# Certificate of Insurance and Vendor Coverage Monitoring Source: PageCrawl.io Blog URL: https://pagecrawl.io/blog/certificate-of-insurance-vendor-coverage-monitoring Published: 18 September, 2026 --- Hana runs vendor compliance for a mid-sized general contractor with eleven active job sites. Every subcontractor in her file has a certificate of insurance on record, every certificate was checked against the subcontract requirements when it arrived, and every one is filed with an expiry date in a spreadsheet. On paper, her program is clean. Then a framing crew's foreman fell off a ladder on a Tuesday. The certificate in Hana's file showed general liability at $2,000,000 per occurrence and an active workers' compensation policy. What it did not show was that the sub had stopped paying premiums in June, the carrier had cancelled mid-term, and the state licensing record had already flipped the workers' compensation line to "expired" seven weeks earlier. Nobody told her. The certificate on file was a photograph of a policy that no longer existed, and the claim landed on her company's own policy along with a defense bill and a very awkward conversation with the owner. That is the structural weakness in every COI binder in the industry. A certificate is evidence of coverage on the day it was issued and nothing more. Coverage is a live thing: it expires on a schedule, it can be cancelled mid-term, limits get eroded by other claims, and endorsements get dropped at renewal. The gap between the paper in your file and the reality on your site is where uninsured exposure lives. This guide covers what changes between certificate renewals, which public pages display those changes, why nobody pushes that news to you, and how to set up monitoring so a coverage lapse reaches your inbox on the next check instead of surfacing in a deposition. ### Why does a certificate of insurance stop being true the day after you file it? A certificate documents coverage on the date it was issued and creates no obligation for anyone to keep you informed afterwards. The form itself says so. Policies cancel mid-term for non-payment, limits get eroded by unrelated claims, and endorsements disappear at renewal, all without any change to the PDF sitting in your file. The standard ACORD 25 certificate of liability insurance opens with a disclaimer in capital letters stating that it is issued as a matter of information only and confers no rights upon the certificate holder, and that it does not amend, extend or alter the coverage afforded by the policies described. The New York Department of Financial Services has published [formal guidance on what an ACORD certificate can and cannot represent](https://www.dfs.ny.gov/insurance/ogco2000/rg009081.htm), which is worth reading once if you have ever assumed a certificate functions as a contract. The cancellation language matters just as much. Since 2010, ACORD forms have said that notice of cancellation will be delivered in accordance with the policy provisions, replacing older wording that appeared to promise certificate holders advance notice. In practice the people who get told about a mid-term cancellation are the named insured (your subcontractor) and the regulator if a filing is required. You are not on that list unless a specific endorsement puts you there. Four things can go wrong between the day you file a certificate and the day you need it: 1. The policy simply expires on its stated date and is not renewed, or is renewed with a different carrier at different limits. 2. The carrier cancels mid-term, usually for non-payment of premium, often within weeks of a subcontractor's cash flow going bad. 3. Aggregate limits are eroded by claims from other projects, so the $2,000,000 general aggregate on your certificate is functionally $300,000 by the time you need it. 4. Endorsements you specifically required (additional insured, waiver of subrogation, primary and non-contributory) are quietly dropped at renewal while the headline limits stay the same. The first two are visible from outside if you know which page to watch. The third and fourth generally are not, which is why the monitoring described here supplements rather than replaces contractual verification. ### Which pages actually show a vendor's coverage status changing? Several public regulator records display live insurance and bond status for licensed vendors, and those records change without notice. State contractor licensing boards, state labor departments, and federal transportation registries all publish a status field, a policy expiry date, or a carrier filing that flips when coverage lapses. Those are the pages worth monitoring. #### State contractor licensing boards California's Contractors State License Board publishes a detail page for every licensee through its [Check a License lookup](https://www.cslb.ca.gov/OnlineService.aspx), showing licence status, classification, the contractor bond and its effective dates, and a workers' compensation line reading active, exempt, or expired depending on what the carrier filed. A contractor with employees whose workers' compensation lapses sees that line change on the public record, and California suspends licences over it. If your sub's page flips to suspended while their crew is on your site, you want to know that week, not at the next annual review. Washington runs an equivalent through the Department of Labor and Industries [contractor verification tool](https://secure.lni.wa.gov/verify/), showing registration status, bond details, liability insurance on file, and any infractions. Most states with a contractor licensing regime publish something comparable under a different name, but the page is the same shape: a per-vendor detail URL displaying status and dates. #### Federal motor carrier records If any of your vendors haul freight or equipment, the Federal Motor Carrier Safety Administration operates the [Licensing and Insurance public access system](https://li-public.fmcsa.dot.gov/), showing the insurance filings on record for a carrier, the required bodily injury and property damage limits, and the filings history including cancellations. When an insurer files a cancellation, FMCSA moves the operating authority toward inactive once it takes effect. A carrier running loads for you without active authority is a direct liability problem, and the change is public days before anyone volunteers the news. #### Federal contracting registration Vendors working with federal agencies must maintain an active [SAM.gov entity registration](https://sam.gov/entity-registration), which expires 365 days after submission unless renewed, and entities that opt into public search show their status publicly. Not an insurance lapse, but the same category of signal: a compliance attribute with a date attached that goes stale silently and blocks work when it does. #### Your own COI tracking portal Most risk teams already push certificates into a broker-provided system, a compliance vendor, or an ERP workspace, and those portals have an exceptions view listing vendors by expiry status. That page changes as certificates lapse and as new ones are uploaded, and because it sits behind a login you can monitor it as an authenticated page. Our walkthrough on [monitoring pages behind a login form](/blog/monitor-website-behind-login-form-steps-automation) covers capturing the session once so every check sees the same logged-in view you do. | Source | What changes | Why it matters | |--------|--------------|----------------| | State contractor licence detail page | Workers' comp status, bond dates, licence status | Suspension or lapse means the sub cannot legally work | | State labour department verification | Insurance on file, bond, infractions | Bond lapse leaves you without recourse on defects | | FMCSA Licensing and Insurance record | Insurance filings, BIPD limits, cancellations | Carrier loses authority, your freight is uninsured | | Federal contracting registration | Registration status and expiry date | Expired registration blocks award and payment | | Your COI tracking portal | Per-vendor expiry and exception counts | Central view of who is out of compliance today | ### Why doesn't the insurer or the vendor tell you when coverage lapses? Because none of them have a reliable reason to. The insurer's notice obligation runs to the named insured under the policy provisions, not to certificate holders. The subcontractor whose policy just cancelled for non-payment has every incentive to keep quiet and keep working. Nobody in the chain is structurally motivated to send you bad news. #### The notice endorsement gap You can contract for notice, and many subcontracts require thirty days' written notice of cancellation to the certificate holder. In practice the endorsement is often not purchased, the notice list is not updated when your project starts, and the requirement lives in the subcontract as an aspiration rather than an active filing. Where notice is genuinely endorsed, it arrives by post to whatever address was on the schedule when the policy was written. The more common failure is passive. A certificate expires, the vendor's broker does not automatically send a replacement to every certificate holder, and your reminder is a spreadsheet cell nobody opens until the quarterly report. Broker-managed collection chases a new PDF; it does not catch the fifteen days of uninsured work between expiry and receipt. #### Manual review runs on the wrong clock Vendor compliance reviews are calendar-driven: quarterly, at renewal, or at onboarding. Coverage failures are event-driven and cluster around a vendor's financial stress, which does not schedule itself around your review cycle. This is the mismatch described in our guide to [continuous vendor monitoring for third-party risk programs](/blog/continuous-vendor-monitoring-tprm): a snapshot taken every ninety days cannot see a state that lasted forty. Commercial COI tracking services help with collection, but few of them watch the public regulator record for the specific subset of vendors on your sites this week, which is exactly the check the certificate cannot substitute for. ### How do you set up COI and vendor coverage monitoring in PageCrawl? Point a monitor at each vendor's public licence or insurance record, track the specific text of the status and expiry fields, check daily, and route alerts to the channel your compliance team actually watches. Setup takes a few minutes per vendor, and adding a monitor when a sub is awarded work is a natural fit for the onboarding checklist. 1. **Collect the per-vendor detail URL.** Look up each active subcontractor on the relevant state board, labour department, or federal registry and copy the URL of the detail page showing their status, not the search page. If the board uses a POST-only search form with no stable detail URL, monitor your own COI portal's exception view for that vendor instead. 