“We keep finding out a vendor’s insurance lapsed after the fact.” If that sounds familiar, look at where the dates live. If the answer is a spreadsheet someone opens when they remember, your reminder system is a person, and it fails when that person is busy, on vacation or gone.
Fixing it takes five parts that work together as one vendor compliance workflow:
- A register: every document, its owner and its expiry date in one place.
- Statuses that change by date, each tied to a specific action.
- Staged reminders to the vendor first and your own team second.
- A hold rule for new work when a required document lapses.
- A review step for resubmissions, with an audit trail behind it.
What to track for every document: the register
The register is one row per document, not one row per vendor. A subcontractor with a general liability certificate, an auto liability certificate and a state license has three rows, each with its own expiry date and status. Which documents you require is a decision for your risk or legal team; the register just has to hold them consistently.
Rules that keep the register trustworthy
- Types come from a list, not free text. “GL cert”, “Gen Liab” and “insurance” in the same column break every filter and reminder rule.
- Dates are dates, in one format. 3/4/27 can mean March 4 or April 3. Pick a format and reject anything else on entry.
- Every row has an internal owner. A reminder nobody on your team is accountable for is one nobody follows up.
- Replacements don’t overwrite. A new certificate becomes a new row and the old one is marked superseded, so the history survives.
- No expiry printed? Set a review date. A signed agreement or a tax form can carry a review date your team chooses, so it still comes up for a check.
Statuses that drive action: compliant, expiring, lapsed, under review
A status is only useful if it tells someone what to do next. Four statuses cover the whole cycle:
Three rules keep the statuses honest:
- Calculate them every day from dates. Nobody types “compliant” into a cell.
- Roll them up to the vendor. A vendor’s overall status is the worst status among its required documents. One lapsed license makes the vendor lapsed, even if everything else is current.
- Under review is not compliant. If the old certificate expired while the new one waits for review, show both (“lapsed, replacement under review”), so nobody chases a vendor who already sent it and nobody assigns work before it’s approved.
Example (hypothetical): one vendor, four documents
A paving subcontractor has a general liability certificate expiring in 120 days (compliant), an auto liability certificate expiring in 21 days (expiring), a workers’ compensation certificate uploaded yesterday (under review) and a state license that expired last week (lapsed). The vendor’s rolled-up status is lapsed. The only thing a person needs to chase is the license: the system is already reminding the vendor about the auto certificate, and the workers’ compensation certificate just needs a reviewer.
Expiration reminder schedules that work: who gets reminded, and when
Send the early reminders to the vendor, because only the vendor can get a new certificate from its insurer or renew its license. Bring your own team in when the vendor hasn’t responded. That split keeps your coordinators out of routine renewals and puts them on the few that need a phone call.
A 90, 60, 30 and 7-day schedule is a sensible start for many documents. Lengthen it for renewals that take longer, such as a license that needs paperwork from a third party, and make the windows a setting per document type rather than something hard-coded.
What an automated expiration reminder email should say
- The specific document and its expiry date, not “your documents need attention”.
- A reply-by date ahead of the expiry, so there’s time to review the replacement before it matters.
- One place to send it: an upload link or a single monitored inbox.
- What the replacement must show, in the words your risk team specified.
- Who to contact with a question.
Example (hypothetical) reminder
“Our records show your general liability certificate expires on March 31, 2027. Please upload an updated certificate by March 24, 2027 using the link below. Questions? Reply to this email and it reaches our vendor team.”
Rules that keep reminders from turning into noise
- Stop the moment a replacement arrives. Reminders about a document that’s already under review teach vendors to ignore the next one.
- One message per vendor, not one per document. List everything that’s due in a single email.
- Send from an address someone monitors. Treat a bounced reminder as a task: the vendor contact is out of date.
- Log every reminder. When a document lapses, the first question is whether the vendor was told, and when.
- Put renewals on your team’s calendar too. An iCalendar (.ics) file adds the renewal date to the owner’s calendar, and the format’s alarm component, defined in RFC 5545, can attach a reminder ahead of it.
