What Is COI Tracking?

A working definition

COI tracking, also called certificate of insurance tracking, is the repeatable process of collecting certificates of insurance from vendors, subcontractors, or other third parties; verifying those certificates against your requirements; monitoring renewals so a required line does not lapse unnoticed; and reporting status to the people who can act on a gap.

The phrase covers a system of record, not a one-time download. A certificate that was acceptable in March can be the wrong document in April if the policy ended, the named insured changed, or the vendor started work under a different contract with different limits. Tracking is how you know which document you relied on, for which party, at which site or project, and what happens next.

Teams also call the same work COI management, certificate tracking, or insurance compliance administration. The words overlap. On this site, “tracking” means the operating cycle below. Shopping for tools is a separate decision, covered in the software shortlist guide and the pricing explainer.

The certificate is not the policy

A certificate of insurance is a summary an agent or broker prepares for someone other than the policyholder. In the United States, many liability certificates use the ACORD 25 layout. The form typically identifies the named insured, the insurers, policy numbers, coverage types, limits, and effective and expiration dates. It may also name a certificate holder and include a description of operations or a remark about additional insured status.

That summary is useful because the full policy is long and the vendor may not hand it over. It is also incomplete. The policy, including endorsements, is the insurance contract. A remark typed on a certificate can describe an endorsement that was never issued, or it can omit one that was. If your agreement requires a specific endorsement, treat the certificate as a prompt to collect that form, unless your broker or counsel has told you the certificate wording is enough for that agreement.

Three labels get mixed together:

Named insured. The person or company the policy is written for. On a vendor COI, this should be the party you contracted with, not a similarly named affiliate, unless your contract allows the affiliate’s policy.
Certificate holder. The party the certificate was issued to inform. Being the holder means you were sent the summary. It does not, by itself, make you an insured on the policy.
Additional insured. A status the policy or an endorsement grants to another party, if the policy provides for it. Whether you need that status is a contract question. Whether you have it is an insurance question. The certificate is only a place people look for a clue.

How to read a certificate walks the fields. The vendor COI guide covers the request and the arrival check in operating terms. The subcontractor guide is the project version.

Collect, verify, renew, report

The cycle is the same in a ten-row spreadsheet and in a large vendor-compliance program. Software changes who does each step and how visible the misses are. It does not rename the steps.

Collect

Collection is the request plus the filing. You decide which contract, property, or project the certificate belongs to, who must send it, and where it will land so the next person can find it. The sender is often the vendor’s agent, not the vendor’s office manager. The request fails when it goes to a generic inbox, when two properties use two different requirement sheets and nobody says which one applies, or when the file comes back named certificate.pdf with no vendor and no site.

A practical request covers who you are, the site or project, the legal name you expect as the named insured, who should be listed as certificate holder, the coverage lines the contract already names, a due date before work starts, and one monitored address for the reply. Wording you can adapt is in the vendor request section. It is an illustration, not a form approved for every contract.

Verify

Verification is a comparison, not a receipt. Someone checks the document against the requirement set for that vendor and that job. At minimum, the comparison asks whether the named insured matches, whether each required line is present, whether the dates cover the period you care about, and whether the certificate holder is the party that should have been notified. If the contract calls for particular limits, additional insured status, a waiver of subrogation, or primary and noncontributory wording, those items are part of the same review. This page does not supply the limits or the wording. Your contract does.

Depth varies, and the depth is the main difference between “we track COIs” and “we reviewed them.” Storing the PDF is one depth. A person reading it against a checklist is another. Asking the agent for the endorsement, or confirming information with the insurer or broker, is another. Automated extraction can pre-fill dates and limits from a scan. It can also misread a fax. Whatever method you use, write down the result and the reviewer’s name. A blank “compliant” cell with no date is not a review.

Renew

Renewal tracking watches end dates and starts the next collection before a required line expires. General liability, automobile, workers’ compensation, and an umbrella can end on different days. One date per vendor hides that. The date that matters is the earliest end date on a line you actually require for that contract.

A common habit is to request the replacement about 30 days before that date. That is an operating lead time, not a legal notice period. Use longer when agents are slow or when your rule is that work stops the day coverage lapses. The renewal is not finished when the vendor replies “it’s coming.” It is finished when the new certificate has been reviewed against the same requirements and the prior file is still in the record.

Report

Reporting is a list someone can use: accepted, exception, expired, requested but missing, or inactive because the contract ended. The audience might be a project manager who can keep a subcontractor off the site, a property manager who can hold a vendor, an owner or lender who asked for evidence, or accounts payable if your rule is that you do not pay a vendor with an expired certificate. Pick the person. A report addressed to “the team” does not create a next action.

Good reporting also preserves history. If an auditor asks what you accepted last March, the answer is the file you reviewed then, not whatever PDF replaced it in November. Overwriting the only copy destroys the evidence of the review.

What a review has to decide

You can track certificates without a product. You cannot track them without a requirement. Before the first request, write down, for each contract type you actually use:

Which lines you require. Common examples in commercial contracts include commercial general liability, automobile liability, workers’ compensation, umbrella or excess liability, and professional liability when the work is advisory. Your contracts may name a different set. Do not copy this sentence into an agreement.
The limits those contracts already state. This site will not invent numbers.
Whether you require additional insured status, a waiver of subrogation, or other endorsement language, and whether you accept a certificate remark or require the endorsement form.
Who the certificate holder must be, including the legal name and address.
Who may accept an exception in writing, and who may not.

