A Certificate of Insurance is one of the most commonly required vendor documents and one of the most commonly mishandled. Companies collect COIs, file them, and forget them. Then an audit, an incident, or a vendor relationship gone wrong surfaces the problem.
This guide covers what a COI actually contains, what to verify when you receive one, and how to build a system that does not depend on calendar reminders and email chains.
What a Certificate of Insurance Actually Is
A COI is evidence that summarizes policy information as of the certificate's issue date. It is not the policy, does not amend coverage, and does not by itself guarantee that coverage remains in force. It commonly lists the insured, policies, limits, policy periods, producer, and certificate holder.
ACORD 25 is a common certificate form for commercial liability insurance, but other forms and evidence may be used.
What to Check on Every COI
Insured Name
Compare the named insured with the legal entity performing the work. A trade name, affiliate, or similarly named company may or may not be covered; resolve discrepancies with the producer or insurer instead of assuming.
Your Company as Certificate Holder
If your process requires it, confirm your company name and address appear in the certificate-holder box. Certificate-holder status alone does not create coverage or confer additional-insured rights.
Coverage Types
The coverage types you require depend on the nature of the work. The most commonly required:
- General Liability: covers bodily injury and property damage caused by the vendor's operations
- Workers' Compensation: requirements and permitted alternatives vary by state and employer; it generally addresses work-related employee injury or illness
- Professional Liability (E&O): required for professional services (consulting, technology, accounting, legal)
- Commercial Auto: required if vendor vehicles are used in connection with your work
- Umbrella/Excess: provides additional coverage above primary policy limits
Coverage Limits
There is no universal limit appropriate for an industry or vendor type. Set limits with your broker, insurer, legal counsel, contract counterparties, and any governing rules. Our guide to COI requirements by industry explains a risk-based process rather than prescribing universal amounts.
Policy Period
Check the effective date and expiration date. The coverage must be active during the period the vendor is working for you. If the expiration date falls before the expected project end date, require a renewal certificate.
Additional Insured Status
Additional-insured and certificate-holder status are different. Certificate-holder status alone does not guarantee cancellation notice or coverage. Additional-insured protection comes from the policy or endorsement and is limited by its terms. Confirm what the contract requires and review the actual endorsement when the distinction matters.
How to Validate a COI
Receiving a COI is not the same as verifying it. A COI can be fraudulent, outdated, or technically valid but insufficient for your requirements.
Steps to validate:
- Check the broker's information. A legitimate COI lists the producing broker with contact information. For high-value vendor relationships, call the broker directly to confirm the policy is in force.
- Verify coverage limits meet your requirements. Compare the per-occurrence and aggregate limits against your minimums.
- Check the insured name carefully. Entity names are often very similar between related companies.
- Confirm your company is listed correctly. Misspellings or outdated addresses are common.
- Note the policy end date. Set reminders using the intervals in your renewal policy.
The Expiration Problem
Many commercial policies use annual terms, but terms vary. If a policy period ends and you do not obtain current evidence, you no longer have verified current coverage. Follow a defined document expiration process rather than improvising.
Manual tracking can become harder to operate and audit as vendor and document volume grows. Evaluate whether your spreadsheet process has clear ownership, validation, reminders, access control, and an audit trail.
One option is a system that tracks policy end dates, alerts the team, and sends renewal requests before the date. This is a core function of vendor compliance software.
How Often to Renew
Request a new COI at every annual renewal, at the start of every new project, and any time the vendor's insurance situation may have changed. If you have reason to believe coverage may have lapsed, verify with the broker directly. For construction teams managing subcontractor COIs at scale, see OnComply for construction.