2. **Add the URL to PageCrawl and choose a tracking mode.** For a licence record, use specific text tracking aimed at the workers' compensation, bond, and status fields so navigation and rotating notices are ignored. For a portal exceptions view, content tracking on the table area catches rows appearing and disappearing. For a coverage limit, specific number tracking lets you alert on a drop rather than any edit. 3. **Set the check frequency to daily.** A daily check finds a status flip within a day, which is fast enough to stop a crew mobilising on Monday under a policy that cancelled on Friday. The free tier's hourly checks are more than enough here; the constraint on this use case is monitor count, not frequency. 4. **Add threshold and keyword rules so only real changes fire.** Set a keyword condition on "expired", "cancelled", "suspended", or "inactive" so a cosmetic page edit stays silent, and a numeric threshold on coverage limits so a drop below your subcontract minimum triggers while an increase does not. Our guide to [conditional alerts with price, keyword, and threshold rules](/blog/conditional-alerts-price-keyword-threshold-rules) walks through the syntax. 5. **Choose notification channels that reach the person who can stop work.** Email suits the compliance inbox and the audit file. Slack, Microsoft Teams, or Discord put the alert in front of the project team who can halt mobilisation. Telegram reaches a superintendent's phone. Webhooks push the change into your compliance system or open a task against the vendor record. Most programs use two: a channel for the risk team and a webhook into the system of record. 6. **Turn on screenshot capture and keep the history.** Every check stores a timestamped capture of the record as it appeared. When an assessor, an owner, or opposing counsel asks when you knew a vendor's coverage had lapsed, you can produce a dated image of the public record plus the diff showing which field moved. 7. **Group monitors by project and by risk tier.** Subs currently mobilised on a live site go in one folder checked daily; dormant or prequalified-but-not-awarded vendors go in a second folder checked weekly. Add the monitor when a subcontract is executed and demote it at final completion, so the portfolio never drifts into hundreds of stale pages nobody reads. ### What should trigger an alert, and what should stay silent? Alert on status words changing, on any date field moving backwards or into the past, and on a coverage limit dropping below your contractual minimum. Stay silent on visit counters, page timestamps, formatting changes, complaint counts unrelated to coverage, and address edits. A COI monitor that pings weekly for nothing gets muted within a month. #### Signals worth waking someone for A workers' compensation line flipping from active to expired or exempt. A licence status changing to suspended, revoked, or inactive. A bond showing a cancellation date. An insurance filing history gaining a cancellation entry. A required limit dropping below the subcontract floor. Any of these means work should pause until the vendor produces a current certificate and an explanation. #### Signals to ignore deliberately Regulator pages carry movement that has nothing to do with coverage: last-refreshed timestamps, session identifiers in the page body, "records updated nightly" banners, and cosmetic redesigns. Each will trigger a naive full-page monitor. Narrow the tracked region to the coverage block, then use the ignore controls on the first few false alerts to train the noise out, as described in our guide to [reducing monitoring false positives](/blog/reduce-website-monitoring-false-positives). Spend ten minutes on this per registry, because the same fix then applies to every vendor on it. #### The escalation ladder Not every change deserves a stop-work order. An expiry date approaching within thirty days should generate a task for the compliance coordinator to chase a renewal certificate. A status flip to expired or cancelled should alert the project manager and hold new work authorisations. A cancellation filing plus a mobilised crew warrants a phone call. Encode that ladder in your notification routing rather than in a policy document nobody reads. ### How does coverage monitoring hold up as audit evidence? Well, provided you keep the history. Every check produces a timestamped record of what the public page said on that date, and the diff shows precisely which field changed. That converts "we had a certificate on file" into a dated evidence trail of what you knew and when, which is the question that actually gets asked after a loss. Insurance and construction disputes turn on notice and knowledge. If a claim lands and your defence is that the sub represented itself as insured, the useful evidence is not just the certificate PDF. It is a dated record showing you verified the public status on a recurring basis, that it was clean on the day work was authorised, and that you acted within a day of it changing. The same archive answers your own underwriters at renewal, where "we collect certificates" is a weaker answer than "we collect certificates and monitor the public licensing and insurance record for every mobilised subcontractor daily, with a screenshot archive." Our post on [monitoring government permit and licence status