Status labels should describe decisions, not optimism. A usable set is: not requested, requested, received, exception, accepted, expired, waived in writing, and inactive. Color alone is not a status. Green with no reviewer and no date will be wrong the week someone is out.

Why spreadsheets fail

A spreadsheet is a reasonable system when one person owns a short, stable list and one requirement set. It fails in predictable ways once the list or the number of editors grows. The failures are operational, not a moral argument for buying software.

One row, many dates. A single expiration column cannot represent four policies. The column usually holds whichever date someone noticed.
Hand entry from a bad scan. A 2026 date typed as 2025, or a limit copied from the wrong column, becomes the record everyone trusts.
The chase address dies. Last year’s agent left. The reminder still goes to that mailbox. The vendor hears nothing.
The file is replaced. The renewed certificate overwrites the PDF you produced for an owner six months ago. You can no longer show what you accepted.
The requirement is implied. Project A and building B use different limits, but the sheet has one “COI on file” column. Both look done.
The reminder is disconnected. A calendar invite does not know whether the new certificate arrived, so people either nag a vendor who already complied or assume a silence means the renewal happened.
Status is typed, not evidenced. Someone enters “yes” because the vendor promised to send it. The cell survives after the promise does not.
Three copies. The property manager, the broker, and accounts payable each keep a version. None of them is current on the same day.

The spreadsheet guide lists the columns and the date formulas, including how a blank expiration gets hidden. A downloadable workbook is not posted yet. Move off the sheet when more than one person updates it, when required lines expire on different dates, or when a missed week would put an active vendor on site without a current review. There is no universal vendor-count at which a spreadsheet becomes “wrong.” That cutoff is something vendors of software sometimes imply. We are not supplying one.

A minimum way to track

This is a manual control, suitable until volume or handoffs make it unreliable. It is also the checklist you can use to judge a tool later: if the software cannot represent these facts, the dashboard is not tracking.

One written requirement set per contract type, owned by someone who can change it when the contract form changes.
One record per vendor per requirement set. The same cleaner on two properties with two different limits is two records, or one vendor record with two requirement lines. It is not one row that pretends the stricter limit applies everywhere.
Fields you can actually fill: vendor legal name, site or project, who you asked, date requested, date received, expiration of each required line, status from the list above, reviewer, and the next action.
One intake point. A dedicated mailbox or an upload folder beats certificates scattered across personal inboxes.
A recurring review. Weekly is sane when subcontractors turn over with the job. Monthly can be enough when the vendor list is stable and policies renew annually. The cadence is yours. Skipping the review is what creates the surprise.
A rule for work that starts before the document arrives. Record the gap. Do not backdate an “accepted” status across days you had no certificate.
Retention of the file you reviewed. How many years to keep it is a records question for counsel and your retention schedule. This guide will not give you a number of years. Keep the reviewed copy, not only the newest file, for as long as your schedule says the claim or audit window is open.

Who needs this

You need a tracker when you are accountable for someone else’s insurance and the list will not fit in one person’s memory. Typical situations, not a survey:

A property or facility team that requires COIs from janitorial, security, elevator, roofing, landscaping, or other on-site vendors.
A general contractor or construction manager collecting subcontractor certificates before site access, often with project-specific wording on top of the vendor’s annual policies.
Procurement or vendor management, where insurance is one item in onboarding and the rest of onboarding already has an owner.
A risk manager who is asked for a portfolio view after an incident, a lender request, or an audit.
A school, campus, hospital, or public agency that lets outside contractors work on the grounds.

The vendor who is asked to produce the certificate has a different job: contact their agent, make sure the holder and any requested wording match the contract, and send it to the address in the request. If that is you, start with the contract you signed and your broker. The vendor COI page describes what the requesting organization is usually trying to collect, which can make their email less mysterious. It is not a guide to buying your own policy.

What tracking does not do

It does not place coverage or change a premium.
It does not prove the insurer will pay a particular claim. Exclusions, conditions, and the facts of the loss live in the policy and the claim, not in the tracking status.
It does not replace reading an endorsement when the contract says the endorsement is required.
It does not make a waived exception disappear. A written waiver is a decision. It should show who accepted the gap and for how long.
It does not, by itself, pick a software product. “Automated COI tracking” in a product ad can mean reminder emails, document extraction, a human review service, carrier monitoring, or some mix. Ask which one. The comparison guide lists that question with the other criteria.

Questions people ask

Is COI tracking the same as reading one certificate?

No. Reading one certificate is a review. Tracking is the system that makes the next review happen, stores the last one, and tells someone when a vendor is missing. A company can be good at reading a PDF and still have no idea which of its 200 vendors expires this month.

Is a certificate proof the vendor is insured?

It is evidence of what the agent reported on that date. Policies cancel, limits erode, and certificates are sometimes wrong. Tracking plus a defined review reduces the chance you are holding an outdated summary. It is not a coverage opinion.

Do we need software?

Not as a first principle. You need an owner, a requirement set, a single place the files land, dates for each required line, and a status that matches the evidence. Software or a tracking service is worth pricing when those controls are already breaking in the ways described above. How vendors charge is covered in COI tracking software pricing. COI Tracker does not sell that software.

How long is a certificate good for?

For as long as the underlying policies remain in force and the certificate still describes them, and only for the parties and locations it actually names. The expiration dates on the certificate are the dates to track. A certificate does not gain an extra year because the PDF is still in the folder.

What is COI tracking?