Vendor Compliance Checklist: Documents to Collect

A vendor compliance checklist tells you exactly which documents to have on file before a vendor starts work, and which of them you’ll need to collect again later. Without one, every new vendor turns into a guessing game, and the gaps only show up when something goes wrong. Below is a checklist organized by document type, with notes on what to check in each one and which documents expire.

This article is general information, not legal or insurance advice. Check your contracts and talk to your insurance broker or attorney about your situation.

Not every vendor needs every document. A cleaning company and a software consultant carry very different risks, and your requirements should reflect that. If you’re setting up the whole process (risk tiers, collection, review, renewals, enforcement), start with the vendor compliance management guide. This post focuses on the documents themselves.

The vendor compliance checklist at a glance

Use this table as your master list. Mark which rows apply to each type of vendor you work with.

Document	Who usually needs it	Expires?	What to check
Certificate of insurance: general liability	Almost any vendor who works on your property	Yes, usually yearly	Insured name, dates, limits, certificate holder
Certificate of insurance: workers compensation	Vendors with employees doing physical work	Yes, usually yearly	Policy dates, employer’s liability limits, state rules
Certificate of insurance: commercial auto	Vendors who drive for the job	Yes, usually yearly	Covered autos, combined single limit
Certificate of insurance: umbrella or excess	Higher-risk vendors	Yes, usually yearly	Limits, policy dates
Certificate of insurance: professional liability (E&O)	Consultants, designers, IT, engineers	Yes, usually yearly	Limits, policy dates, claims-made details
Endorsements (additional insured, waiver of subrogation)	Where your contract requires them	Tied to the policy term	The endorsement page itself, read by a person
IRS Form W-9	Every US vendor you pay	No set expiry	Signed, legal name and TIN match your records
Business license	Most vendors, depending on city and state	Often yes	Name, license number, expiry
Contractor or trade license	Trades where the state or city requires one	Yes	Status on the issuing board’s lookup
Professional license	Licensed professionals (nurses, engineers, and so on)	Yes	Status on the state board’s lookup
Industry certifications (OSHA, ISO, others)	Depends on the work and industry	Varies	Who issued it, scope, dates
Business associate agreement (BAA)	Healthcare vendors who handle protected health information	Follows the contract term	Signed by both sides, current
Master services agreement (MSA)	Ongoing vendors	Follows the contract term	Signed, insurance clause included, term dates
Non-disclosure agreement (NDA)	Vendors who see confidential information	Follows its own term	Signed, covers the right parties

The rest of this post goes through each group.

Insurance certificates

Insurance is the core of most vendor compliance checklists, because it’s what pays if a vendor injures someone or damages property while working for you.

In the US, proof of liability insurance usually arrives as an ACORD 25, the standard certificate of liability insurance form published by ACORD. One certificate can list several types of coverage. If you haven’t worked with these forms before, our guide on how to read an ACORD 25 walks through every section.

General liability

Covers bodily injury and property damage caused by the vendor’s operations. On the certificate, the limits usually include each occurrence, general aggregate, and products-completed operations aggregate. This is the most common requirement for any vendor who sets foot on your property.

Workers compensation and employer’s liability

Covers the vendor’s own employees if they’re hurt on the job. If an uninsured vendor’s worker is injured at your site, you can end up in the middle of it. Workers comp rules vary by state, including who is required to carry it, so ask your broker how to handle sole proprietors or vendors who say they have no employees.

Commercial auto

Needed when the vendor drives as part of the work: delivery, mobile repair, landscaping crews with trucks. Personal auto policies often don’t cover business use, so ask for the commercial policy.

Umbrella or excess liability

Adds limits above the general liability, auto, and employer’s liability policies. Higher-risk vendors (roofers, electricians, tree services) are often required to carry it.

Professional liability (errors and omissions)

Covers financial loss caused by a vendor’s mistake or bad advice, rather than physical injury. Common for consultants, engineers, architects, accountants, and IT vendors.

Endorsements: the part that needs a human

If your contract requires the vendor to name you as additional insured, or to provide a waiver of subrogation or primary and non-contributory coverage, those are endorsements to the policy. A checkmark in the ADDL INSD or SUBR WVD column on the certificate isn’t enough on its own: the certificate states that it’s issued for information only and doesn’t change the policy.

Ask the vendor for the endorsement page, read it, and check that it names you (or covers you through blanket wording). If you’re unsure what it means, ask your broker. Software won’t do this step for you. CertiTrack reads dates, policy numbers, insurers, and coverage amounts from certificates, but it does not verify endorsements or policy wording.

