coi-insurance-compliance-tracker

COI & Insurance Compliance Tracker — Coverage Gate Matrix

Framework: Coverage Gate Matrix Price: $29 Category: Productivity / Compliance Tags: COI, insurance, compliance, vendor management, risk, certificates of insurance last_validated: 2026-03-03

---

What This Is

The Coverage Gate Matrix is a four-phase system for managing vendor certificates of insurance (COIs) from collection through remediation. It tells you exactly what to collect, how much coverage to require, when to follow up, and what to do when a vendor falls out of compliance.

Problem it solves: Most ops teams manage COIs reactively — they chase documents after something goes wrong, or realize a vendor's coverage expired months ago. The Coverage Gate Matrix closes that gap by turning COI management into a proactive, scored system with clear triggers and actions.

Output: A complete COI compliance registry with current status for every vendor, coverage scores, expiration alerts, and documented remediation actions.

---

The Coverage Gate Matrix Framework

The system runs across four sequential phases:

PHASE 1: COLLECT
What to get, from whom, by when
        ↓
PHASE 2: VALIDATE
Does coverage meet minimums? Is it current?
        ↓
PHASE 3: SCORE
Compliance score 0-100 per vendor
        ↓
PHASE 4: REMEDIATE
Action based on score and gap type
        ↓
    COMPLIANT ✓ or ESCALATED ⚠️

---

PHASE 1: COLLECT

1.1 — What to Collect (Universal Requirements)

Every vendor, regardless of category, must provide:

1. Certificate of Insurance (ACORD 25 form) — the standard COI document 2. Additional insured endorsement naming your organization (required for all vendors with physical access or service delivery liability) 3. Primary and non-contributory endorsement (for vendors with significant liability exposure) 4. Waiver of subrogation (for construction, facilities, and high-risk service vendors)

1.2 — Coverage Minimums by Vendor Category

#### Technology / SaaS / Software Vendors | Coverage Type | Minimum Required | |--------------|-----------------| | General Liability | $1M per occurrence / $2M aggregate | | Professional Liability / E&O | $1M per occurrence | | Cyber Liability | $1M per occurrence (required if handling data) | | Workers' Compensation | Statutory limits |

#### Professional Services (Consulting, Staffing, Legal, Accounting) | Coverage Type | Minimum Required | |--------------|-----------------| | General Liability | $1M per occurrence / $2M aggregate | | Professional Liability / E&O | $2M per occurrence | | Workers' Compensation | Statutory limits | | Umbrella / Excess Liability | $2M (for spend >$100K) |

#### Facilities / Construction / Contractors | Coverage Type | Minimum Required | |--------------|-----------------| | General Liability | $2M per occurrence / $4M aggregate | | Workers' Compensation | Statutory limits | | Employer's Liability | $500K per accident | | Auto Liability | $1M combined single limit | | Umbrella / Excess Liability | $5M (for projects >$500K) | | Builder's Risk / Installation Floater | Project value (for construction) |

#### Logistics / Shipping / Transportation | Coverage Type | Minimum Required | |--------------|-----------------| | General Liability | $1M per occurrence | | Auto Liability | $1M per occurrence | | Cargo Insurance | $500K per shipment (adjust to actual shipment value) | | Workers' Compensation | Statutory limits |

#### Marketing / Creative / Events | Coverage Type | Minimum Required | |--------------|-----------------| | General Liability | $1M per occurrence / $2M aggregate | | Professional Liability | $1M per occurrence | | Media Liability | $1M (for agencies managing public content) | | Workers' Compensation | Statutory limits (if they have employees) |

#### Low-Risk Vendors (Pure SaaS, subscriptions, no on-site work) | Coverage Type | Minimum Required | |--------------|-----------------| | General Liability | $500K per occurrence | | Professional Liability | $500K per occurrence | | Cyber Liability | $500K (if any data processed) |

1.3 — Additional Insured Requirements

Your organization name on the COI must be exact. Confirm the COI reads:

> "[Your Legal Entity Name], its officers, directors, employees, and agents are included as additional insured"

If the name is wrong, request a corrected certificate before accepting.

