Certificates of Insurance: An Important Part of Vendor Risk Management

Hiring contractors and vendors is a routine part of operating a condominium, homeowners association, commercial property, or other organization. From landscapers and plumbers to roofers, electricians, restoration companies, and general contractors, these vendors perform essential work—but their operations can also introduce significant liability.

A well-designed insurance and contractual risk-transfer process can help ensure that when something goes wrong, the responsibility—and the insurance intended to respond—rests with the appropriate party.

One of the most familiar parts of that process is the Certificate of Insurance (COI). However, simply obtaining a certificate is not enough. It is equally important to understand what the certificate should show, what supporting documentation may be necessary, and how the vendor agreement works together with the vendor’s insurance coverage.

What Is a Certificate of Insurance?

A Certificate of Insurance is a document summarizing certain insurance policies carried by a contractor or vendor, typically including policy types, insurance carriers, policy numbers, effective and expiration dates, and limits of insurance.

It is important to remember that a certificate is evidence of insurance—it is not the insurance policy itself. A COI generally does not create, expand, or amend coverage. The actual policy terms and endorsements ultimately determine whether coverage applies.

For that reason, reviewing a COI should be viewed as an important first step in the risk-management process, rather than the final one.

Start With the Appropriate Insurance Coverage

Insurance requirements should be tailored to the work being performed and the exposures involved. Depending on the vendor and project, required coverage may include:

• Commercial General Liability
• Workers’ Compensation and Employers Liability
• Commercial Automobile Liability or Hired and Non-Owned Auto Liability
• Umbrella or Excess Liability
• Professional Liability
• Pollution Liability
• Cyber Liability
• Other specialized coverage appropriate to the work

The limits should also be appropriate for the size and nature of the project.

Beyond confirming that coverage exists, several important risk-transfer provisions should be considered.

Additional Insured Status

Requiring the association, property owner, or other hiring entity to be named as an Additional Insured on the vendor’s liability policy is one of the most important components of contractual risk transfer.

Additional insured status may allow the vendor’s insurance policy to provide liability protection to the hiring entity for certain claims arising out of the vendor’s work, subject to the terms and conditions of the policy and endorsement.

For example, if a contractor’s operations cause property damage or bodily injury, and the association is subsequently named in a lawsuit, properly structured additional insured coverage should provide protection to the association under the contractor’s policy.

However, listing an organization in the Description of Operations section of a COI does not necessarily establish Additional Insured status. Additional insured coverage is generally created through the actual policy or endorsement.

The certificate should indicate Additional Insured status, and the applicable Additional Insured endorsement should be obtained or verified.

Waiver of Subrogation

A Waiver of Subrogation is another important risk-transfer provision.  Ordinarily, after an insurance company pays a claim, it may have the right to pursue another responsible party to recover the amount it paid. This is known as subrogation.

A waiver of subrogation can limit the vendor’s insurer’s ability to pursue the protected party for recovery, subject to the policy language and applicable law.  The COI should indicate that a Waiver of Subrogation applies where appropriate, and the underlying policy should contain the necessary endorsement or provision.

Primary and Noncontributory Coverage

Additional insured coverage is even more valuable when the vendor’s insurance applies on a Primary and Noncontributory basis, where available and appropriate.

“Primary” generally means that the vendor’s applicable insurance is intended to respond before the additional insured’s own insurance for a covered claim.

“Noncontributory” generally means that the vendor’s insurer will not seek contribution from the additional insured’s applicable insurance, subject to the terms of the policies and endorsements.

Without appropriate primary and noncontributory language, disputes can arise over which policy should respond first or whether multiple insurers should share in a loss. As with Additional Insured status and Waiver of Subrogation, simply typing “Primary & Noncontributory” onto a certificate does not create the coverage. The underlying policy and endorsements must support it.

Don’t Overlook Policy Expiration Dates

A COI is only a snapshot of coverage at a particular point in time.  For ongoing projects and recurring vendors, insurance should remain in force for the required period. A policy that expires halfway through a project may leave a significant gap if replacement evidence of coverage is not obtained.

Organizations should therefore have a process for tracking expiration dates and requesting updated certificates when policies renew.

The COI Is Only Half of the Equation

One of the most common mistakes in vendor risk management is focusing exclusively on the Certificate of Insurance.  The written vendor agreement is equally important.

Insurance requirements and contractual obligations should work together. A properly drafted agreement can establish which party is responsible for particular risks and what insurance the vendor is contractually required to maintain.

Among other provisions appropriate to the relationship, the agreement should address the vendor’s insurance obligations and contain appropriately drafted indemnification and hold harmless provisions.

These provisions can require the vendor to indemnify and hold harmless specified parties from certain claims, damages, losses, or expenses arising from the vendor’s work, subject to applicable law.

The agreement should be reviewed by qualified legal counsel because indemnification and hold harmless provisions are subject to state law and may be limited or unenforceable if improperly drafted.

An Often-Overlooked Issue: Policy Exclusions

A contractor can carry a General Liability policy with seemingly adequate limits and still have a serious coverage problem.  The policy may contain an exclusion that eliminates coverage for the very work the contractor was hired to perform.

For example, depending upon the contractor, insurer, policy, and project, exclusions or limitations may affect roofing operations, residential construction, work above a certain height, exterior work, water intrusion, mold, excavation, subcontracted work, designated operations, or other specific exposures.

This creates a dangerous situation: the vendor technically has insurance, and the COI may look satisfactory, but the policy may not respond to a loss arising from the project.

For this reason, vendor agreements should require not only that specified insurance be maintained, but also that the vendor’s insurance does not contain exclusions or limitations that would preclude coverage for the work or operations being performed under the agreement.

For higher-risk projects, additional documentation or review of relevant policy forms and endorsements may be appropriate rather than relying solely on the certificate.

A Strong Vendor Risk-Transfer Process

An effective process goes beyond asking a contractor to “send over a COI.” Before work begins, organizations should consider confirming:

1. The vendor carries the types and limits of insurance required by the contract.
2. Coverage will remain in effect for the required period.
3. The appropriate parties are included as Additional Insureds.
4. Waiver of Subrogation applies.
5. Additional insured coverage is Primary and Noncontributory.
6. The underlying endorsements support the representations shown on the COI.
7. The vendor agreement contains appropriate indemnification and hold harmless provisions.
8. The vendor’s policies do not contain exclusions that would preclude coverage for the contracted work.
9. Higher-risk projects receive additional insurance review when warranted.

The Bottom Line

A Certificate of Insurance should not be treated as a box to check before allowing a vendor onto a property.  It is one component of a broader contractual risk-transfer strategy.  The goal is not simply to confirm that a contractor has insurance. The goal is to determine, as reasonably as possible before work begins, that the contractor has appropriate insurance for the work being performed, that the hiring entity receives the protections required by the contract, and that the contract clearly establishes the parties’ respective obligations.  A strong process combines a properly drafted vendor agreement, appropriate insurance requirements, careful review of certificates and endorsements, and additional scrutiny when the nature of the work presents significant risk. Taking these steps before a project begins can help prevent an unpleasant discovery after a loss: that a vendor had a Certificate of Insurance on

Meet the author

Meredith James

Meredith James is a graduate of Penn State University. She is a licensed 2-20 Agent with 9 years of insurance experience. She is the Vice President of Travers Hartnett Insurance Commercial Lines Service team. Meredith upholds the Agency’s high standard in customer service & maintaining relationships with our clients.