Track validity, not receipt
The useful state of an evidence item is not whether it was received but whether it is valid now. That requires the issue date, expiry date, scope and issuer to be recorded as fields, not buried in a PDF.
Once those fields exist, expiry reporting is trivial: valid, expiring soon, expired, missing, under review.
Check scope, not just the logo
A certificate that covers a different legal entity, a different data centre or a subset of services is common and easy to miss. Record the scope statement alongside the dates and compare it to the service you actually consume.
Automate the request cycle
Renewal requests should be generated from the expiry date, not from a person's calendar. A request sent sixty days before expiry, with a reminder cadence and a portal upload link, keeps the file current without a chase list.