TL;DR
Certificate of insurance tracking is the practice of collecting, verifying and monitoring proof that vendors, subcontractors and tenants carry the coverage their contract requires. The common failure is not an expired certificate. It is a valid certificate that confers no protection, because the certificate is an informational document and the endorsement is what actually binds coverage.
Key Takeaways: A COI is informational and grants no rights to the holder. Certificate holder status means you received the document; additional insured status means coverage extends to you, and that requires a policy endorsement. Requirements must be tracked per coverage line rather than per vendor. The failure mode is silence: a shortfall produces no symptom until a loss occurs.
What is certificate of insurance tracking?
Certificate of insurance tracking is the ongoing process of collecting certificates from vendors, subcontractors and tenants, verifying that the coverage shown meets the requirements in their contract, and monitoring that it stays in force for as long as the relationship lasts.
Most certificates arrive on the ACORD 25 form, which lists the named insured, the carriers, each line of coverage, policy numbers, effective and expiration dates, the limits, and the certificate holder and additional insured language.
The work has three parts. Collection: obtaining a current certificate from every counterparty. Verification: checking what it shows against what the contract requires. Monitoring: tracking status across coverage lines so a lapse is caught before it matters rather than after.
Verification is where the value sits, and it is the part most commonly reduced to checking a date.
The distinction that decides whether you are covered
Here is the point that reframes everything else, and it is the most consequential misunderstanding in the subject.
A certificate of insurance is an informational document. It confers no rights on the party holding it.
The ACORD 25 says so on its face. It is evidence that a policy existed on the date of issue. It is not a contract, it does not amend the underlying policy, and receiving one gives you nothing.
Which leads to the distinction that matters:
Certificate holder means your organization received the document. You are on the distribution list. You may receive notice of cancellation, depending on the policy terms.
Additional insured means coverage under the vendor’s policy extends to your organization for claims arising from their work. The vendor’s insurer defends and indemnifies you as well as them.
These are not the same thing, and the gap between them is where organizations discover they are uninsured.
Additional insured status requires a policy endorsement. The box ticked on the certificate face, and the additional insured language in the description of operations, indicate intent. They do not create coverage. The binding document is a separate form issued by the insurer, commonly CG 20 10 for ongoing operations and CG 20 37 for completed operations, and it is frequently never collected.
The same applies to two other provisions contracts routinely require. Waiver of subrogation and primary and non-contributory wording both require endorsements. A tick on the certificate points to them; it does not evidence them.
So the uncomfortable position is this. You can hold a current, unexpired certificate, with limits meeting your contract, naming your entity, and have no coverage at all when a claim arrives, because the endorsement behind it was never issued or never obtained.
Why the failure is invisible
The second property worth understanding is about detection.
The failure mode is silence. Coverage lapses, or falls short of requirement, and nothing happens. No system errors, no process stops, no alert fires. The vendor continues working, invoices continue arriving, and the file shows a certificate on record.
The discrepancy surfaces at exactly one moment: when a loss occurs and the claim is made. At that point the question is no longer administrative. If the vendor had no active coverage, or you were never endorsed as an additional insured, the exposure falls on your own policy, at your deductible and against your claims history.
That is why an expired-certificate problem and an endorsement problem are not equivalent. An expired certificate is at least visible on the document. A missing endorsement is visible only in a document you do not have.
What verification actually requires
A complete check per certificate, against the requirements for that specific counterparty type.
Named insured matches the contracting entity exactly. A mismatch means the policy may not cover the party you actually hired. This is a common defect where vendors operate through related entities or trading names.
Required coverage lines are present. General liability, workers compensation, commercial auto, umbrella or excess, professional or pollution liability where the work calls for it.
Limits meet contract minimums, checked per line: each occurrence, general aggregate, auto combined single limit, umbrella, employers liability.
Policy dates are current for every line. Coverage lines expire independently, which is why a certificate should produce several tracked records rather than one.
Endorsements are evidenced, not asserted. Additional insured, waiver of subrogation, primary and non-contributory, each confirmed on the actual endorsement form rather than on the certificate face.
Carrier is acceptable. Many contracts specify a minimum financial strength rating.
Requirements should also be tiered by risk. A roofing or excavation contractor needs higher limits, umbrella coverage and specific endorsements that a landscaping vendor does not, and applying one standard to both either over-restricts low-risk vendors or under-protects on high-risk work.
Where the work actually goes
Look at the operational reality and the character is clear.
Someone receives a certificate, by email, portal upload, or broker. Someone reads the ACORD form and extracts the coverage lines, limits, dates, named insured and holder details. Someone retrieves the contract to establish what this counterparty was required to carry. Someone compares the two, line by line. Someone determines whether the required endorsements exist, which usually means requesting documents that did not arrive with the certificate. Someone records each coverage line separately with its own expiry. And someone chases renewals ahead of each expiry, since industry guidance suggests requesting a replacement 30 to 45 days before a policy lapses.
Then it repeats, per vendor, per coverage line, continuously.
Almost none of this is risk judgment. It is reading a standardized form, retrieving a contract, and comparing them, at a volume that scales with vendor count multiplied by coverage lines multiplied by renewal frequency.
Which is why spreadsheet-based tracking is commonly reported to achieve only partial compliance. Not because the method is wrong, but because the volume exceeds what manual comparison sustains, and the parts that get skipped are the endorsement checks, since they require chasing a document rather than reading one.
Where automation fits
Because the constraint is reading documents and comparing them against contractual requirements, that is where automation changes the position.
Automation that can read unstructured documents and reason about their contents can extract the coverage lines, limits, dates and named insured from an ACORD form whatever condition it arrives in, retrieve the applicable requirements from the governing contract, compare them line by line, identify which endorsements the contract requires and whether evidence of each has actually been received, and maintain expiry tracking per coverage line rather than per certificate.
The shift worth noting is from date tracking to requirement tracking. Monitoring expiry is a calendar problem that software has handled for years. Establishing whether this certificate satisfies this contract, including the endorsements the contract demands, is a document comparison problem, and it is the part that gets skipped.
Because these determinations decide whether a vendor is permitted to work and whether your organization is protected, each one needs to be traceable to the clause it was checked against and the document that evidenced it. A compliance status nobody can substantiate is the same position as no check at all, discovered at the same moment.
To be clear about scope, Kognitos is not a COI tracking platform. It does not provide vendor portals, issue renewal reminders, or replace the dedicated systems that manage certificate collection and storage. What it addresses is the verification layer underneath: reading certificates and contracts, comparing requirement against evidence, and producing a documented position on each counterparty.
For related processes, see our guides on vendor onboarding automation, contract lifecycle automation, internal controls, first notice of loss, and master data management. To see how deterministic AI compares documents against contractual requirements with a full audit trail, book a demo or try the platform.
Getting started
Two checks, neither requiring new software.
Take twenty vendors whose contracts require additional insured status and ask for the endorsement. Not the certificate, the endorsement form. The proportion you cannot produce within a day is your actual coverage gap, and it is almost always larger than the expired-certificate count everyone tracks.
Count your tracked records against your coverage lines. If you hold one record per vendor rather than one per coverage line, your expiry monitoring is incomplete by construction, because general liability, auto and workers compensation renew on different dates and a single date field can only reflect one of them.
