Automating compliance expiry tracking

Put every certificate, licence and policy in one SharePoint list with a named owner and an expiry date, then let a daily Power Automate flow send escalating reminders at 60, 30 and 7 days and assemble the evidence on demand. Almost every organisation tracks expiries in a spreadsheet that one person maintains, and almost every one of them has been caught out at least once. It is a small build — usually about two weeks — with a genuine risk reduction.

Why the spreadsheet fails

The spreadsheet is not the problem on its own. The problem is that it only works while one particular person opens it, scans the dates column, and remembers to email the right people. When that person is on leave, busy at month end, or leaves the business, the system stops — silently.

Three failure patterns come up again and again:

• Nobody looked. The date was in the sheet; nobody opened the sheet in the right week.
• Everybody assumed. The reminder went to a shared inbox, and each person who saw it assumed someone else was handling it.
• The evidence is somewhere. The renewal happened, but the new certificate is in someone's email, so when the auditor or funder asks, it takes days to find.

Automation fixes the first. Ownership fixes the second. The evidence pack fixes the third. You need all three. We cover the wider cost of running things this way in the real cost of a spreadsheet.

What usually needs tracking

The list is broader than most people expect once you start writing it down. Typical items by sector:

You do not need to load all of it on day one. Start with the items where a lapse stops work or breaches a contract, then add the rest once the reminders are trusted.

The structure

A single list with these columns:

• What it is — police check, first aid, white card, insurance certificate. A choice column, not free text, so you can filter and report.
• Who or what it belongs to — a person column for staff items, a lookup to a subcontractor or asset register for everything else.
• Owner — the person responsible for renewal, not the person who filed it.
• Expiry date — a date column, required.
• Evidence — the actual document attached, or a link to it in a controlled library.
• Status — current, expiring, expired. Calculated by the flow each day, never typed by hand.

The owner column matters most. Most failures are not "we did not know", they are "we all assumed someone else was handling it". For a staff member's own first aid certificate the owner might be the staff member; for a subcontractor's insurance it is usually the project or contracts administrator who engages them.

The reminders

Escalating, and to a person rather than a shared inbox:

• 60 days — to the owner. Enough lead time to book the course.
• 30 days — to the owner and their manager.
• 7 days — to the owner, their manager, and the compliance lead.
• On expiry — flagged in a report to leadership.

Escalation is what makes it work. A single reminder to a shared inbox is how the current spreadsheet already fails.

A few details separate a reminder system people trust from one they mute:

1. Send to Teams and email, once each. Not daily. A reminder that repeats every morning trains people to ignore it.
2. Link straight to the record. The message should open the exact item, with an upload button for the new evidence. Every extra click is a reason to defer.
3. Reset on renewal. When someone updates the expiry date and attaches the new document, the cycle restarts without anyone touching the flow.
4. Handle leavers. If the owner's account is disabled, route the reminder to their manager and flag the record for reassignment. Otherwise items quietly lose their owner when staff turn over.

The evidence pack

The step people forget. When an auditor or funder asks for evidence, a flow that assembles current certificates into a single folder turns a week of reconstruction into a button.

In practice that is a second flow, started manually from the list or from a Teams message. It filters for the scope you choose — one project, one funding program, one team — copies the current evidence for each record into a new dated folder, and writes an index listing each item, its owner and its expiry date. You send the auditor a link to the folder, with access that expires.

The numbers are illustrative and easy to check against your own: count the records an auditor typically asks about, and time how long it takes to find one current certificate today. The bigger benefit is less visible — you find the gaps before the auditor does, because the pack shows which records have no evidence attached.

How the build runs

The excerpt says two weeks, and that holds for a single register with the reminders and evidence pack described here. Most of that time is not building; it is getting the data clean and the owners agreed.

Retiring the spreadsheet is part of the build, not an optional extra. If the old sheet stays open, people will keep updating it "just in case", and you will have two sources of truth instead of one.

What it costs

There are two ways to buy this. If it is the main thing you want automated, it is a scoped build — ours start from $10,000, and an expiry register usually sits inside that alongside a related process such as subcontractor onboarding or induction. If you already have us on a retainer (from $3,000 a month), a single register like this often fits inside a month of retainer work.

On licensing, the standard version runs on SharePoint and Power Automate capabilities included in most Microsoft 365 business plans, so for most organisations there is no new licence to buy. Check your own plan before assuming — if you want to pull data from a premium source such as an HR system's API, that changes the licensing for the people who run the flow.

Compare the build cost to one lapsed insurance certificate discovered during an incident.

When it is not worth building

Be honest about scale. If you track a dozen items and one careful person owns all of them, a shared Outlook calendar with reminders may be enough for now. The build earns its keep when there are enough records, owners or sites that no single person can hold it in their head — or when an auditor, funder or principal contractor expects you to produce evidence quickly.

It is also not worth automating a register nobody agrees on. If you cannot say who owns subcontractor insurance today, settle that first. Our note on writing the process down before you automate applies here exactly.

What to do next

Pull together every expiry you currently track — the spreadsheet, the calendar reminders, the folder of certificates — and count the records and the people who own them. If the count is in the dozens and the owners are spread across teams or sites, this is worth building. If you want help deciding whether it belongs in a larger piece of work, our Power Automate service page shows how we scope it, and the free diagnostic audit will tell you where it ranks against your other candidates.

Expiry tracking is the cheapest risk reduction available in the Power Platform. It is also the one most often postponed.