Ask a facilities leader about invoice exceptions and you get a number. Top-performing organizations hold them under 10 percent, and most teams review them on a cadence because they show up every month, in volume, in front of finance.
Ask the same leader when the insurance certificate for their busiest HVAC vendor expires, and the room gets quiet.
ClearFM considers this the most underestimated failure in facility operations. Compliance lapses, specifically certificate of insurance expirations and licensing issues, happen far less often than invoice exceptions. That low frequency is exactly why they get neglected. And when one surfaces, it carries the highest price tag in the portfolio.
Why Low-Frequency Risks Get the Least Attention
Operating rhythms follow volume. Invoices arrive weekly, so invoice controls get built. Work orders close daily, so completion tracking matures. A certificate of insurance renews once a year, and a state license renews on its own calendar — neither generates the repetition that forces a real process into existence.
The mechanics of a lapse are quiet. A provider misses a premium payment and the policy drops mid-term. A renewal deadline with an individual state passes without anyone noticing. A certificate that looked valid at collection was already deficient. The International Risk Management Institute audited hundreds of contractor insurance programs and found that more than 9 out of 10 certificates of insurance failed to meet the insurance specifications in the underlying contract, while every certificate on file appeared fully compliant. The work continues after coverage disappears. Invoices process. Dashboards stay green. Nothing flags it.
The failure shows up at the only moment the coverage actually mattered.
The Cost Structure Is Inverted
An invoice exception costs you a dispute, some AP hours, and occasionally an overpayment. A compliance lapse costs you your insurance standing.
When an incident occurs during a coverage gap, the liability moves to the building owner. One documented insurance compliance case involved an electrical fire that caused $1.2 million in damages. The general contractor had a certificate on file but had not verified that the additional insured endorsement was actually in place. The insurer denied the claim. The contractor paid the full amount out of pocket, plus $175,000 in legal fees, then absorbed a 35 percent premium increase at the next renewal. Insurers reassess risk with every claim, and premiums build on each other for years.
ClearFM puts it plainly: invoice exceptions are a recurring tax you can measure and manage. A compliance lapse is a balance sheet event you find out about after the fact.
The Real Problem Is Who Owns the Record
Across multi-site portfolios, ClearFM sees compliance tracking living in one of three places. Each one fails structurally.
The spreadsheet. A coordinator maintains a workbook where column F holds expiration dates. The record is private by default, error-prone, and it leaves with the person who built it. One resignation and that tracking system is gone.
The vendor. National contractors often track their own credentials and their subcontractors’ credentials too. That places the record inside the system of the party being verified. The organization carrying the liability holds no direct visibility into it. According to the Bureau of Labor Statistics’ Census of Fatal Occupational Injuries, building and grounds cleaning and maintenance workers recorded 337 fatalities in 2023 alone. The people doing the work on your buildings operate in a genuinely high-risk environment. Whether their coverage is current matters.
The dashboard someone else controls. A vendor management team owns a compliance tool, and when that team gets pulled into higher-priority work, an expiration alert sits unread. The lapse goes unnoticed for months because monitoring depends on someone’s attention rather than on the workflow itself. That’s a real difference. Attention is not a system.
In all three cases, the record sits outside the decision it needs to protect. The certificate expires in one system while the dispatch happens in another, and nothing connects the two.
What Structural Compliance Looks Like
ClearFM’s position is that accountability has to be built into the workflow. Asking people to remember a renewal date is not a process. It’s optimism with a deadline on it.
Three things change the risk profile.
Make documentation a precondition of assignment. The person dispatching work sees, at that moment, whether the provider is currently approved for the trade, the region, and the dollar threshold. A lapsed certificate intercepts the assignment before a technician reaches the site. This one matters most, honestly, because it removes the human memory requirement entirely.
Own the authoritative record. Compliance status belongs in a system your organization controls, attached to the provider record, visible to everyone who assigns work and not just one coordinator who may or may not check it this week.
Surface expirations to a named owner ahead of time. Catching a certificate 60 days before it lapses, with a specific person accountable for resolution, turns a silent failure into a routine task.
Invoice discipline deserves its cadence and its sub-10-percent target. Compliance deserves the same rigor, because a single incident can make it the most expensive line item in the portfolio. Not a theoretical risk. A documented one.
One question worth asking your team this week: if your largest provider’s certificate expired yesterday, name what would stop them from being assigned work today. The answer tells you exactly where the exposure sits.
