Vendor COI requirements, requests, and renewals

What a vendor COI is

A vendor certificate of insurance is the COI you request from a company that sells you services or does work on your behalf: a janitorial contractor, a roofer, a landscaper, a consultant, a security firm, a transporter. “COI for vendors” means the same document from the requester’s point of view. Vendor COI tracking is the record of what you asked that company for, what you received, whether it matched the requirement, and when it stops being current.

The vendor does not usually type the certificate. Their insurance agent or broker issues it. Your request should say that plainly, so the vendor knows to call the agent instead of forwarding an old PDF from a different customer.

If you need the underlying cycle first — what tracking is, and how it differs from saving a file — start with what COI tracking is. This page assumes you already know you are the party asking.

What to record

In the United States, many liability certificates are issued on ACORD 25. Treat the form as a summary. The fields people actually use in a vendor file are:

• The vendor’s legal name, and whether it matches the named insured on the certificate.
• The certificate holder: your organization’s name and address, as the party being notified.
• Each insurer, policy number, and coverage line you require.
• Effective and expiration dates for each of those lines. They are often different.
• Limits, compared with the limits already written in your contract. This page does not publish sample limits. A number that is “typical” for someone else’s building can be wrong for yours.
• A description of operations or location, when it shows which job the certificate was issued for.
• The date you received it, who reviewed it, and the status you assigned.

Lines that commercial contracts often name include commercial general liability, automobile liability, workers’ compensation, umbrella or excess liability, and professional liability for advisory work. Some agreements also ask for property, pollution, or other specialty lines. List the lines your agreement names. Do not add a line because it appeared on another vendor’s certificate.

Workers’ compensation certificates often describe benefits as statutory. What “statutory” requires is a state-law question. Record that the line is present and the dates, and send anything you do not understand to your broker rather than marking it accepted because the word looks official.

Holder, additional insured, and waiver

These three ideas arrive in the same email and they are not interchangeable.

Certificate holder

The holder is who the certificate was addressed to. Ask for your legal name, spelled as it appears on the contract, and the address where notices should go. If a parent company, a property manager, and a building owner all think they are the holder, say which names the contract requires. A certificate issued to “whom it may concern,” or to a previous landlord, is a collection failure even if the limits look familiar.

Additional insured

Additional insured status, when a policy provides it, is granted by the policy or an endorsement, not by your wish to be protected. Contracts often ask for it. Certificates often contain a remark that additional insured wording is included. Use that remark as a prompt. If your contract or your broker says you need the endorsement itself, ask for the form and file it with the certificate. This site will not tell you that a checked box is enough. Someone who knows your contract has to say that.

Waiver of subrogation

A waiver of subrogation is a promise, if the policy allows it, that the insurer will not pursue your organization to recover what it paid its own insured, in the situations the waiver covers. Like additional insured status, a sentence on the certificate is a clue, not the waiver. Collect the endorsement when your agreement requires the endorsement.

Primary and noncontributory wording is the same kind of item: a contract request, sometimes noted on the certificate, confirmed in the policy forms if that is the standard you use. Write your standard down once so reviewers are not inventing it per email.

How to request one

Send the request before work starts, in writing, to a person at the vendor and ask them to have their agent reply to a single monitored address. Include:

1. Your organization’s name and the property, project, or contract the request applies to.
2. The vendor’s legal name as it appears on your agreement, and any DBA you know they use, so the agent can match the named insured.
3. The certificate holder’s exact name and address.
4. The coverage lines and limits the contract already requires, by pointing at the contract section or exhibit. Do not retype limits from memory if the contract is the source.
5. Any additional insured, waiver, or other wording the contract requires, and whether you want the endorsement attached.
6. A due date that leaves time to reject a bad certificate before the vendor is on site.
7. Where to send it, and a note that a prior customer’s certificate will not be accepted in place of one that names you.

Keep a copy of what you sent. When the vendor replies with questions, the requirement set — not a new improvised email — should answer them. If you do not have a requirement set yet, stop and write one. Chasing paper without a standard produces a folder of PDFs and no decisions. The definition guide lists what that standard has to decide.

When the certificate arrives

Open the file against the request, not against your memory of last year’s vendor. Check each item. Leave it blank if you cannot tell. Blank is more honest than “looks fine.”

