COI Tracking for Property Managers: The Complete Guide

COI tracking is the process of collecting certificates of insurance from your tenants and vendors, verifying that the coverage matches what their lease or contract requires, and keeping that verification current as policies renew. Most property managers do the first part. Almost nobody does the second part well — and the second part is the one that protects you.

Here's the uncomfortable pattern: a COI on file is not the same thing as compliant coverage. A certificate can be current, signed, and sitting neatly in your system while the policy behind it is missing the additional insured endorsement your lease requires. When something goes wrong, "we had a certificate" is not a defense. "We verified the coverage" is.

This guide covers what to require, how to actually verify it, and how to run tracking across a portfolio without it eating your team's week.

What a COI tells you — and what it doesn't

A certificate of insurance (usually an ACORD 25 form) is a one-page snapshot: who's insured, by which carrier, with what limits, through what dates. It's issued by the vendor's or tenant's insurance agent as a courtesy.

Read the fine print at the top of any ACORD 25 and you'll find the part most people skip: the certificate "confers no rights upon the certificate holder" and "does not affirmatively or negatively amend, extend or alter the coverage." In plain terms: the certificate is a claim about coverage, not proof of it. The actual protections you care about — additional insured status, waiver of subrogation, primary and noncontributory wording — live in policy endorsements, not on the certificate itself.

So a real verification checks three layers:

1. The certificate — right named insured, current dates, adequate limits, your entity listed as certificate holder.
2. The endorsements — the actual forms (like a CG 20 10 for additional insured status) attached behind the certificate.
3. The match against your lease or contract — because "good coverage" only means something relative to what you required.

What property managers should require

Requirements should live in the lease (for tenants) and the service agreement (for vendors), and your COI review should check against those documents — not against a generic standard. That said, typical baselines for commercial properties look like this:

And the parts that actually protect the owner:

• Additional insured status for the owner and management entity — via endorsement, not just a note in the description box. Ask for the endorsement form itself.
• Primary and noncontributory wording — so the tenant's or vendor's policy pays first, before the owner's.
• Waiver of subrogation — so their carrier can't pay a claim and then come after you to recover it.
• Notice of cancellation — so you find out when a policy lapses mid-term, not at renewal.

One practical note: scale requirements to vendor risk. Requiring a $5M umbrella from the company that waters the lobby plants just slows down onboarding. Requiring only $1M GL from a roofer is how owners end up funding someone else's claim. A simple two- or three-tier vendor risk schedule solves both problems.

(Have your attorney review the actual lease and contract language — insurance requirements are jurisdiction- and asset-specific.)

Why expiration tracking isn't compliance

Most tracking systems — spreadsheets and most property management software alike — track one field: the expiration date. That catches the vendor whose policy lapsed. It does nothing about the vendor whose policy is active but wrong.

In practice, wrong-but-active is the more common failure. Certificates come in missing the additional insured endorsement, naming the wrong entity (the LLC that owns the building, not the one on the lease — or vice versa), carrying half the required GL limit, or listing an umbrella that expired even though the GL is current. An expiration-date tracker marks all of these "compliant."

This is the gap that matters: the difference between tracking documents and verifying coverage. Everything else in your process should be built around closing it.

How to actually run COI tracking across a portfolio

1. Put the requirements somewhere checkable. Extract the insurance requirements from each lease and contract into a schedule — per property, per tenant, per vendor tier. If requirements only live inside 80-page lease PDFs, nobody is checking against them.

2. Collect COIs at the moments of leverage. Lease signing, vendor onboarding, and renewal are the three moments you have someone's attention. A vendor who wants to get paid returns emails. A vendor who's already been working on site for six months does not.

3. Review against requirements, not against "looks fine." Certificate, endorsements, match — the three layers above. Fifteen minutes per COI if you're doing it properly by hand.

4. Chase corrections to completion. This is where compliance programs actually die. The first review flags the gap; then it takes three to five rounds of email with a vendor's insurance agent to get a corrected certificate, and nobody has time for round three. An open item that never closes is the same as never reviewing at all.

5. Re-verify at every renewal. Coverage changes at renewal — carriers change, limits drop, endorsements quietly disappear. Every renewal is a fresh verification, not a date update.

Spreadsheet, PM software, or dedicated tracking?

A spreadsheet works up to roughly 50–75 active certificates. Beyond that, renewals cluster, the chase emails multiply, and the sheet stops being true. (If you're at this stage, start with a free COI tracking template — just know what it can't see.)

Property management software (Yardi, MRI, AppFolio and similar) stores certificates and tracks expiration dates. Useful, but it's document storage plus a calendar — the verification layer isn't there.

Dedicated COI tracking is worth it when the math flips: portfolio size × vendors per property × 15 minutes per proper review × 3–5 chase emails per gap. For most managers that's somewhere around a few hundred certificates — the point where doing it right by hand becomes a full-time job nobody was hired for.

This is the job Tightrope's agent Travis does end to end: reads each COI against the actual lease or contract requirements, flags gaps in limits and endorsements, and then handles the part software never did — emailing, calling, and texting the vendor, broker, or tenant until a corrected, compliant certificate is on file.

FAQ

What is COI tracking? Collecting certificates of insurance from tenants and vendors, verifying the coverage against lease or contract requirements, and keeping that verification current through renewals and policy changes.

How often should COIs be reviewed? At intake, at every policy renewal, and whenever the underlying contract changes. Annual batch reviews leave you exposed for the months in between mid-term cancellations.

Who should be listed as additional insured? Typically the property owner and the management company — as they're named in the lease. Confirm it's granted by endorsement, not just typed into the certificate's description box.

Is a certificate of insurance legally binding? No. The ACORD 25 itself confers no coverage rights. The policy and its endorsements control — which is why verification has to go one layer deeper than the certificate.

---

Want to see what a real verification looks like? Run one of your COIs through Travis on Tightrope's free plan — upload the certificate and the lease requirements, and see what it catches.