COI Tracking Best Practices: 10 Rules That Prevent Costly Lapses

After tracking 2,000+ vendor certificates across 150+ properties, these are the practices that separate teams that stay compliant from teams that get surprised by uncovered claims.

Most COI compliance failures aren't caused by bad intent, they're caused by bad process. A vendor's policy lapses because nobody set a renewal reminder. A claim happens and you discover your organization was never listed as additional insured. A spreadsheet gets outdated and nobody notices until the audit.

These 10 best practices close those gaps. They're based on what consistently works across property management portfolios, construction projects, and facilities management programs.

1. No Work Starts Without a Compliant COI on File

This is the non-negotiable foundation of any COI compliance program. Make it an absolute rule: no vendor performs work on your property or project until you have a current, compliant COI on file, reviewed and approved.

"They said they have insurance" is not a COI. A certificate issued last year for a policy that's since lapsed is not compliant. A verbal assurance from a vendor you've worked with for a decade is not protection. The rule applies to every vendor, every time, no exceptions.

Build this into your vendor onboarding workflow. Don't schedule work until you have the COI. Your team needs clear authority to say "we can't start until we have your certificate."

2. Standardize Your Insurance Requirements by Vendor Type

Don't invent requirements from scratch for every new vendor. Create requirement templates by vendor category, reviewed by your attorney and insurance broker:

  • General trades (plumber, electrician, HVAC): GL $1M/$2M, WC statutory, Auto $1M, Additional Insured, Waiver of Subrogation
  • High-risk trades (roofer, structural work): GL $2M/$4M, WC statutory, Umbrella $2M, Additional Insured, Waiver of Subrogation
  • Professional services (engineers, consultants): GL $1M/$2M, Professional Liability $1M, Additional Insured
  • Low-risk vendors (cleaning, landscaping): GL $1M/$2M, WC statutory, Additional Insured

Having these templates defined means anyone on your team can verify a COI against the right requirements, without calling you or making judgment calls in the moment.

3. Verify Additional Insured Status on Every Certificate

Additional insured status is the single most commonly missed item on COI reviews. A vendor can have excellent coverage limits and current policies, but if you're not listed as additional insured, you're not protected under their policy.

Look for your organization's exact legal name in the "Description of Operations / Locations / Vehicles" box on the ACORD 25 form, or on a separate Additional Insured endorsement attached to the certificate. A blanket "as required by contract" notation may or may not be sufficient depending on your jurisdiction, verify with your attorney.

Require additional insured status on General Liability, Auto Liability, and Umbrella policies. Workers' Compensation doesn't have additional insured endorsements, instead, require a Waiver of Subrogation on WC.

4. Set Expiration Alerts at 30, 14, and 7 Days

The most common COI lapse scenario: a certificate expires, nobody notices, work continues, and you only find out when there's a claim. Prevent this with a tiered alert schedule:

  • 30 days out: Send a renewal request to the vendor. Give them plenty of time to contact their broker and get a new certificate issued.
  • 14 days out: Follow up if no renewal has been received. Escalate internally if the vendor is active on your property or project.
  • 7 days out: Final reminder. If no renewal is received by expiration, pause the vendor's access or work until a compliant COI is on file.

If you're doing this manually, it requires calendar reminders for every vendor, a workflow that breaks down quickly at scale. COI tracking software automates this entire process, sending alerts automatically at each threshold.

5. Store COIs Centrally, Not in Email

Certificates stored in individual email inboxes are certificates that will get lost. When staff changes, when the email client crashes, when someone needs to pull a COI for an audit at 4pm on a Friday, scattered storage creates crises.

Use a central, searchable system for COI storage. This can be:

  • A shared cloud folder (Google Drive, Dropbox, SharePoint) organized by vendor, better than email, but requires manual organization
  • A dedicated COI tracking spreadsheet with a naming convention and linked file paths, works for small portfolios
  • COI management software, the most reliable option; stores the certificate alongside the extracted data, compliance status, and audit trail

Whatever system you use, make sure every team member knows where to find COIs and how to file new ones.

6. Verify the Certificate Holder Information

The certificate holder field matters more than most people realize. If your organization is listed as the certificate holder, you'll receive notice of cancellation if the vendor's policy is cancelled mid-term. If the field is blank, incorrect, or lists a previous property management company, you lose that protection.

Make sure your full legal entity name and correct mailing address appear in the certificate holder section of every COI you accept. If you manage properties for multiple owners, decide whether the certificate holder should be the management company or the property owner, and be consistent.

7. Require Waivers of Subrogation Where Your Contracts Demand Them

A waiver of subrogation prevents the vendor's insurer from pursuing your organization after paying a claim. Without it, your insurance could still be drawn into a claim even after the vendor's insurance pays, increasing your premiums and legal costs.

