A regional general contractor carrying 230 active subcontractors, with a risk manager running the cert wall on spreadsheets and reminder emails. We rebuilt the COI desk as a pipeline: LlamaParse and Google Document AI on the intake, Procore and a custom risk register as the system of record, a renewal cadence the risk team runs without us.
| Sub | Carrier | GL / Umbrella | AI endorsed | Expires | Status |
|---|---|---|---|---|---|
| Ridgeway Electric | Travelers | $1M / $5M | CG 20 10 | 2026-09-30 | current |
| Carolina Mechanical | Liberty Mutual | $1M / $5M | CG 20 10 | 2026-11-14 | current |
| Tarheel Drywall | The Hartford | $1M / $2M | CG 20 10 | 2026-05-22 | limit short |
| Piedmont Steel Erectors | Zurich | $1M / $10M | CG 20 10 | 2026-08-01 | current |
| Blue Ridge Concrete | Chubb | $1M / $5M | pending | 2026-07-18 | AI missing |
| Sandhills Sitework | Travelers | $1M / $5M | CG 20 10 | 2026-12-03 | current |
| Coastal Roofing Co. | Liberty Mutual | $1M / $5M | CG 20 38 | 2026-05-12 | renewal in flight |
| Cape Fear Glass | The Hartford | $1M / $5M | CG 20 10 | 2026-10-09 | current |
| Magnolia Plumbing | Zurich | $1M / $5M | CG 20 10 | 2027-02-26 | current |
At a glance
One risk manager, 230 subs, the contract insurance schedule as the source of truth. Everything else was implementation detail.
The engagement
The stack
ISO 27001 · ISO 9001 · DPA and NDA signed at kickoff.
Before, the cert wall
The desk worked. It worked the way desks work when one risk manager tracks 230 subs on a spreadsheet and nobody tells her when a policy cancels mid-term. These were the three patterns we found in discovery.
The risk manager kept a spreadsheet with expiry dates, but policies renewed on the sub's anniversary, not on the GC's calendar. When renewal pings went out by hand, half the subs missed the window. On any given day, roughly 16 of the 230 active subs had a lapsed cert.
Pre-build baseline: 7% of subs lapsed on the cert wall at any given moment across the prior fiscal year.
Every master subcontract had an insurance schedule with limits, endorsements, and additional insured wording. The risk manager knew the schedule cold, but checking a new COI against it meant reading the certificate line by line. Discrepancies surfaced at site access, not at intake.
Pre-build baseline: approximately 12% of COIs had a limit or endorsement discrepancy missed at intake and caught at the gate.
The risk manager sent renewal pings 30 days before expiry, manually, from her own Outlook. When she was out, the pings stopped. The first sign of a lapse was a phone call from a superintendent at the gate, on the day, in the rain.
Pre-build baseline: renewal pings stopped every vacation window; lapses clustered in those weeks.
What we built
The pipeline follows the same five stages we run on every construction engagement. The details below are the ones we actually implemented for this contractor, not a generic template.
Broker email polled on a 15-minute cadence. Sub email routed via a secure mailbox. Procore uploads captured via webhook. All normalised to a single COI ID per sub per policy year.
Document type tagged on ingest. Acord 25 routed to LlamaParse, sub policies routed to Google Document AI, handwritten endorsements routed to LandingAI. Below 0.90 confidence, the document holds for risk tagging.
Carrier, policy number, effective and expiry dates, coverage limits by line, additional insured wording. LlamaParse primary, Google Document AI fallback for certificates with non-standard layouts.
Limits compared to the contract insurance schedule for each sub's master. Additional insured wording matched to the contract language. Expiry registered for the renewal cadence. Below threshold, held for risk review.
Current COIs posted to Procore's compliance module and the custom risk register. Renewal pings scheduled at 45, 30, and 14 days. Exceptions routed to the risk manager with the flag in plain English.
After, the numbers the desk signs off
Same risk manager, same subs, same brokers, same master subcontracts. The pipeline read every cert on arrival and ran the renewal cadence for her. What changed was the wall, not the operation.
The risk manager still owns the schedule calls. She still signs off every new sub against a master. The difference is that on a clean day, the renewal pings go out without her clicking send. On a bad day, the cert wall shows a red dot at the 14-day mark, not at the site gate.
From the desk
I stopped sending renewal pings from my own inbox. A year in, we have not had a lapse on the cert wall.
Risk managerRegional contractor, Raleigh
Handover
The engagement ends at a clean handover. The risk team runs the pipeline; Hexaa stays on call for a fixed retention period, then steps back.
Related cases
Each links to a named client, a named document, and the system the clean data lands in. We publish only what the client signed off to publish.
Submittal log reconciliation against the prime contract spec. 1,200 submittals per project, Procore as the system of record.
→Construction · 2024Infra contractor · AIA pay-app routingAIA G702/G703 reconciled against the schedule of values with retainage rules inside the approval path. 98% first-pass accuracy.
→Construction · 2026Mid-market GC · AIA A201 clauses against the house positions180-page MSAs triaged in 8 minutes against a 34-clause house taxonomy. LlamaParse, LandingAI, and DocuSign CLM in the loop.
→Free 30-minute call
You'll leave with a clear next step.
The Acord 25 says one set of limits, the master subcontract schedule says another, the additional insured endorsement either reads the right wording or it does not. The pipeline compares all three at the field level, flags the gap, and holds the COI until the broker responds.
