The reasons for not doing this can be organizational (shared calendars are a pain), laziness, lack of documentation (we know it expired, but we don’t know/remember how to update it) or task overload (the new certificate solved an incident likely because the previous instance expired without warning and now it is past office hours and everyone goes home and tomorrow there’s a different incident, so no one follows up, repeat next year).

Granted, I’ve been guilty of all of those, but a calendar should be all that you need.