1.4 — Collection Cadence

| Trigger | Action | |---------|--------| | New vendor onboarding | Request COI at Gate 2 (before activation) | | Annual renewal (for active vendors) | Request 60 days before current COI expires | | Policy renewal noticed | Request updated COI within 5 business days | | Vendor adds new service type | Request updated COI reflecting new scope | | After a claim or incident | Request updated COI confirming coverage remains active |

---

PHASE 2: VALIDATE

2.1 — COI Validation Checklist

When a COI is received, run this 10-point validation:

Identity Verification

[ ] Insured name matches vendor legal entity name exactly

[ ] Insurer is licensed to operate in your state (check state insurance department lookup)

[ ] Certificate holder name is correct (your organization's exact legal name)

Coverage Verification

[ ] All required coverage types are listed

[ ] Per-occurrence limits meet category minimums

[ ] Aggregate limits meet category minimums

[ ] Policy effective dates are current (not expired)

[ ] Policy expiration date is at least 30 days in the future

Endorsements

[ ] Additional insured endorsement attached and correct

[ ] Waiver of subrogation included (if required for this vendor category)

[ ] Primary and non-contributory language included (if required)

2.2 — Common COI Red Flags

Flag any COI that shows:

| Red Flag | Action | |----------|--------| | Expiration within 30 days | Request renewal immediately — activate Phase 4 | | Limits below category minimum | Vendor must increase coverage — hold or conditional approval | | Insurer not admitted in your state | Confirm surplus lines filing or reject | | Additional insured not correctly named | Request corrected certificate | | Coverage type missing | Vendor must add coverage before activation | | Dates don't match policy period | Verify with insurer or request binder | | Certificate holder blank or wrong | Request corrected certificate | | "Sample" or "for information only" stamp | Reject — request actual current certificate |

2.3 — Verification Best Practices

For high-value vendors (>$100K annual spend) or high-risk categories:

Contact the insurer directly to verify coverage is active (call the agency listed on the ACORD form)

Request a binder rather than a certificate for construction or major project starts

Add an endorsement verification step — request the actual endorsement pages, not just the summary certificate

---

PHASE 3: SCORE

3.1 — Vendor Compliance Score (0-100)

Score each vendor across five dimensions. Update scores quarterly and whenever a new COI is received.

#### Scoring Dimensions

Dimension 1: Coverage Completeness (25 points)

All required coverage types present: 25 pts

Missing 1 coverage type: 15 pts

Missing 2 coverage types: 5 pts

Missing 3+ coverage types: 0 pts

Dimension 2: Coverage Adequacy (25 points)

All limits meet or exceed minimums: 25 pts

1-2 limits below minimum (minor gap <20%): 15 pts

1-2 limits below minimum (major gap >20%): 5 pts

3+ limits below minimum: 0 pts

Dimension 3: Policy Currency (20 points)

Policy active, not expiring within 90 days: 20 pts

Policy active, expiring in 60-90 days: 15 pts

Policy active, expiring in 30-60 days: 8 pts

Policy active, expiring within 30 days: 2 pts

Policy expired: 0 pts

Dimension 4: Documentation Quality (15 points)

All required endorsements present and correct: 15 pts

Missing 1 endorsement: 10 pts

Missing 2 endorsements: 5 pts

Missing 3+ endorsements or certificate holder wrong: 0 pts

Dimension 5: Response Compliance (15 points)

Submitted on first request, within 5 days: 15 pts

Submitted within 10 days: 10 pts

Required 1 follow-up, submitted within 15 days: 5 pts

Required 2+ follow-ups or more than 15 days: 0 pts

#### Score Calculation

Total Score = D1 + D2 + D3 + D4 + D5
Max possible: 100 points

3.2 — Compliance Tier Classification

| Score Range | Tier | Status | |-------------|------|--------| | 85-100 | 🟢 Green — Compliant | No action required | | 70-84 | 🟡 Yellow — Attention | Minor gaps, monitor closely | | 50-69 | 🟠 Orange — At Risk | Active remediation required | | Below 50 | 🔴 Red — Non-Compliant | Work pause or hold recommended |

---

PHASE 4: REMEDIATE

4.1 — Remediation Actions by Tier

🟢 Green (85-100): No Action

Log score in tracker

Set next review date (90 days or at COI expiration, whichever comes first)

Send acknowledgment to vendor if they improved from prior review

🟡 Yellow (70-84): Monitor & Notify

Log score and specific gaps

Send Gap Notice to vendor (Template A below)

Set 30-day follow-up reminder

Escalate if not resolved within 30 days

🟠 Orange (50-69): Active Remediation

Log score and all gaps

Send Remediation Required notice (Template B below)

Notify internal owner of vendor relationship

Give vendor 15 business days to resolve

If spend is high: consider conditional hold on new purchase orders

Escalate to manager if not resolved

🔴 Red (Below 50): Non-Compliant Hold

Immediately notify internal vendor owner and manager

Send Non-Compliance Notice (Template C below)

Place hold on new purchase orders until resolved

Give vendor 10 business days to resolve or escalate

If coverage is expired: recommend immediate work stoppage for high-risk vendor categories

