How COI tracking works

COI tracking is a loop, not a filing cabinet

Most people picture COI tracking as saving PDFs to a folder. In practice it is a repeating workflow that starts before a subcontractor sets foot on site and does not end until the policy has renewed past the last day of their work. A certificate of insurance is only accurate the moment it is issued, so tracking exists to keep that proof current as policies renew, lapse, or get cancelled underneath you.

The workflow breaks into seven stages: set requirements, collect the certificate, read the ACORD 25, grade it against your rules, verify the endorsements, monitor expirations, and retain an audit trail. Below is what actually happens at each stage—done by hand versus done by software. If you want the general-contractor operating system for running this day to day, see how to track certificates of insurance; this guide focuses on the mechanics underneath it.

Stage 1 — Set the insurance requirements

Nothing can be verified until you define what "compliant" means. Requirements come from your subcontract and typically vary by trade: a painter carries different exposure than a steel erector. For each vendor type you set minimum limits per line of coverage and the specific endorsements you demand.

• Required coverage lines—general liability, workers’ compensation, auto, and umbrella/excess where the contract calls for it.
• Minimum per-occurrence and aggregate limits on each line.
• Mandatory endorsements: additional insured, waiver of subrogation, and primary and non-contributory.
• How your company must appear as certificate holder and as a named insured on the endorsements.

In software, these requirements become a rule set the system checks every certificate against automatically. On paper, they live in a subcontract nobody rereads at collection time—which is where most compliance gaps begin.

Stage 2 — Collect the certificate

Next you get an ACORD 25 for each subcontractor. Traditionally this means emailing the sub, who forwards the request to their insurance agent, who issues the certificate and emails it back—a chain that routinely takes days and produces lost attachments. Modern tools replace the email chase with a no-login upload link: the sub (or their agent) drops the PDF straight into your system with no account to create.

Stage 3 — Read the ACORD 25 (data entry vs. OCR vs. AI)

Once a certificate arrives, the data has to come off the page: insurer, policy numbers, coverage lines, limits, effective and expiration dates, and the endorsement checkboxes. There are three ways this happens.

• Manual data entry — a person types each field into a spreadsheet. Accurate only if the reader knows the form, and slow at any real volume.
• OCR — optical character recognition pulls raw text off the PDF. It captures obvious fields like policy numbers and dates, but it does not understand the document. Vendors including Jones note that plain OCR tends to break on the ACORD 25’s compressed multi-coverage tables and cannot connect the certificate to its attached endorsement pages.
• AI extraction — models trained on insurance forms preserve the table structure, keep the ACORD 25 tied to its ACORD 101 and endorsement attachments, and read the checkboxes in context rather than as loose text.

This is the stage where automation earns its keep. Wardly reads each ACORD 25 automatically on upload, so no one retypes a certificate to start the review.

Stage 4 — Grade the certificate against your rules

Reading the data is not the same as approving it. Verification compares every extracted field to the requirements from Stage 1 and produces a pass/fail per line: Is workers’ comp present? Does the general liability limit meet your minimum? Has the policy already expired? Manually, this means eyeballing each form against a subcontract—reliable for a handful of subs, error-prone past a dozen.

Software turns that comparison into a single verdict. Wardly grades each certificate A–F against your own requirements, so an F flags an unusable certificate at a glance instead of forcing you to decode a form. A grade also gives your subs a clear target: fix what dropped the score and re-upload.

Stage 5 — Verify the endorsements

The riskiest fields on a certificate are the ones the ACORD 25 only hints at. The form has checkboxes and notes for additional insured, waiver of subrogation, and primary and non-contributory status—but those boxes are marketing until the actual endorsement pages (for example CG 20 10 and CG 20 37 on general liability) confirm the coverage. A checked box with no attached endorsement is a common way certificates look compliant while leaving you exposed.

• Confirm your company is actually named as additional insured on the endorsement, not just the certificate.
• Check that additional-insured status extends to completed operations, not just ongoing work.
• Verify the waiver of subrogation and primary and non-contributory language appears on the policy endorsement, matching your contract.

Stage 6 — Monitor expirations and chase renewals

A certificate that graded an A in January is worthless in July if the policy lapsed in May. This is the stage manual tracking fails most often, because it depends on someone remembering a date. Automated expiration tracking watches every effective and expiration date and fires reminders on a schedule—commonly 60, 30, and 7 days out—to both your team and the subcontractor, so a renewed ACORD 25 is requested before coverage ever gaps.

Stage 7 — Keep an audit trail

The final stage is documentation. When a project owner, lender, or your own carrier audits your risk transfer, you need to show that every subcontractor was verified, when, and by whom—including the certificates you rejected. A good system timestamps each upload, grade, renewal, and status change automatically, so the trail is a byproduct of the workflow rather than a scramble at audit time. Certificates are commonly retained for years after a project to cover latent completed-operations claims.

Manual COI tracking vs. automated: stage by stage

The same seven stages run whether you track by hand or by software—the difference is what has to be done manually at each one.

For a full breakdown of options, see the best COI tracking software comparison, or weigh a spreadsheet against dedicated tools. The workflow above applies equally to general contractors, property managers, and facility managers.