• The named insured matches the contracted party. A parent, a subsidiary, or a DBA is a mismatch until someone confirms the policy is the one your contract allows.
• The certificate holder is your organization, spelled so you would recognize a notice sent to that name.
• Every required line is present. A handsome general-liability limit does not fill in a missing auto policy if the vendor drives onto your property and the contract requires auto.
• Limits meet the contract. Compare the contract’s numbers with the certificate’s numbers. Do not “round” a shortfall because it is close.
• The effective date has started. A certificate that begins next month does not cover work this week.
• You have the expiration date of each required line, and the earliest of those dates is the one on your renewal list.
• The description of operations or location is not obviously another customer’s job or another building.
• If you require additional insured status, a waiver, or similar wording, the certificate’s remark is recorded as a remark. The endorsement is either attached or still outstanding, according to your standard.
• The reviewer’s name and the review date are on the record.
• Any exception is written down, with the person who has authority to accept it and the date the exception ends. An exception with no owner becomes permanent by accident.
• The file is stored against that vendor and that site or project. It is not only in the reviewer’s downloads folder.

If the vendor is already working and the certificate is late, record the gap for the days you had no accepted document. Do not mark those days accepted because a certificate arrived later. The later certificate speaks to the period it actually covers.

Expiry and renewal checklist

Most vendor policies are written for a year. Project work and off-site contracts still collide with those anniversaries. The renewal is a new collection, not a hope that the old PDF remains true.

• Put the renewal task on the earliest required end date, not on a single “vendor expires” cell if the lines end apart.
• Start early enough that an agent can reissue. Many teams ask about 30 days ahead. That is a habit, not a statute. Lengthen it when your vendors’ agents miss shorter windows, or when your rule is that work pauses the day a required line lapses.
• Write to a live person at the vendor. If you have the agent’s contact, copy the agent. Last year’s address that now bounces is not a request.
• Say that you need a new certificate naming you, not a reply that says “nothing has changed.”
• When the new file arrives, run the arrival checklist again. A renewal can raise a limit and drop a line, or rename the insured after a sale.
• Keep the prior certificate. The new file does not replace the evidence of what you accepted last period.
• Leave the status at expired, missing, or exception until the review is finished. “The vendor said it’s in process” is a note, not a status.
• If the contract has ended, mark that vendor inactive for that site and stop chasing. Renewal mail to closed contracts trains vendors to ignore you.
• Send the aging list to a person who can pause the work or hold payment, if those are your actual consequences. Name the person in the procedure so the report has a destination.

Mid-term cancellation is a separate problem from the annual date. Some certificates are updated when a policy cancels, and some are not. Do not assume you will be told. A process that only wakes up on the expiration date will miss a cancellation in month three. Whether you also confirm coverage with a broker or carrier is a depth decision. It costs more staff time or more service fees. The pricing guide treats that depth as a cost driver, without quoting a fee.

One vendor, several sites

National and regional vendors reuse one insurance program across your properties. Your requirements may not be identical: a high-rise and a vacant lot, or a routine service contract and a roof replacement, often name different limits and different additional insured parties. File the certificate against each requirement. Accepting “we already have their COI at the other building” is how the stricter job inherits the weaker document.

Ask the agent for a certificate that lists the holder for this property even when the policies are the same. If your standard allows one certificate to evidence several locations, write that standard down and check that this certificate’s description actually covers those locations. Silence in the description is not a list of your buildings.

Vendors and subcontractors

A subcontractor COI is the same kind of document, requested because someone is performing part of a construction contract. The mechanics — request, review, renew, keep the old file — match vendor tracking. The contract language is often stricter: per-project additional insured wording, primary and noncontributory requirements, and a rule that nobody steps on site without an accepted certificate. Completed operations and wrap-up programs add facts this page does not try to settle.

Use the same checklist, and do not pretend a janitorial vendor standard is a subcontract exhibit. If your company does both property vendors and subcontractors, keep two requirement sets. The subcontractor guide covers the project workflow, the request, and the gaps that show up before site access. The contract exhibit is still the source of the limits and the wording. This vendor checklist is the shared filing habit around it.

How long to keep it

People ask how long a vendor COI must be kept. There is no single retention period this site will prescribe. Follow your organization’s records schedule and whatever limitation period counsel gives you for claims arising out of that vendor’s work. A certificate can matter years after the vendor left, because that is when the injury is reported. The operational rule is narrower and immediate: keep the version you reviewed, with the reviewer’s name and date, for as long as the schedule says to keep evidence of the decision. Keeping only the latest PDF fails that test the day a renewal overwrites it.

When the list outgrows the inbox

The checklist above fits a mailbox and a disciplined sheet while one person can see the whole vendor list. It gets brittle when several properties request certificates in parallel, when subcontractors turn over weekly, or when the renewal calendar is a set of personal reminders. That is the point to read how to shortlist COI tracking software and what to ask about price. Those pages name tools other companies sell. They are not a checkout for COI Tracker.

Corrections to this guide: info@coitracker.com. The corrections policy explains what a correction is, and what it is not.