Collecting an ACORD 25 Certificate of Insurance at onboarding is useless if that certificate quietly expires six months into a construction or service contract. Here is how risk managers automate vendor renewals.
Hamza
Co-Founder & Operations Lead
In enterprise procurement, facilities management, and construction subcontracting, requiring third-party vendors to provide a Certificate of Insurance (COI) is universal standard operating procedure. When an HVAC technician, electrical contractor, cleaning crew, or logistics carrier is onboarded, the procurement clerk collects an ACORD 25 (Certificate of Liability Insurance) PDF, saves it in a vendor folder, and marks the vendor "Compliant."
That standard process creates a massive corporate liability gap. Commercial insurance policies are written for 12-month policy periods. Because vendors are onboarded throughout the calendar year, their insurance policies expire at random intervals: some in March, others in August, others in November.
Within six months of onboarding, an estimated 35% to 45% of an enterprise's vendor base is operating with lapsed or unverified insurance. If a subcontractor causes a major facility flood, structural fire, or personal injury after their policy expiration date, your corporate general liability policy is forced to absorb the primary loss, driving up your deductible expenses and future insurance premiums by hundreds of thousands of dollars.
A compliant ACORD 25 form contains critical data columns that must be independently tracked and validated:
| Insurance Coverage Type | Required Standard Limit | Mandatory Tracking Check | Common Vendor Deficiency |
|---|---|---|---|
| Commercial General Liability (CGL) | $1,000,000 Occurrence / $2,000,000 Aggregate | Policy Effective & Expiration Date; Occurrence Form verified | Aggregate applies "Per Policy" instead of "Per Project / Location" |
| Automobile Liability | $1,000,000 Combined Single Limit (CSL) | "Any Auto" (Symbol 1) checked | Only "Scheduled Autos" checked, excluding rental or newly acquired trucks |
| Workers' Compensation & Employers' Liab. | Statutory Limits / $500,000 / $500,000 | Mandatory for any vendor with employees on your premises | Vendor operates with sole proprietor exemption despite bringing 1099 laborers on-site |
| Excess / Umbrella Liability | $2,000,000 to $5,000,000+ | Follow-Form over primary CGL and Auto | Umbrella terms do not sit directly over underlying auto or employers liability |
The single greatest misconception in third-party risk management is relying solely on the "ADDL INSD" checkbox on an ACORD 25 form. Look at the fine print at the top of every ACORD certificate:
"This certificate is issued as a matter of information only and confers no rights upon the certificate holder. If the certificate holder is an ADDITIONAL INSURED, the underlying policy must be endorsed."
If you do not obtain a copy of the actual Additional Insured Policy Endorsement (such as ISO Forms CG 20 10 for ongoing operations and CG 20 37 for completed operations), the insurance carrier has no legal obligation to defend your company. When a claim is filed, the insurer will point to their policy declarations, proving that the certificate was merely an unauthorized broker summary.
Historic versions of the ACORD 25 form included language stating that the insurer would "endeavor to mail 30 days written notice" to the certificate holder if the policy was cancelled prior to expiration. Modern ACORD forms have completely removed this commitment.
The form now states that notice of cancellation will be delivered only "in accordance with the policy provisions." Unless an explicit Notice of Cancellation Endorsement is attached requiring the carrier to notify certificate holders in writing, a vendor can pay their initial down payment, obtain a clean COI, cancel their policy for non-payment thirty days later, and continue working on your property completely uninsured for the remaining eleven months.
Manually reviewing hundreds of vendor insurance folders in shared drives guarantees that policies will lapse. High-performing risk teams automate the renewal outreach cadence directly to the vendor and their listed insurance broker:
By centralizing vendor contracts, COI policy expiration dates, broker emails, and mandatory endorsements in RenewOS, risk and compliance leads ensure that no contractor or supplier steps foot onto an enterprise job site without active, verified insurance backing.
This article is published for educational and operational workflow planning purposes only and does not constitute formal legal, accounting, tax, insurance, or engineering advice. Statutory rules, fine schedules, and filing deadlines vary by jurisdiction and are subject to legislative amendment. Always consult with certified legal counsel, an authorized tax professional, or your local regulatory authority for official requirements. All third-party company, brand, and product names referenced are the registered trademarks of their respective owners and are used purely for identification and comparative reference under nominative fair use doctrine.
Continue exploring compliance guidelines and renewal tactics.
Switching liability insurers or restructuring your business can accidentally eliminate years of coverage if you misunderstand your policy's retroactive date and Basic Extended Reporting Period (BERP).
A SOC 2 Type II report only covers a historical observation window. When that window ends, enterprise vendors face a 2 to 4 month gap before the next report is issued. Here is how to manage bridge letters safely.
From software subscriptions and vendor contracts to vehicle fleets and compliance certifications, discover the top 7 expiration and renewal tracking software tested on pricing, mobile alerts, and privacy.