Document in vendor record for risk history

4.2 — Communication Templates

#### Template A — Gap Notice (Yellow Tier)

Subject: Action Required: Insurance Certificate Update — [Vendor Name]
Hi [Contact Name],
During our routine review of your insurance documentation, we identified the following items that require your attention:
GAPS IDENTIFIED:
[ ] [Specific gap 1 — e.g., "Professional liability limit is $500K; our minimum is $1M"]
[ ] [Specific gap 2]
Please provide updated documentation addressing these items by [DATE — 30 days].
If you've already renewed or updated your coverage, please send the new certificate to [email].
Questions? Contact [Your Name] at [email/phone].
[Your Name]
[Your Company] Operations

#### Template B — Remediation Required (Orange Tier)

Subject: IMPORTANT: Insurance Compliance Issue — [Vendor Name] — Action Required by [DATE]
Hi [Contact Name],
Our compliance review has identified significant gaps in your current insurance documentation that require immediate attention. 
ISSUES REQUIRING RESOLUTION:
1. [Issue — e.g., "General liability aggregate limit ($1M) is below our $2M minimum"]
2. [Issue]
3. [Issue]
We need updated certificates of insurance addressing all items above by [DATE — 15 business days].
IMPORTANT: Until these items are resolved, we may need to place a hold on new purchase orders. Our goal is to work through this quickly so there's no disruption to our relationship.
Please contact us immediately to discuss a resolution timeline.
[Your Name]
[Your Company] Operations | [phone]

#### Template C — Non-Compliance Notice (Red Tier)

Subject: URGENT: Insurance Non-Compliance — [Vendor Name] — Immediate Action Required
Hi [Contact Name] and [Senior Contact at Vendor],
[Vendor Name]'s insurance coverage has fallen into non-compliance with our vendor requirements. We need to resolve this immediately.
NON-COMPLIANCE ISSUES:
1. [Issue — e.g., "General liability coverage expired [DATE]"]
2. [Issue]
REQUIRED ACTIONS:
1. Confirm in writing within 24 hours whether coverage is being reinstated
2. Provide updated certificates within 10 business days
IMPACT: We have placed a hold on new purchase orders pending resolution. [For high-risk categories: We also need to pause work in [specific area] until coverage is confirmed.]
We value our relationship with [Vendor Name] and want to resolve this quickly. Please contact me directly.
[Your Name], [Title]
[Your Company] | [direct phone]
CC: [Internal vendor owner], [Finance/Legal if applicable]

4.3 — Escalation Ladder

If vendor does not respond within defined timelines:

| Day | Action | |----|--------| | Day 1 | Send appropriate template (A, B, or C) | | Day 5 | If no response: send follow-up to same contact + CC vendor's senior contact | | Day 10 | If still no response: internal escalation to your manager + legal review | | Day 15 | If still no response: formal non-compliance notice with contract language cite | | Day 20 | Contract review — consider cure notice or termination for cause language |

---

COI Registry Setup

Required Fields in Your COI Tracker

Maintain these fields for each vendor COI:

| Field | Notes | |-------|-------| | Vendor ID | Links to vendor master | | Vendor Name | Legal entity | | COI Document # | Track multiple versions | | Date Received | | | Policy Period Start | | | Policy Period End | Sort by this for expiration management | | Insurer Name | | | Insurer AM Best Rating | A- or better recommended | | GL Per Occurrence | | | GL Aggregate | | | Professional Liability | | | Cyber Liability | | | Workers Comp | Y/N + statutory | | Auto Liability | If applicable | | Additional Insured | Y/N + correct name confirmed | | Waiver of Subrogation | Y/N | | Current Compliance Score | 0-100 | | Compliance Tier | Green/Yellow/Orange/Red | | Last Review Date | | | Next Review Date | 90 days out or at expiration | | Gaps Identified | Free text | | Remediation Status | Open/In Progress/Resolved |

Alert Calendar Setup

Create these calendar alerts for every COI:

90 days before expiration: "COI Renewal Request Due — [Vendor Name]"

60 days before expiration: "COI Renewal Follow-Up — [Vendor Name]"

30 days before expiration: "URGENT: COI Expiring — [Vendor Name]"

Day of expiration: "COI EXPIRED — [Vendor Name] — HOLD NEW POs"

---

Expected Outputs

After implementing Coverage Gate Matrix, you will have: 1. ✅ A complete COI registry with current status for every vendor 2. ✅ Standardized coverage minimums by vendor category 3. ✅ Compliance scores for every vendor (0-100) 4. ✅ Automated alerts for upcoming expirations 5. ✅ Documented remediation actions for any non-compliant vendors 6. ✅ A 30-day improvement plan for vendors in Orange/Red tiers 7. ✅ Audit trail for all compliance reviews and communications

Time savings (typical): 2-4 hours/week for a team managing 20+ vendors. Hours increase at scale — the system doesn't.

---

*Coverage Gate Matrix — Part of the Vendor & Compliance Operations Pack by Remy Claw* *More at remyclaw.com | @Remy_Claw on X*