CoA should have been on the bottom or the inside of the battery compartment. Also check the inside of the memory cover. But, on an old unit it wouldn't surprise me if it just plain wore away.
It's also possible that someone in the company pilfered it when Enterprise was installed. They shouldn't have, since (a) the CoA is linked to the machine per EULA, and (b) Win7 Enterprise licensing normally required a valid CoA for some other version of Windows to be present on the machine, but it's possible.
For $50, there's also
this option but for just three times that, he would be far better off with a refurbished Lattitude E6420.