Procurement collected certificates of insurance from contractors at onboarding three years ago and never rechecks them at policy renewal. What control gap does this create?
Select an answer to reveal the explanation.
Short Explanation
A COI from three years ago is like a milk carton with last decade's date — filing it once doesn't keep the coverage fresh. You have to track renewals or you're trusting a ghost policy.
Full Explanation
COI controls need ongoing renewal tracking, not a one-time file-and-forget collection is the gap when procurement imaged certificates at onboarding three years ago and never rechecks at policy renewal. Coverage lapses silently while vendors keep working. Civic procurement must calendar renewals, block expired vendors, and refresh limits as contracts evolve.
Claiming COIs remain permanently valid once imaged into the vendor master fails by concept because insurance policies expire and cancel; images are snapshots, not perpetual coverage. Claiming renewal tracking is required only for vendors who never perform on-site work fails because on-site vendors are typically higher priority for current COIs, not exempt—and off-site vendors may still need coverage depending on services. Claiming acceptance of expired coverage is automatic after the first COI is archived fails because archiving old evidence is not a conscious acceptance decision about present uninsured performance.
Exam caveat: CRMC transfer verification is continuous for as long as the vendor performs. One-time onboarding COI collection is incomplete control design.
Operational check: Implement COI expiration alerts for active municipal contractors; require renewal before anniversary; quarantine work authorization when coverage lapses; sample the vendor file for current certificates quarterly.