Review your standard vendor contracts. If they require waivers of subrogation, and most well-drafted contracts do, verify that the endorsement appears on every required policy type (typically GL, WC, and sometimes Auto).

8. Do a Full Portfolio Audit Quarterly

Don't just rely on expiration alerts. Once a quarter, pull a full list of all active vendors and their COI status. Look for:

  • Vendors with COIs expiring in the next 90 days
  • Vendors who are active but whose COI file is outdated
  • Vendors who have been added to your system without a COI on file
  • Vendors whose coverage limits no longer meet your current contract requirements

A quarterly audit catches the gaps that individual expiration alerts miss, vendors who changed insurers, added or dropped coverage types, or whose policy conditions changed mid-term.

9. Use a Vendor Portal for Self-Service Uploads

The most time-consuming part of COI management is the email back-and-forth: "Can you send me your COI?" "I'll have my broker send it." "We got an email but can't open the attachment." "Can you resend to a different address?"

A vendor self-upload portal eliminates this. You send the vendor a link. They upload their certificate directly. You get a notification and the COI is in your system. No email attachments, no manual downloads, no forwarding. For teams tracking 20+ vendors, this alone saves hours per week.

10. Automate What You Can, But Don't Outsource Judgment

COI tracking software automates the repeatable parts: data extraction, expiration alerts, compliance status tracking, vendor reminders. This is where most time is saved.

But some decisions still require human judgment: accepting a certificate with a lower limit than required because the vendor is mid-project, evaluating whether an additional insured endorsement is worded correctly, deciding whether to pause a vendor's access when their policy lapses the day before a critical deadline.

Use software to handle the volume. Keep humans in the loop for exceptions and judgment calls. The goal is a process where your team spends time on decisions, not on data entry and calendar management.

Tools to Implement These Best Practices

If you're implementing these practices from scratch, here are the tools to start with:

  • For small teams (<10 vendors): Start with our free COI requirements checklist and COI tracking spreadsheet template. Set calendar reminders manually for each expiration.
  • For growing teams (10 to 100 vendors): COI File automates expiration alerts, AI extraction, and compliance dashboards. All plans include a 7-day free trial; Base starts at $39/month for up to 10 vendors.
  • For enterprise portfolios (100+ vendors): Evaluate enterprise platforms like myCOI or Jones for advanced workflows and integrations.

For a full comparison of COI tracking software options, see our best COI tracking software guide.

Frequently Asked Questions

Collect a new COI before each new project or contract and whenever the existing certificate is within 30 days of expiration. For ongoing vendors, review the entire vendor list quarterly and send renewal requests 60 days before each anniversary date. Never accept verbal assurances that coverage is still in place, require a current COI on file at all times.
The most common and costly COI mistakes: (1) Allowing vendors to start work before a COI is on file, (2) Not verifying that your organization is listed as additional insured, (3) Accepting expired certificates, (4) Not checking coverage limits against your contract requirements, (5) Storing COIs in email without a tracking system, (6) Failing to collect renewal COIs before existing ones expire.
The most reliable approach is COI tracking software with automated expiration alerts, it sends email reminders at 30, 14, and 7 days before expiration without any manual effort. For small portfolios (under 10 vendors), a spreadsheet with conditional formatting can work if someone checks it weekly. The worst approach: relying on memory or email reminders that get buried.
Require COIs from every vendor that performs work on your property or project, regardless of size. A solo handyman with no workers' comp can expose you to just as much liability as a large contractor if they're injured on your property. Set a blanket policy: no work starts without a compliant COI on file.
Stay firm. Make COI requirements a non-negotiable condition of your contract. If a vendor can't meet your insurance minimums, they either need to obtain appropriate coverage (cost them money) or they're not the right vendor for your project. The liability exposure from working with an uninsured or underinsured vendor is far greater than the cost of finding a compliant alternative.
Most certificates of insurance include a clause that says the insurer will notify the certificate holder if the policy is cancelled, but this is not always reliable. The best practice is to use a vendor portal where vendors update their COIs proactively, combined with tracking software that flags missing or expired certificates automatically. Don't rely solely on insurer notifications.
F

Firdaosh Bano

COI Compliance Specialist

Firdaosh Bano is a COI compliance specialist and the founder of COI File. She spent 6 years managing vendor compliance for commercial properties - tracking 2,000+ COIs across 150+ properties in spreadsheets before building the tool she wished she'd had. She writes about certificate of insurance compliance, vendor risk management, and making insurance tracking less painful for small teams.

Ready to simplify your COI tracking?

Join property managers and contractors who are ditching spreadsheets for good.

Start Base Trial →