Expiring credentials that belong to people
The same expiring credential reminder workflow covers licenses and certifications held by individual technicians or staff. Route the reminder to the person who holds the credential, copy their manager, and roll the status up to both the person and their company.
Holding new work when documents lapse
Reminders reduce lapses. A hold rule decides what happens when one gets through anyway. Without it, “lapsed” is a red cell that someone may or may not notice before the next assignment goes out.
Holding new work until a current document is received and reviewed is a common rule. Decide yours with your risk or legal team and write it down in plain words before anyone builds it. These questions shape the rule:
- Which documents block new work, and which only need to be on file?
- Does the hold cover new work only, or work already scheduled? Scheduled work has different consequences, so decide it separately.
- Is there a grace period, and who can grant an exception? Record every exception with a reason, an approver and an end date.
- What lifts the hold: an upload or an approval? Lifting it on approval stops a blank or outdated file from releasing work.
- Who hears about it? The vendor, the internal owner and whoever assigns work should all be told when a hold starts and when it ends.
Example (hypothetical) hold rule
A vendor with a lapsed required document can’t be offered new work orders. Work already scheduled in the next five business days goes to the operations manager to decide. The hold lifts when a replacement is approved, and both the hold and the release are logged.
A hold only works if it lives where work is assigned. If dispatchers assign work in one system and the register sits in a spreadsheet, the hold depends on someone remembering to check. Putting the check inside the system that assigns the work closes that gap.
Want the hold to live where work is assigned?
We build contractor and vendor portals where people upload their own documents, reminders go out on your schedule and new work waits for an approved replacement. Your first call is with an engineer.
Reviewing resubmissions and keeping an audit trail
An upload isn’t a compliant document until someone checks it. The review step is where you catch the wrong file, the wrong company name or last year’s certificate sent again.
A document resubmission approval checklist
- Right document, right vendor. The type matches what was requested and the name matches your vendor record.
- The dates add up. The new expiry is later than the one it replaces, the document is already in effect, and the date entered matches the file.
- Your requirements are met. Whatever your risk or legal team specified for that document type, as a short checklist the reviewer ticks.
- The file is complete. Every page is there, legible and signed where required.
- The decision is recorded. Approve, and the new document becomes current while the old one is superseded; or reject with a reason.
Make rejections something the vendor can act on. “Rejected” on its own starts another round of email. A short list of reasons (wrong document, already expired, name doesn’t match, missing pages, requirement not met), a note and a link straight back to the upload give the vendor what they need to send the right file.
Decide who can approve, too. If the person who wants the vendor on a job is the only one who can approve that vendor’s documents, the review isn’t much of a check.
What the audit trail should record
- Every upload: who sent it, when, and the file itself
- Every status change, and whether a date or a reviewer caused it
- Every reminder: what was sent, to whom and when
- Every hold, release and exception, with who approved it
- Superseded documents, kept rather than deleted
With that history, “Were they covered on June 12?” becomes a lookup instead of an inbox search.
Spreadsheet, compliance software, or built into your portal
There are three reasonable ways to run this, and each fits a different situation.
If certificate collection is the whole job, dedicated software can fit well. Building it in makes sense when tracking has to live inside your own portal, data and process: the people uploading documents are the same people accepting work, the hold has to apply at the moment of assignment, or your rules don’t fit a product’s settings.
When it belongs in your own system, we build it: uploads from a phone, reminders on your schedule, a review queue and holds tied to assignments. See contractor portal development for contractor networks and customer and vendor portals for suppliers and customers.
Try the free tracker with your own list
Before you build or buy anything, see where your list stands today. Paste your vendor or contractor list from Excel or Google Sheets into the free document expiration tracker. It sorts every document by days left, groups them into 30, 60 and 90-day windows, rolls each vendor up to its worst status, flags dates it can’t read and drafts a reminder email for each vendor with something expired or due. It runs in your browser: nothing you type is sent anywhere unless you choose to send it to us.
Its buckets map onto the statuses above: current is compliant, the 30, 60 and 90-day windows are expiring, and expired is lapsed. If the same names turn up overdue every month, the register needs to live in a system rather than a sheet.
More practical write-ups for operations teams are in our guides.
