The Certificate Expired and the Work Carried On

Subcontractor compliance is treated almost everywhere as an admissions test. The documents are collected before the first gang arrives, somebody senior looks through them, the file goes into a drawer or a shared folder, and the subcontractor starts work. What that process controls is the day they were engaged. What matters legally is the day something happens — and on a contract running fourteen months, those are rarely the same day.

The documents that decide your exposure are precisely the documents that expire. A workmen's compensation policy runs a year. A tax compliance certificate runs a year. NCA registration renews annually. Public liability runs to a policy date. Every one of them can lapse quietly halfway through a contract while the subcontractor keeps working, keeps invoicing, and keeps sending people up scaffolding — and the only party with an incentive to mention it is the one who would have to pay for the renewal.

This article is about the difference between a gate and a state, and about a specific and slightly absurd asymmetry in how most systems — including this one — handle the two.

The gate is well built. The state is not watched.

Take the onboarding side first, because it is genuinely solid and it is worth knowing what you already have:

Read those four together and the shape of the problem appears. There is a validity date. There is a scheduled job that acts on it. What the job does is set the application to expired and switch the linked vendor inactive, so a lapsed subcontractor silently drops out of every future [request for quotation](/glossary/request-for-quotation). That is a real control and a well-chosen consequence. It is also completely silent: the job writes a line to the application log and notifies nobody. The first human-visible symptom is a vendor who is no longer on a shortlist, noticed by a buyer who assumes somebody deactivated them on purpose.

The asymmetry worth knowing about

Here is the part that is genuinely odd, and worth stating plainly because it changes what you should ask a vendor. The reminder machinery exists. Document Vault files carry an expires_at timestamp, and there is a scheduled command that runs every morning, finds vault files inside thirty days of expiry, and emails the organization about them. It works, it respects notification preferences, and it is exactly the mechanism a compliance register needs.

It is filtered to two model classes: employees and employment contracts. An HR document with an expiry date produces a thirty-day warning. The identical field, on the identical table, attached to a supplier produces nothing. Meanwhile the central vault upload screen labels that field "Access Expiry" — and it means it: once the date passes, viewing or downloading the file returns a hard error. For a compliance document that is the opposite of the desired behaviour. You want a warning before the date and continued access to the historic document forever, because the expired policy is the evidence of what was in force last year.

The same date field on the same table warns you about an employee's work permit and says nothing about a subcontractor's liability policy.

Not a missing feature — a feature pointed at one module

One more detail closes the picture: attachments on transactional records — expenses, purchase orders, requisitions, quotations, assets — accept a file, a title, a description and a classification. They do not accept an expiry date at all. And a vendor is not an attachable record, so the subcontractor's current insurance certificate has no home on the subcontractor.

Which documents you actually need, and what the system knows about them

The four document types the prequalification form asks for by name are incorporation, tax compliance, bank details and portfolio. Now compare that list against what a Kenyan main contractor genuinely needs from a subcontractor before allowing them on site:

The pattern in that table is not random and it is worth naming. Of the four documents the form asks for by name, three never expire — a certificate of incorporation is issued once, bank details change but do not lapse, a portfolio is a claim about the past. The documents that carry dates and therefore carry risk are either unnamed, or named without a date. The four that matter most on a construction site are not in the list at all; they go in as "other", where nothing distinguishes a lapsed liability policy from a company brochure.

The pattern that works with what exists

1. Set the qualification date to the earliest certificate, not to a year from today

   There is one qualified_until per supplier and there are five documents with five dates. So make the single date mean something: set it to the earliest expiry among the certificates that matter. When it fires, the vendor deactivates, and re-qualifying forces a fresh look at all of them. It is a blunt instrument used precisely — the whole file is re-checked because one item lapsed, which is the conservative direction to fail in.

2. Capture each document's expiry as a required custom field

   Custom fields are available on vendors and on supplier applications, and they can be made mandatory. Add a date per certificate — WIBA expiry, NCA expiry, TCC expiry, liability expiry. Nothing will watch these dates, but they become filterable and exportable, which turns "who is lapsing this quarter" from an archaeology exercise into a report you can run.

3. Put a recurring task on the notice deadline, not the expiry date

   Recurring tasks genuinely spawn on a schedule — it is the one reliable reminder mechanism for anything the compliance side cannot watch. Date it three or four weeks before the certificate lapses, because chasing a renewal on the day it expires means a subcontractor stood down. This is the same workaround that service contracts and auto-renewals need, for the identical reason: the controls are event-driven and an expiry raises no event.

4. Never set an Access Expiry on a compliance document

   It is access control, not a compliance clock. Setting it makes the document unreadable after the date, which destroys exactly the evidence you would want in front of an insurer or an inspector. Leave it blank and let the certificate live in the vault permanently.

5. Re-verify at the payment, not at the renewal

   Renewals get chased when someone remembers; payments get processed every month without fail. Tie the check to the thing that already happens reliably — a compliance confirmation as part of certifying the subcontractor's monthly valuation, held as a required field on the record. The strongest control in a construction chain is almost always the one attached to money, which is why valuing work rather than processing a claim is the right place to hang it.

What to ask any vendor selling you compliance tracking

Frequently asked questions