Certificate of Insurance Tracking: 7 Best Practices for Contractors

The best way to track certificates of insurance is to stop relying on a spreadsheet and build a repeatable system: collect every COI before work starts, document your minimum coverage requirements, verify the endorsements (not just the checkbox), track each expiration date with automatic advance alerts, re-collect on renewal, keep everything in one source of truth, and verify the license alongside the insurance. Below are the seven COI tracking best practices that close coverage gaps and keep you ready for an audit.

What does poor COI tracking actually cost?

A certificate of insurance is only useful if it is current and complete on the day a sub is on your jobsite. When tracking breaks down, the failures are quiet right up until they are expensive:

• Coverage gaps. A sub's general liability or workers' compensation policy lapses mid-project and nobody notices, so work continues with no coverage behind it.
• Uninsured claims fall to you. If a sub causes damage or injury and their policy was expired, or you were never actually added as an additional insured, the claim can land on your policy and your loss history.
• Failed insurance audits. At your own policy's audit, missing or expired subcontractor certificates can be reclassified as uninsured exposure and drive up your premium.
• Wasted admin time. Hours spent emailing subs for "the updated COI," re-typing dates into a spreadsheet, and hunting through inboxes for the right version.

The fix is not more diligence on a bad system. It is a better system. Here are the seven practices that make COI tracking reliable.

1) Collect the COI before work starts

The single highest-leverage rule: no certificate, no boots on the ground. Make a compliant COI a condition of the subcontract and of jobsite access, not an afterthought you chase down two weeks in. Once a sub is already working, the leverage to get a clean certificate evaporates.

Tie collection to onboarding. When you set up a new subcontractor, request the ACORD 25, a current certificate of liability insurance, their W-9, and their license number in the same step. If any piece is missing, the sub stays in a pending state until it is complete.

2) Set and document your minimum coverage requirements

You cannot tell whether a certificate is "good enough" if you have never written down what good enough means. Define your minimum requirements in the subcontract and apply them consistently to every sub. Typical requirements a GC documents include:

• Commercial General Liability — minimum each-occurrence and general aggregate limits, including products/completed-operations coverage.
• Workers' Compensation & Employers' Liability — coverage for the sub's employees, or a valid exemption where applicable.
• Automobile Liability — combined single limit for owned, hired, and non-owned autos where the sub drives on the project.
• Umbrella / Excess — if your contract or the project owner requires higher total limits.
• Required endorsements — additional insured and waiver of subrogation in your favor, named explicitly.

3) Verify the endorsements, not just the checkbox

This is where most COI tracking quietly fails. The ACORD 25 is informational. The certificate itself does not amend the policy and does not, on its own, make you an additional insured. The boxes and notes on the form describe coverage; the actual coverage comes from the policy and its endorsements.

So when your contract requires the sub to add you as an additional insured (via an endorsement such as CG 20 10 or CG 20 37) and to include a waiver of subrogation, do not accept a checked box as proof. Confirm the endorsement is actually attached to the policy. For a deeper explanation of the difference, see additional insured vs. waiver of subrogation.

A certificate is a summary, not the policy. "Additional insured" on the ACORD 25 is a claim; the endorsement is the proof. Verify the endorsement, or you may not be covered when it counts.

4) Track expiration dates with advance alerts

Every policy on the certificate has an effective date and an expiration date, and they rarely line up across subs. Tracking expirations by manually scanning a spreadsheet is how lapses happen. The reliable pattern is automatic, layered reminders that fire on their own:

1. ~30 days out — first notice, giving the sub and their agent time to issue a renewal certificate.
2. ~15 days out — reminder if no updated COI has arrived.
3. Day 0 / expired — flag the sub as non-compliant and pause jobsite access until a current certificate is on file.

The target is zero days of uninsured work. That only happens when the alert does not depend on a person remembering to look.

5) Re-collect automatically on renewal

Insurance is a moving target. Policies renew, limits change, carriers switch, and endorsements can drop off at renewal. A COI you verified last year tells you nothing about coverage today. Build re-collection into the cycle so that when a policy expires, the system requests the new certificate, re-checks it against your documented requirements, and re-confirms the endorsements — every renewal, automatically — instead of starting a fresh round of email chasing each time.

6) Centralize in one source of truth

COIs scattered across inboxes, desktop folders, and a shared spreadsheet are impossible to audit. Which version is current? Did the renewal arrive? Who approved it? When the answers live in five places, the honest answer is "nobody knows."

Keep one record per subcontractor that holds the current certificate, the verification result, the W-9, the license status, and the expiration dates — with a history of prior versions. One place to look means you can answer "is this sub compliant right now?" in seconds, and hand a clean file to an auditor without a scramble.

7) Verify the license alongside the insurance

Insurance and licensing are separate checks, and a valid COI says nothing about whether the contractor is licensed to do the work. Verify the license at the same moment you collect the certificate. At Florida's DBPR portal you can confirm:

• The license number is real and the status is current/active — not null, void, delinquent, or expired.
• Whether it is Certified (valid statewide) or Registered (valid only in the county or municipality that issued it).
• The class fits the scope — for example CGC (general), CBC (building), CRC (residential), CAC (air-conditioning), CCC (roofing), CFC (plumbing), or CEC (electrical).
• The expiration date (Florida contractor licenses generally renew on a two-year cycle) and the qualifying agent behind the business.

You can run a check yourself at SubShield's license verification page, and our guide to verifying a Florida contractor license walks through reading the DBPR result. For the full onboarding picture, the subcontractor compliance checklist ties insurance, licensing, and paperwork into one repeatable flow.

Spreadsheet vs. software: which COI tracking approach wins?

A spreadsheet is free and familiar, which is exactly why so many GCs default to it. The problem is what it cannot do. Here is how the two approaches compare against the seven practices above:

The spreadsheet can survive a handful of subs. Across dozens of subcontractors with staggered renewals, the manual gaps compound until something lapses unnoticed.

How should you choose a tracking approach?

Match the tool to your volume and your risk tolerance:

• Just a few subs a year? A disciplined manual process with calendar reminders and a documented requirements template may be enough — as long as you actually verify endorsements and licenses.
• Many subs and staggered renewals? Automate it. The volume that breaks a spreadsheet is exactly where software earns its keep, and one prevented uninsured-sub incident usually covers the cost.
• Facing owner or audit pressure? If a project owner or your insurer expects proof of subcontractor compliance, a centralized, audit-ready system stops being optional.

How SubShield handles all seven automatically

SubShield is built around exactly these seven practices. Upload a subcontractor's ACORD 25 and SubShield's AI reads the certificate, pulls out the coverage types, limits, and policy dates, checks the contractor's license against Florida's DBPR records, stores the W-9, and tracks every expiration date — then sends advance alerts before anything lapses and prompts a re-collect on renewal. Everything lives in one record per sub, so you always know who is compliant today.

See how it fits your operation on the pricing page, or create an account and run your first certificate through it.