Most of project portfolio management is about choosing and steering work. But the moment your delivery depends on outside vendors and contractors, a different kind of risk enters the picture, and it has nothing to do with schedule or scope. It is compliance: the certificates of insurance, licenses, and contractual requirements that have to stay current for that contractor to be on the job at all.
This risk is easy to ignore because it is invisible right up until it is not. A contractor's general liability insurance lapses. A subcontractor was never verified. Then there is an incident, or an audit, or a client who asks to see the paperwork, and suddenly a document nobody was tracking is holding up an entire program.
Key takeaways
- Vendor compliance is portfolio risk. A lapsed certificate can stop work as surely as a missing resource.
- Track requirements and expiration dates centrally, not in scattered email folders.
- Verify before work starts and re-verify on renewal, because compliance is a moving target.
Why this is a portfolio problem, not just a procurement one
It is tempting to file vendor compliance under procurement and forget it. But from a portfolio perspective, an out-of-compliance contractor is a delivery risk identical in effect to a key resource leaving: the work cannot proceed. When several projects share the same vendors, one expired certificate can ripple across the portfolio. That makes compliance status something portfolio leaders should be able to see, not a detail buried two layers down.
What you are actually tracking
For each vendor or contractor, compliance usually comes down to a short list: the required coverage types and limits, the certificates of insurance that prove them, any licenses or certifications the work demands, and the expiration date on each. The challenge is rarely understanding the requirements. It is keeping the documents current across dozens of vendors, each on its own renewal cycle, without the whole thing living in one person's inbox.
Make compliance a tracked status, not a fire drill
The organizations that handle this well treat compliance as a standing status with dates and owners, the same way they treat project milestones. Each vendor has a record, each required document has an expiration, and something flags the renewal before it lapses rather than after. For portfolios with a large or constantly changing roster of vendors, dedicated certificate of insurance tracking software automates the collection and expiration monitoring so a lapse gets caught before it stops the work. The tool matters less than the habit: verify before work begins, re-verify on renewal, and keep the status visible to the people accountable for delivery.
Fold compliance into the gate
The natural place to enforce this is at a project gate. Before a project that depends on external vendors moves into delivery, vendor compliance should be a checklist item in the stage-gate process, alongside the project budget and capacity. That ties it into the same portfolio governance machinery that controls everything else, instead of leaving it as an afterthought that only gets attention when something goes wrong. A compliance lapse caught at a gate is a quick fix. The same lapse caught during an incident is a crisis.
The documents behind the program
Vendor compliance is one example of a broader truth about project portfolios: a surprising amount of delivery risk lives in documents, not in the plan. Contracts, certificates, statements of work, and approvals all carry information the portfolio depends on, and all of it has to be captured and kept current. For how to handle that document load at scale, see from project documents to portfolio data.
Frequently asked questions
What is a certificate of insurance?
A certificate of insurance (COI) is a one-page document from an insurer that proves a vendor or contractor carries specific coverage, such as general liability or workers' compensation, with named limits and effective dates. On a project it is the evidence that a contractor's insurance is real and current. It is a summary, not the policy itself, so it can lapse or be canceled without the certificate updating.
What does a certificate of insurance cover?
A certificate of insurance lists the coverage types a vendor holds, most commonly general liability, professional liability, workers' compensation, and auto, each with policy limits and expiration dates. On projects it is used to confirm a contractor carries the coverage the contract requires before work begins. Read the actual limits and dates rather than assuming the certificate alone means the vendor meets your requirements.
How do you track certificates of insurance for multiple vendors?
Track certificates of insurance in one central record with a field for each vendor's required coverage, the certificate on file, and its expiration date, then set a reminder that fires before each expiry rather than after. For a large or changing vendor roster, tracking software automates collection and expiration monitoring. The principle holds regardless of tooling: verify before work starts, re-verify on renewal, and keep the status visible to whoever owns delivery.
Why is vendor compliance a portfolio-level concern?
Vendor compliance is a portfolio concern because an out-of-compliance contractor is a delivery risk identical in effect to losing a key resource: the work cannot proceed. When several projects share the same vendors, one lapsed certificate can ripple across the portfolio at once. That makes compliance status something portfolio leaders should be able to see at a glance, not a procurement detail buried two layers down.