Nobody finds an expired COI on a good day

A water hauling company gets set up as a new supplier in January. Before their trucks start running water to your locations, someone in the office checks their certificate of insurance (COI) against the master service agreement (MSA), the contract that sets the terms for every job they'll run for you. General liability, auto liability, and workers' comp are all there, at limits that meet your minimums, with you named as an additional insured. The dates are good. The certificate goes in the folder, and the supplier record says approved.

In October, one of their drivers is unloading at a pad when a hose coupling fails, and produced water goes into the ground before anyone can close the valve. Cleanup starts that afternoon, and the landowner calls by evening. Somebody pulls the folder to find out whose insurance picks up the cost, and that's when the office learns the hauler's policy expired in August. Maybe it renewed and nobody sent the new certificate. Maybe it didn't. Either way, you're finding out now.

Nothing about that August date was hidden. It was printed on the certificate the whole time. It just lived in a folder, and a folder can't tell anyone a date has passed. That folder, along with the spreadsheet and the calendar reminder someone set up two coordinators ago, is Shadow ERP™: the work your business depends on that your systems were never built to hold.

Every certificate comes with an expiration date

A COI summarizes a supplier's policies as of the day it was issued: coverage types, carrier, limits, endorsements, and the dates each policy starts and ends. When someone checks it at onboarding, every one of those checks is accurate. The expiration date tells you exactly when the rest of the page stops being reliable, unless a renewal certificate shows up to replace it.

Insurance is only part of it. Safety certifications and training records expire on their own schedules. One supplier can hold several of them, and an operator working with dozens or hundreds of suppliers ends up responsible for a calendar that doesn't exist in any one place.

Where the dates actually live

Most ERPs give you a supplier record that says approved and stop there. Approval happened once, and there's usually no mechanism for tracking whether the certificates behind it are still current.

So the tracking happens wherever someone can make it happen: a shared folder of PDFs, a spreadsheet with an expiration column that gets sorted when someone has time, and renewal requests sent by email whenever someone gets to them. Procurement handles supplier setup, the safety team owns the certification requirements, and risk management sets the insurance minimums, so the full picture tends to sit with whoever happens to be holding the folder.

The people doing that work are usually doing it carefully. A good compliance coordinator catches most lapses. Most is the problem, because the one that slips through tends to be the one with a truck on your location.

What rides on the expiration date

If a supplier's crew causes damage on your location, the arrangement is built so their coverage responds, and being named as an additional insured is how that protection reaches you. All of it depends on the policy being in force on the day of the work. When it isn't, the protection you negotiated may not be there, and your own coverage may not extend to the supplier's mistakes.

Safety certifications raise their own version of the problem. An expired one means someone is working your location without the qualification your own rules require.

Neither kind of lapse announces itself. Most stay invisible until there's a claim, an incident, or an auditor asking a pointed question. Nobody finds an expired COI on a good day.

Turn the certificate into a record

Every fact you need is already on the paperwork. What's missing is something that reads it, knows your requirements for that kind of supplier, and keeps watching after the folder closes.

Start by turning each document into data. As COIs, safety certifications, and training records arrive, from a new supplier or a renewal, AI reads each one and pulls out the coverage type, carrier, limits, endorsement status, and effective and expiration dates.

From there, each supplier is checked against the minimums for its class, at onboarding and on every renewal. It lands as compliant, expiring, lapsed, or insufficient coverage when a specific limit falls short, and every status carries the reason.

The chasing gets handled as well. Suppliers get notified directly at 90 days, at 30 days, and again once a document has expired, and your team sees internal alerts on a fixed schedule ahead of each expiration. A new supplier who doesn't meet your requirements is flagged and routed to a person for review, and an existing supplier who lapses or falls short gets flagged against their record the same way. When a renewed or corrected document comes in and passes, the flag clears on its own. A dashboard sorts every supplier by days to expiration, so the lapsed and the nearly lapsed are the first thing anyone sees.

Your rules drive all of it: which documents each type of supplier owes you, what the minimums are, how far ahead the warnings start, and who reviews the exceptions. Your coordinator still makes the calls that need judgment. What reaches them now is a limit below your minimum or a missing endorsement, with the document and the reason attached, instead of a folder to work through. The supplier record still gets created in your ERP as part of standard onboarding, so your system of record stays where it is.

Was this supplier insured on the day of the work?

Sooner or later, a claim, an incident review, or an audit asks that question. Today the answer often comes from a folder, an email thread, and whatever the spreadsheet said the last time someone updated it.

When the certificate is a record, the answer is the document itself, the terms pulled from it, the status it held on any given date, and who reviewed what along the way. That record won't change what happened at the pad. It will tell you exactly where you stood, and it would have been asking the hauler for a renewal back in May, when there was still time to do something about it.

Start with the suppliers on location this week

Shadow ERP lives in the spaces between systems, and closing it means closing those spaces one at a time. Your ERP keeps the supplier master. If a vetting service or a supplier portal is already handling part of this, it stays. What's new is the layer your team has been holding together by hand, built with your rules in it and a record behind it.

A good place to start is the list of suppliers working your locations right now, since those are the certificates where a lapse turns into exposure.

Nextworld is the platform where that layer gets built, connected to your ERP and run on your own requirements. If you've ever opened the folder hoping the date was still good, that's the gap we close.