Do you require current insurance certificates to be maintained at all times?

Does this apply to all vendors? If not, what is your methodology for this requirement?

I would suspect every vendor might be difficult to track. Why not use a risk based approach for you vendors and obtain insurance verification for you critical and high risk.

We absolutely obtain insurance for critical vendors but as risk dwindles from there, I was trying to determine a cut off point that made sense and wondered what others were doing.