Guide

COI tracking checklist

By Daniel Siryakov, Founder · Updated July 8, 2026

A COI tracking checklist walks you through five phases: (1) set your insurance requirements and contract language, (2) collect a certificate from every subcontractor and vendor, (3) verify each ACORD 25 against your rules, (4) monitor and renew before expiration, and (5) keep an audit trail. Work each phase in order and no uninsured sub slips through.

How to use this checklist

This is the operational checklist for tracking certificates—the repeatable process you run on every subcontractor and vendor, from the day you set your requirements to the day the job closes out. If you first need to decide *what* coverage to require (limits, coverage lines, and endorsement language), start with subcontractor insurance requirements. Once you know your requirements, this checklist is how you make them stick.

Work the phases in order. Each one has a short list of line items you can tick off. Phases 1–2 happen once per sub at onboarding; phases 3–5 repeat every time a new certificate of insurance comes in and every renewal cycle thereafter.

The five phases at a glance

1. Set requirements & contract language. 2. Collect certificates from every sub and vendor. 3. Verify each ACORD 25 against your rules. 4. Monitor & renew before expiration. 5. Keep an audit trail. Do all five, consistently, and a lapsed or non-compliant policy never becomes your liability.

Phase 1 — Set requirements & contract language

You cannot verify a certificate against requirements you have not written down. Before you collect a single COI, lock in exactly what compliant looks like—and make sure your subcontract obligates every sub to meet it. This is the phase everyone skips, and it is the reason most tracking programs quietly fail.

Define minimum limits for each coverage line—general liability, auto, workers’ compensation, and umbrella/excess—including the per-occurrence and aggregate limit you require.
Specify required endorsements in writing: additional insured, waiver of subrogation, and primary and non-contributory status.
State that these must be evidenced by an actual endorsement (e.g. CG 20 10 / CG 20 37 for additional insured), not just a note in the ACORD 25 description box.
Write the exact legal name and address that must appear as the certificate holder—your company, spelled the way it appears on the contract.
Put an insurance exhibit in the subcontract requiring a compliant COI before mobilization, and 30 days’ notice of cancellation where obtainable.
Decide your minimum acceptable carrier rating (many contractors require an A.M. Best rating of A- VII or better).

Phase 2 — Collect a certificate from every sub and vendor

The goal of this phase is complete coverage of your roster—one current certificate on file for every party doing work, with none missing. The hardest part is not the first certificate; it is chasing the subs who go quiet.

Build a master list of every subcontractor and vendor on the project, so you know exactly whose certificate you are waiting on.
Request the COI from each sub’s insurance agent or broker—brokers issue the ACORD 25, and asking them directly avoids a game of telephone.
Send your requirements with the request so the certificate comes back right the first time, with the correct endorsements attached.
Give subs a frictionless way to submit—a no-login upload link beats an email thread that gets buried.
Log the request date and set a follow-up so no sub sits in “requested” limbo for weeks.
Block mobilization for any sub without a verified certificate on file—a rule with no teeth gets ignored.

Phase 3 — Verify each ACORD 25 against your rules

This is the heart of tracking. A certificate that is merely filed is worthless; a certificate that is *verified* is proof. Read every ACORD 25 field by field and check it against the requirements you set in Phase 1.

Certificate basics

The insured name exactly matches the legal entity on your subcontract—not a trade name, parent company, or affiliate.
Every policy line shows a policy number and a named insurer with an NAIC number.
The certificate is on a current ACORD form and dated recently (treat anything over 30 days old as potentially stale).

Coverage types & limits

Every coverage line you require is present—general liability, auto, workers’ comp, and umbrella/excess where applicable.
Each limit meets or exceeds your contract minimum, including the general-liability aggregate and products-completed operations.
If an umbrella is being used to reach your limit, confirm it sits over the correct underlying policies.
Workers’ comp shows no owner/officer exclusions that would leave working principals uncovered.

Endorsements

Additional insured status names your company and is backed by an endorsement form, not just a checkbox or a line in the description box.
Waiver of subrogation is in favor of your company where your contract requires it.
Primary and non-contributory language is confirmed by endorsement for the general-liability policy.

Dates & holder

Every required coverage line is active today and its expiration date covers the sub’s full scope of work.
The certificate holder box lists your company with the exact name and address from Phase 1.
No coverage line is expired, and none was issued with a future effective date.

