracking Spreadsheet

You don't need fancy software for this. A simple spreadsheet with these columns will do the job:

The "Next Follow-Up" column is where the magic happens. Set it to 60 days before expiration. That gives you time to reach out, get a new certificate, and verify it before the old one lapses.

Step 3: Set Renewal Reminders For more details, see automated reminder messages.

When the next follow-up date arrives, send the vendor an email asking for a renewed certificate. Don't wait for them to contact you. Most vendors won't think about it until their insurance company reminds them, which could be weeks before expiration.

Set three reminder dates:

• 60 days before expiration: "Hey, your certificate expires on [date]. Please send us the renewed one when it's ready."
• 30 days before expiration: "We still need your updated certificate. Expiration is [date]."
• 7 days before expiration: "Your certificate expires in one week. We need the new one before work continues."

If you're using a spreadsheet, you can set calendar reminders on your phone. If you want automation, tools like Google Calendar or Outlook can send you alerts based on the dates in your sheet.

Step 4: Assign Ownership

Someone on your team needs to own this process. It could be your office manager, project manager, or operations lead. Make it clear: this person is responsible for tracking expirations, sending reminders, and verifying new certificates. If it's nobody's job, it won't get done.

Step 5: Make COI Submission a Gate for Payment

This is the enforcement step. In your vendor contract or subcontract agreement, state: "No payment will be issued until a current certificate of insurance is on file." Then actually enforce it. If a vendor's certificate expires and they haven't sent a new one, hold their payment. It sounds harsh, but it works. Vendors will prioritize getting you a new certificate if it means getting paid.

Step 6: Require COI Before First Payment

Don't wait until the job is halfway done to ask for a certificate. Make it part of your onboarding process. Before you cut a check to any vendor or sub, you should have a current COI on file. This prevents the gap where work happens but coverage isn't verified.

Manual Tracking vs. COI Tracking Software

You can absolutely run this system with a spreadsheet. If you have fewer than 15 vendors, a spreadsheet is probably your best bet. It's free, it's simple, and you control it.

But if you're managing a larger roster of vendors with staggered renewal dates - or if you're a property manager tracking a hundred-plus certificates - a spreadsheet starts to feel like a second job. You'll spend a few hours every month updating dates, sending reminders, and chasing down new certificates.

That's where COI tracking software comes in. Platforms like myCOI, Jones, BCS, and others automate the reminders, flag coverage gaps, and sometimes use AI to read certificates and pull out the key fields for you. The math is worth thinking about: if you're spending several hours a month on manual tracking, software that handles it for a modest monthly fee can pay for itself. If you're only spending 30 minutes a month, a spreadsheet is fine.

But here's the thing: software doesn't replace the process. You still need to enforce the payment gate. You still need to verify that the coverage limits meet your contract requirements. You still need to check that additional insured status is listed. Software just handles the calendar and the reminders.

For most service owners at smaller revenue levels, a spreadsheet works fine. As you grow and add more vendors, you can move to software later.

How Often Should You Review COIs?

Review COIs at three moments:

At Onboarding: Before the vendor starts work, verify that their certificate is current and meets your requirements. Check the expiration date, coverage limits, and additional insured status. File it in your central location.

Annually: Even if a certificate doesn't expire for six months, pull it out once a year and verify it's still valid. Insurance companies sometimes cancel policies mid-term. A quick call to the vendor asking "Is your coverage still active?" takes 30 seconds and could save you thousands.

At Expiration Alert: When your 60-day reminder fires, reach out to the vendor. When they send the new certificate, verify it's current and meets your requirements before filing it.

For a contractor with a couple dozen subs renewing on staggered schedules, this means a handful of expirations per month to manage. Learn more about recurring compliance schedules. That's workable with a spreadsheet and a calendar reminder - and it's also the kind of volume where software starts to look attractive.

One more thing: request a "cancellation notice" endorsement on every policy. This tells the insurance company to notify you if the policy is cancelled before the expiration date. Most carriers will add this for free. It's your safety net against mid-term cancellations. According to industry best practices, re-check every certificate 30 to 45 days before it expires so you can chase the renewal before there's a coverage gap, not after.

Common COI Tracking Mistakes and How to Avoid Them

Mistake 1: Accepting a COI Without Verifying the Date

You receive a certificate dated March 2025. You file it. Three months later, you realize the expiration date was April 2025. The certificate is expired, and you didn't notice. You can also explore job costing.

Fix: Always check the expiration date before accepting a certificate. If it's within 30 days of expiration, ask for a renewed one immediately.

Mistake 2: Not Requesting Additional Insured Status

You have a certificate on file. The vendor causes damage. You file a claim with their insurance company. They deny it because you're not listed as an additional insured. The certificate holder status doesn't protect you.

Fix: Before accepting a certificate, verify that your company is listed as an additional insured. If it's not, ask the vendor to add it via an ISO CG 20 10 or CG 20 37 endorsement. Don't proceed without it.

Mistake 3: Tracking Only General Liability

You verify the vendor's general liability coverage but don't ask about workers comp. One of their employees gets hurt on your job. You're liable as the statutory employer. Their workers comp is expired, so you're unprotected.

Fix: Ask for all relevant coverage types. For most trades, that's general liability, workers comp, and commercial auto. For specialized vendors, ask what coverage they carry and require it on the certificate.

Mistake 4: Relying on the Vendor to Tell You About Renewals

You assume the vendor will send you a new certificate when their policy renews. They don't. You don't follow up. The certificate expires, and you don't realize it until a problem arises.

