A certificate on a wall can still be expired
Attach the current file when storage is on.
Compliance certificates are dated. Auditors will ask for the current one. A drive folder called "certs" with six versions is not a system. One item per certificate, with expiry and an owner, is.
Examples
ISO 27001, PCI if you hold it, lift inspections, PAT testing, food hygiene, training expiry for named people.
People vs sites
A first-aid certificate belongs to a person. A fire alarm cert belongs to a site. Use the holder field. Do not mix them into one "compliance" row.
Evidence
Keep the current PDF on the item. When you upload a new one, confirm the extracted dates if the product asks. Wrong dates in the tracker are worse than no tracker.
FAQ
Does this replace an ISMS?
No. It reminds you when a piece of paper dies.
Can employees see only their own?
Seat and permission models vary. If you need strict HR isolation, keep people certs in HR software and site certs here.