COI Tracking for Commercial Buildings: The Practical Guide

Every commercial building runs on vendors: elevator crews, HVAC contractors, janitorial teams, fire-protection techs. Every one of them carries insurance, and every one of those policies expires. Certificate of insurance (COI) tracking is the discipline of knowing, at any moment, that everyone working in your building is covered.

It sounds administrative. It is one of the highest-leverage risk controls a property team owns, and one of the most commonly neglected.

What a COI certifies

A certificate of insurance is a one-page summary issued by a vendor’s broker showing active policies: commercial general liability, workers’ compensation, auto, umbrella. For building work you should expect to see your ownership entity named as additional insured, limits that match your lease or vendor agreement, and effective dates that cover the work period.

The certificate is only evidence of the policy, not the policy itself, and evidence goes stale without telling anyone. That is why tracking matters.

Why spreadsheets fail at this

• Expiry dates don’t announce themselves. A spreadsheet holds a date that passed four months ago without a word.
• Volume compounds. Thirty vendors × three policies each is roughly a hundred renewal events a year to catch by eye.
• The tracker leaves. COI spreadsheets are personal systems; the habit walks out with the person who kept it.
• No connection to access. The spreadsheet can be perfectly current and the uninsured vendor still walks in, because the sheet and the door don’t talk.

What good COI tracking looks like

Whether you buy software or build process, these are the requirements that matter:

• Certificates live on the vendor record instead of a shared drive folder, with coverage types, limits and dates stored as fields, not just as a PDF.
• Notifications fire before expiry: to the vendor to re-submit and to your team to chase, on a schedule (30/14/7 days) instead of from memory.
• Status is visible where work is dispatched. Whoever assigns the work order sees compliance next to the vendor’s name.
• Access depends on compliance. A lapsed policy should hold building access until someone deliberately overrides it, so a lapse is a decision someone made and never an accident.
• The audit trail writes itself. When counsel or the carrier asks, the answer is an export.

The tenant side

Vendor COIs get the attention, but tenant insurance obligations sit in every lease, and they lapse just as easily. The same tracking discipline applies: structured records, end-date notifications, and renewal requests that send themselves before the lease team ever notices a gap.

Where BuildingHub fits

Smart Record Storage in Operations Hub was built exactly for this: every certificate tracked with expiry alerts, compliance status beside the vendor wherever work is assigned, and vendor access tied to coverage, all in the same system that runs your work orders. Compliance stops being a memory exercise.