Fix: Don't wait. Proactively reach out 60 days before expiration. Send an email: "Your certificate expires on [date]. Please send us the renewed one." Most vendors will respond immediately. The ones who don't are the ones you need to follow up with.

Mistake 5: No Consequence for Non-Compliance

A vendor's certificate expires. You ask for a new one. They say they'll get it next week. You wait. Nothing happens. You still pay them on time.

Fix: Tie payment to compliance. In your contract, state that payment is contingent on a current certificate. When a certificate expires, hold the payment until you have a new one. It's the most effective enforcement tool you have.

Mistake 6: Not Catching Mid-Term Cancellations

A vendor's policy is cancelled in May for non-payment of premium. The certificate doesn't expire until August. You don't find out until a claim is denied in June.

Fix: Request a cancellation notice endorsement. This tells the insurer to notify you if the policy is cancelled before the expiration date. It's your early warning system.

FAQ: COI Tracking Questions Answered

What does COI stand for in insurance tracking?

Direct Answer: COI stands for "certificate of insurance." It's a one-page document that proves a vendor or subcontractor has active insurance coverage. For more details, see vendor payment holds.

A certificate of insurance is issued by an insurance company and shows the policy holder's name, the insurer, the policy number, coverage types, limits, and expiration date. It's not the actual policy - it's proof that the policy exists. Think of it like a receipt for insurance. You use it to verify that someone has coverage before they start work on your job.

How much does COI tracking software cost?

Direct Answer: COI tracking software varies quite a bit in price depending on the number of vendors and features you need.

Entry-level platforms are generally affordable enough for small operations with a modest vendor list. Mid-market platforms add more automation. Enterprise platforms with advanced features and integrations cost more. Most offer a free trial, so you can test before committing. The real question isn't the sticker price - it's how many hours a month you're currently spending on manual tracking. If software saves you that time, it usually pays for itself.

What is the difference between a certificate holder and an additional insured?

Direct Answer: A certificate holder is simply the party to whom the certificate is issued. An additional insured is actually covered under the vendor's insurance policy.

Being listed as a certificate holder means you receive a copy of the certificate - that's it. You have no coverage. If the vendor causes damage, their insurance won't cover you. Being an additional insured means you're named in the policy itself (via an endorsement like ISO CG 20 10). If the vendor causes damage, their insurance will cover you. Always request additional insured status in your contracts. Don't accept a certificate without it.

Can I track COIs in a spreadsheet or do I need software?

Direct Answer: You can absolutely track COIs in a spreadsheet if you have a relatively small vendor list. Beyond that, software becomes more practical.

A spreadsheet with columns for vendor name, expiration date, and next follow-up date works fine for smaller operations. You can set calendar reminders for renewal dates and manage the process manually. The downside is that it requires discipline - if you miss a reminder, you miss an expiration. Software automates the reminders and flags coverage gaps, which saves real time as your vendor list grows. A spreadsheet is a great starting point, and you can upgrade to software later if needed.

What happens if a subcontractor's COI expires while they are on a job?

Direct Answer: If a subcontractor's COI expires while they're working, you're exposed to liability. If they cause damage or get injured, their insurance won't cover it, and you may be liable.

This is why the payment hold enforcement step is critical. In your contract, state that payment is contingent on a current certificate. If a certificate expires and the vendor hasn't sent a new one, hold their payment until they do. It creates urgency. Most vendors will prioritize getting you a new certificate if it means getting paid. If a vendor refuses to provide a current certificate, don't let them continue working.

How do I request a COI from a vendor or subcontractor?

Direct Answer: Send a simple email asking for a certificate of insurance and specifying what coverage you need.

Here's a template: "Before we begin work, please provide a current certificate of insurance showing [general liability, workers comp, commercial auto] coverage with limits of at least $1M per occurrence / $2M aggregate. Please list [Your Company Name] as an additional insured. The certificate should be valid for at least [30 days / 90 days] from the start date of work." Most vendors have this on file and can send it within 24 hours. If they push back or say they don't have insurance, that's a red flag. Don't hire them.

What coverage limits should I require on a COI?

Direct Answer: Standard minimums are $1 million per occurrence and $2 million aggregate for general liability. Workers comp limits vary by state and payroll.

For most construction and service trades, $1M/$2M is the industry standard. Some larger projects or GCs require higher limits. Check your contract with your GC or client to see what they require. For workers comp, the limit is typically based on the vendor's payroll and state requirements - ask your insurance broker what's appropriate for your state. If a vendor's coverage limits are below your requirements, ask them to increase them or decline the work. Don't compromise on this.

Conclusion

COI tracking isn't sexy, but it's one of the most important things you can do to protect your business. A lapsed certificate can cost you tens of thousands of dollars. A simple system - whether it's a spreadsheet or software - catches expirations before they become problems.

Start with a spreadsheet. Set up your vendor list, add expiration dates, and create calendar reminders for 60 days before each expiration. Enforce the payment gate: no current certificate, no payment. Require additional insured status on every certificate. That's it. You've built a system that works.

As you grow and add more vendors, you can move to software. But the process stays the same: collect, verify, track, remind, enforce.

If you want to skip the spreadsheet and have someone else handle the tracking, LocalRestart sets this up for you - we track every license, insurance paper, and subcontractor form, and we warn you before they expire. But whether you do it yourself or outsource it, the key is consistency. Check your certificates. Verify the dates. Follow up before they lapse. Your future self will thank you.