pages](/blog/government-permit-license-status-monitoring) covers tracking the permits themselves, which most compliance teams run alongside this. ### What goes wrong with COI monitoring programs? Three things, mostly: monitoring the wrong page, letting the vendor list drift out of date, and confusing a public record with a policy. Each is fixable, but each has quietly wrecked programs that looked well designed on the whiteboard. #### Monitoring a search page instead of a record The single most common setup error is pointing a monitor at a licensing board's search form rather than a specific licensee's detail page. The search form never changes, so the monitor reports clean forever and everyone assumes coverage is fine. Before you save any monitor, load the URL in a private browsing window and confirm you can see the vendor's status and dates on the page itself without submitting a form. If the board only exposes results through a POST search, monitor your own portal record instead and note the limitation. #### A vendor list that drifts Subcontractors get added mid-project, second-tier subs appear without prequalification, and finished vendors linger in the monitor list for years. Both directions cause damage: unmonitored active subs are the exposure, and hundreds of stale monitors bury the real alerts. Tie the monitor list to the executed subcontract list and reconcile it monthly. If your procurement system can call a webhook on contract execution, wire it to create the monitor so it never depends on someone remembering. #### Assuming the public record equals the policy Regulator records are a lagging, partial view. A board shows what the carrier filed, on the carrier's schedule, which can trail the actual cancellation by days, and usually shows nothing about additional insured endorsements, waivers of subrogation, aggregate erosion, or umbrella coverage above the primary. Monitoring catches the loud failures (expiry, cancellation, suspension) that your certificate file structurally cannot. It does not replace requiring the endorsements in the subcontract and verifying them at execution. Treat it as a smoke detector, not a fire inspection. Some legitimate vendors have no public record at all: sole proprietors with a workers' compensation exemption, suppliers who are not licensed contractors, professional services firms in unregulated categories. For those, the monitorable signal is your own portal's expiry view. Mark them explicitly as manually verified so their absence from the monitored list never reads as compliance. ### Choosing your PageCrawl plan PageCrawl's **Free plan** lets you monitor **6 pages** with **220 checks per month**, which is enough to validate the approach on your most critical pages. Most teams graduate to a paid plan once they see the value. | Plan | Price | Pages | Checks / month | Frequency | |------|-------|-------|----------------|-----------| | Free | $0 | 6 | 220 | every 60 min | | Standard | $8/mo or $80/yr | 100 | 15,000 | every 15 min | | Enterprise | $30/mo or $300/yr | 500 | 100,000 | every 5 min | | Ultimate | $99/mo or $999/yr | 1,000 | 100,000 | every 2 min | Annual billing saves two months across every paid tier. Enterprise and Ultimate scale up to 100x if you need thousands of pages or multi-team access. Compliance monitoring is the cheapest insurance you can buy. A single missed regulatory change can trigger fines in the tens or hundreds of thousands, not to mention the audit overhead of proving you did not see it coming. Enterprise at $300/year covers 500 regulatory pages with unlimited history and timestamped screenshots, which is usually exactly what an assessor wants to see. All plans include the **PageCrawl MCP Server**, so your compliance team can ask Claude to summarize every change to a specific regulation over the last quarter and pull the exact diff, turning your monitoring history into a queryable audit trail. AI assistants can create monitors through conversation on every plan, including Free. Standard at $80/year is enough to cover 100 pages across your primary regulatory bodies if your program is smaller. ### Getting Started Start with the vendors who are physically on a site this week, not with your whole vendor master. Pull the five or six subcontractors with crews mobilised right now, look each one up on the relevant state licensing or federal insurance record, and copy the detail page URL for each. Add those URLs as monitors with specific text tracking aimed at the status and expiry fields, set a daily check, and add a keyword rule on "expired", "cancelled", and "suspended" so quiet weeks stay quiet. Route the alerts to your compliance inbox and to the project channel where a superintendent will see them. That fits inside the free tier, and it takes about twenty minutes. Then run it for a month. If any vendor's public record disagrees with the certificate in your file, that is exactly the vendor you would rather find on a quiet Tuesday than after an injury. Once you trust the setup, wire monitor creation into subcontract execution so every new vendor arrives with coverage monitoring already switched on. Stop trusting a PDF to tell you what a policy is doing today. Watch the record that changes. --- Need more? The complete PageCrawl.io help center, with every article, is available as a single document at https://pagecrawl.io/llms-full.txt. Read it for context on anything this page does not cover.