Tax documents

Form W-9

The IRS Form W-9 is how a US vendor gives you their legal name, entity type, and taxpayer identification number (TIN). You need it to issue year-end information returns such as Form 1099-NEC. Collect it before the first payment, not in January when you’re filing.

What to check:

• The form is signed and dated.
• The name matches the vendor you’re paying (the legal name, not just the trade name).
• The entity type is filled in.

A W-9 doesn’t have an expiration date, but request a new one whenever a vendor tells you their name, business structure, or TIN has changed. Your accountant can tell you how often to refresh them for your situation.

Licenses

Business licenses

Many cities, counties, and states require businesses to hold a general business license. Renewal cycles vary by location, and many renew yearly. Record the license number and expiration date.

Contractor and trade licenses

Electricians, plumbers, HVAC technicians, general contractors, and other trades often need a state or local license for the work they do. Requirements vary a lot by state and by type of job. Most licensing boards offer an online lookup: check that the license is active and that the name on it matches the business you hired.

Professional licenses

Nurses, therapists, engineers, architects, and other licensed professionals hold licenses issued by a state board. These renew on a set cycle. For healthcare staffing vendors, check each individual’s license, not just the agency’s paperwork.

Industry certifications

Certifications prove a vendor meets a standard beyond the legal minimum. Which ones matter depends on your industry:

• OSHA Outreach training cards (10-hour and 30-hour) show that workers completed safety training through OSHA’s Outreach Training Program. Some states, owners, and general contractors require them on job sites, and some set their own refresh rules.
• ISO certifications, such as ISO 9001 for quality management, are common for manufacturing suppliers. Certificates are issued by a certification body for a set period, with surveillance audits in between, so check the dates and the scope listed on the certificate.
• Trade-specific certifications, for example lead-safe or asbestos certifications in construction and property work.

Record the issuing body and the expiration date, if there is one. If a certification has no printed expiry, note when you last confirmed it.

Contracts and agreements

Master services agreement (MSA)

The MSA sets the ground rules for an ongoing relationship: scope, payment terms, liability, and, most importantly for compliance, the insurance requirements. If your insurance minimums aren’t written into the contract, they’re hard to enforce. Check the term and renewal dates.

Non-disclosure agreement (NDA)

Needed when a vendor will see confidential information: financials, customer lists, building access codes, system credentials. Check that it’s signed by the right legal entities.

Business associate agreement (BAA)

If you’re a healthcare organization covered by HIPAA and a vendor creates, receives, maintains, or transmits protected health information for you, HIPAA requires a written business associate agreement. HHS publishes guidance and sample contract provisions. Billing companies, IT providers, shredding services, and cloud software vendors are common examples. More on healthcare-specific documents is on the healthcare page.

Want this on paper? Download the free printable vendor compliance checklist (PDF, no sign-up), with an “on file” box and an expiry date line for each document.

Which vendor documents expire

This is the part that causes the most trouble. A document you checked once doesn’t stay valid forever.

Expires on a fixed date	Follows a contract term	No fixed expiry, but recheck
Insurance certificates (all lines)	MSA	W-9 (when details change)
Business licenses	NDA	Certifications without a printed date
Contractor and professional licenses	BAA
Many industry certifications

For everything in the first column, record the expiration date the day the document arrives and set reminders well ahead of it. Insurance is usually the most urgent: policies commonly renew every year, and a vendor can be fully compliant in March and uninsured in April without anyone noticing. Our certificate of insurance tracking guide covers the renewal side in detail.

Tracking this by hand works for a few vendors. Past that, a tool helps. CertiTrack reads the expiry date from uploaded documents (you confirm it) and emails the vendor 90, 60, 30, and 7 days before each one expires, with a copy to your team. Its Free plan covers up to 5 vendors; see pricing for more.

Common questions

What documents should I get from a new vendor?

At minimum, a W-9 and a certificate of insurance showing general liability. Add workers compensation, auto, licenses, and agreements based on the work they’ll do and the risk involved.

How long should I keep vendor compliance documents?

Keep every version for as long as your contracts, your insurer, or your accountant say you should, and longer for anything tied to a claim or dispute. Don’t delete an old certificate when the new one arrives: it shows what was in force on a given date.

Can a vendor send a photo of a certificate instead of a PDF?

A clear photo or scan is usually fine for your records, as long as every section is readable. If anything is cut off or blurry, ask for the PDF from their insurance agent.

Do I need a vendor compliance checklist for each vendor?

Use one master checklist, then mark which documents apply to each vendor type. That keeps requirements consistent and makes it obvious when something is missing.