Grade, don’t just file

Reduce every verification to one status per sub: compliant, expiring, or non-compliant. A red flag—expired dates, a mismatched insured name, a missing endorsement, or limits below your minimum—means request a corrected certificate before the sub works. COI grading turns this judgment call into a consistent A–F score.

Phase 4 — Monitor & renew before expiration

A COI is only accurate the day it is issued. A sub who is fully insured in January can be uninsured by June. This phase is what keeps every certificate current for the entire time the sub is on your job—the difference between one-time verification and real tracking.

Record every policy’s expiration date the moment you verify the certificate.
Set staggered reminders ahead of each expiration—60, 30, and 15 days is a common cadence for slower-responding subs.
Request the renewal certificate before the old one lapses, then re-run Phase 3 verification on the new document.
Flag any coverage gap between the old expiration and the new effective date—even a one-day lapse is exposure.
Watch for mid-term cancellations, not just expirations, since a policy can be cancelled long before its printed end date.

Manual reminders in a calendar or spreadsheet work for a handful of subs but break down at scale. Automated expiration tracking watches every date for you and nudges the sub before anything lapses.

Phase 5 — Keep an audit trail & reporting

When an owner, a lender, your insurer, or opposing counsel asks whether a specific sub was insured on a specific date, you need to answer in seconds—with the document to back it up. That is what the audit trail is for.

Store every certificate in one searchable place, keyed to the sub and the project—not scattered across inboxes and drives.
Keep the full history: superseded certificates, renewals, and the dates each was received and verified.
Record who verified each certificate and when, so compliance is accountable, not anecdotal.
Document exceptions and any remediation—what was non-compliant, what you requested, and when it was resolved.
Be able to produce a current compliance report showing which subs are compliant, expiring, or non-compliant at a glance.
Retain expired certificates; a claim can surface years later and you will need proof of coverage as it stood at the time.

Wardly is free COI tracking software for general contractors: send subcontractors a no-login upload link, get an automatic A–F grade on every certificate, and let Wardly watch every expiration date. See the best COI tracking software comparison or explore the features.

General information, not legal or insurance advice.

Frequently asked questions

What should be on a COI tracking checklist?

A complete COI tracking checklist covers five phases: setting your insurance requirements and contract language; collecting a certificate from every subcontractor and vendor; verifying each ACORD 25 for coverage types, limits, endorsements, dates, and the certificate holder; monitoring expirations and requesting renewals before coverage lapses; and keeping a searchable audit trail of every certificate you have verified.

What do you check when verifying a certificate of insurance?

Confirm the insured name matches your contracted entity, every required coverage line is present at or above your minimum limits, required endorsements (additional insured, waiver of subrogation, primary and non-contributory) are documented by endorsement rather than just noted, all policy dates are active and cover the scope of work, and your company appears as the certificate holder with the correct name and address.

How often should I re-verify a subcontractor’s COI?

Re-verify at every policy renewal—most commercial policies renew annually, so at minimum once a year per coverage line. Because a policy can also be cancelled mid-term, the safer practice is continuous monitoring: watch every expiration date and request a fresh certificate before the old one lapses, then run the same verification checklist on the renewal.

What are the red flags on a certificate of insurance?

Reject and request a corrected certificate for expired policy dates, a named insured that does not match your contract, a missing required coverage line, limits below your minimum, a blank or wrong certificate holder, or a non-ACORD form. Follow up before deciding when endorsement documents are missing, a claims-made policy lacks a retroactive date, an umbrella does not sit over the right underlying policies, or the certificate is more than 30 days old.

Is a note on the ACORD 25 enough to prove additional insured status?

No. The description box on an ACORD 25 is not the coverage itself—it only describes it, and the form’s own disclaimer says it confers no rights. Additional insured, waiver of subrogation, and primary and non-contributory status must each be evidenced by the actual policy endorsement. Always require the endorsement forms, not just a line in the description.

Can a spreadsheet handle COI tracking?

A spreadsheet can hold a list of subs and expiration dates, which is enough for a handful of vendors. But it cannot read an ACORD 25, cannot flag a missing endorsement or a limit below your minimum, and will not warn you before a policy expires. Once you are past roughly 15 subs, dedicated COI tracking software automates the collection, verification, and expiration monitoring the checklist calls for.

Keep reading

More COI tracking guides for general contractors.

Run the whole checklist automatically—for free.

Wardly collects certificates from a no-login link, reads every ACORD 25, grades it A–F against your requirements, and watches every expiration date so nothing lapses. Free forever, unlimited subs.

Get started free