Certificate of insurance tracking: the complete guide

What a certificate of insurance actually is

A COI is a one-page summary issued by an insurer that confirms a party holds specific insurance in specific limits for a specific period. It typically lists the insured entity, the policy type (public liability, employers' liability, professional indemnity, motor, etc.), the coverage limits, the effective and expiry dates and any additional insured parties.

What to check on every COI

1. Insured name matches the entity you're contracting with.
2. Policy type matches what your contract requires.
3. Limits meet or exceed your minimum.
4. Effective date is today or earlier; expiry is in the future.
5. Additional insured / waiver of subrogation clauses are present where required.
6. Issuer is a genuine insurer or broker (spot check the phone number).

The tracking system that actually works

The system is boringly simple: each supplier is a record, each COI is an object with an expiry date and the software nudges you 60, 30 and 14 days before expiry. Credbase does this automatically the moment a COI is uploaded, its AI reads the expiry date, a human approves and reminders switch on.

Handling multi-policy suppliers

Large suppliers may hand over five or six certificates. Store them as separate documents on the same supplier record so each expiry is tracked independently. A single 'blob' PDF hides the fact that the PI has lapsed while the public liability is fine.

Sharing evidence with your clients

Your clients ask for COIs from you. When your record is live, you can share the exact certificates they need in a single link, always current, revocable and easy to refresh next year.

A tracking model that survives contact with reality

Most COI tracking dies for one of three reasons: the tracker lives in one person's spreadsheet, the expiry date is typed by hand and drifts or nobody owns the chase. A model that survives has four properties. Each policy is a separate record. The expiry comes off the document rather than out of someone's memory. Every record has a named internal owner. And the chase happens on a schedule, not a mood.

Reading limits properly: aggregate versus any one claim

A £5m limit is not always £5m. An any-one-claim limit applies afresh to each claim. An aggregate limit is the most the insurer will pay across the whole policy year, so two earlier claims can leave far less than the headline figure. Professional indemnity is usually the one to watch, because it is typically claims-made and often aggregate. When a client contract specifies a minimum, check which basis they mean before you accept a certificate that technically shows the number.

• Any one claim: limit resets per claim, the stronger basis.
• Aggregate: shared across the policy year, so erosion matters.
• Claims-made: covers claims notified during the period, so a lapse creates a permanent gap.
• Occurrence-based: covers incidents that happened during the period, whenever notified.

Verifying a certificate without becoming a fraud investigator

1. Check the entity name against Companies House and your own contract, not against the invoice.
2. Look up the insurer independently and confirm they are authorised to write UK business.
3. For material engagements, ring the broker on a number you found yourself and quote the policy number.
4. Treat an editable file or an unbranded PDF as a request for the broker to reissue, not as a fraud accusation.
5. Record who verified, how and when. That record is the thing an auditor wants.

Handling renewals and continuity gaps

The riskiest week in the year is the week around a renewal. A supplier renews with a new insurer, the certificate arrives late and for four days you hold nothing. If work continued in that window you need to be able to show cover was continuous, which means keeping the outgoing certificate alongside the incoming one and checking the dates butt up with no gap. Where there is a genuine gap, log the decision you took and why, because the honest record is far more defensible than a tidy folder.

Sharing evidence with your clients

Your clients ask for COIs from you. When your record is live, you can share the exact certificates they need in a single link, always current, revocable and easy to refresh next year.

Metrics worth watching

Common failure modes

• One blob PDF per supplier, so individual policy expiries are invisible.
• Expiry dates typed into a spreadsheet by hand and never reconciled with the document.
• Tracking owned by one person, with no cover when they are on leave.
• Renewal chases starting after the expiry date rather than before it.
• Superseded certificates deleted, making continuity impossible to prove.