Why contractor insurance certificates lapse mid-contract: lessons from a city audit

Contractor insurance certificates rarely fail at the start of a contract. They fail later, when the policy renews and nobody asks for the new certificate. A published audit by the City of Richmond, Virginia, shows how that happens in an organisation that had certificates on file and paid a provider to track them, and what its auditor recommended.

What did the Richmond audit find?

The Richmond City Auditor reviewed all 17 street paving (milling and overlay) contracts active from 2018 to 2020, in Report #2022-03 of 20 September 2021. The contracts required contractors to provide and maintain insurance for the whole contract. If the cover on a certificate lapsed before the work was done, the contractor had to provide a certificate with the new coverage period.

Certificates for all 17 contracts had arrived before the contracts were signed. But for 13 of the 17 (76%), the coverage period on the certificate expired before the contract work was completed, and the contractors did not send updated certificates. The city’s Chief of Risk Management obtained them only after the auditor asked.

The auditor named the risk plainly: the city could be sued for damage a contractor caused if the contractor’s insurance was inadequate or had lapsed.

Why did the certificates lapse?

The auditor traced the gap to the process, not to any one contractor. The city paid a third-party provider to collect and track certificates, and the report lists what went wrong around it:

• The records didn’t survive a change of provider. When a new tracking contract started in May 2019, the previous provider did not hand over the certificates the city asked for. The new provider tracked only the certificates it was sent, so it couldn’t follow up on open contracts.
• For a while, no provider was tracking. There was a period between the two contracts with no tracking provider in place, and the city could not tell which certificates went missing then.
• Contact details were missing. The contract list given to the provider had no contact name, telephone number or email for the contractors.
• Contractors weren’t sure where to send certificates. Some went to the former provider, some to Purchasing Services and some to Risk Management.
• Nobody checked the tracking. The report found no adequate procedures to make sure the provider met the terms of its contract.

The same audit found a second, smaller version of the problem. The paving inspectors’ own certifications were listed in a spreadsheet compiled for an earlier audit and never updated. The supporting documents were not collected in one place, so the auditor could not confirm some of them.

What did the auditor recommend?

1. Give whoever tracks certificates the information they need, including each contractor’s contact details.
2. Decide which department owns certificate tracking: Procurement Services or Risk Management.
3. Put contract administration procedures in place, so someone checks the tracking is actually done.
4. Tell every active contractor how certificate tracking works and where certificates go.

Why isn’t the first certificate enough?

Because a certificate is a snapshot. The Connecticut Insurance Department says a certificate of insurance “contains a snapshot of the insured’s coverages as of the day of issue”. It adds that the certificate holder “is owed no duty to be notified” if the policy is cancelled. In Australia, Defence guidance describes a certificate of currency as evidence that a policy is in force at its date of issue, and notes that most insurances renew annually.

So a contract that runs past the policy’s renewal date needs at least one more certificate. Nobody is obliged to send it unless your contract requires it, and even then someone has to ask.

Which controls would have caught it?

• Record the date each certificate’s cover ends, not the date you received it, and compare it with the contract’s end date.
• Ask for the renewal before the cover ends, and keep asking until it arrives.
• Name one owner for certificate tracking, and give contractors one place to send certificates.
• Keep a contact name, email address and phone number for each contractor with the contract.
• Before changing tools or providers, export every certificate with its dates and history, then check the new records against your open contracts.
• Check the tracking itself: a regular list of certificates that ended without a replacement shows quickly whether it works.

One city’s audit of 17 contracts is a case study, not an industry rate. Its causes are worth checking because none of them is unusual.

How does Vendarity handle this?

In Vendarity, an accepted certificate keeps a requirement current until its expiry date or review date, whichever comes first, and a gap of even one day shows as a gap. Once an Owner or Admin turns on automatic reminders, the standard schedule asks the supplier contact for the renewal 30, 14, 7 and 1 days before expiry, and the contact uploads it through a private link. Certificates your team receives by email, for example from a broker, can be forwarded to the workspace’s own address. Replaced documents stay on record with their history, and an Owner or Admin can download a full account export if you move to another tool. See how renewals work.