Certificates of insurance (COI) can be confusing to many clients. Our corporate clients often ask us two questions. The first is: “Are there any legal requirements for tracking vendor certificates of insurance?”

The simple answer to that question is "no." The real answer, however, is a little more complex than that. Many of these clients work for publicly traded companies and are concerned about reporting requirements under the Generally Accepted Accounting Practices (GAAP) or under the Sarbanes-Oxley Act of 2002 (SOX). Neither GAAP nor SOX specifically require companies to track certificates of insurance. However, SOX does require executives and their auditors to report on the effectiveness of their internal controls. Many companies look at the tracking of COI’s as a way to minimize possible knowledge gaps regarding their financial exposures. There is the equally important additional benefit of reducing financial risk and minimizing litigation costs.

The second question we get asked is: “We’re covered if we made sure to get a certificate of insurance, aren’t we?” Well, the answer to that question is “maybe.”

Many of our clients require their contractors and suppliers to submit proof of insurance. The primary reason for collecting certificates of insurance is to ensure that the other party has sufficient insurance coverage in place. You want to make sure that the other party maintains minimum levels of workers compensation, general liability, and commercial auto coverage. Those levels should at the very least be those determined by your risk management group, but may increase depending on the work or the type and quantity of material being supplied.

Many companies also require that they be listed as an additional insured. An additional insured is the company named on the certificate that is covered under another party’s (the contractor’s) insurance policy. This coverage provides protection from liability or risks that arise from the named insured’s (the contractor’s) work, performance, negligence, or improper conduct.


Download this free guide: How to Read a Certificate of Insurance


If you want to add that additional insured coverage, it is essential that you also collect an endorsement to the policy. The endorsement is the form that the insurance company issues naming your company as an additional insured to the other party’s policy. Without a written endorsement, you aren’t considered an additional insured and may be exposing your company to substantial risk and liability.

It is a widely-held belief that certificates of insurance themselves convey the additional insured status from the named insured’s policy. But certificates of insurance are like photographs: they are a statement of the insured’s coverage as of the date of issue. If the policyholder cancels or alters the coverage, or allows it to be cancelled for lack of payment, you will not be notified.

The ACORD Certificate of Insurance form actually specifies the following: “This certificate is issued as a matter of information only and confers no rights upon the certificate holder. This certificate does not affirmatively or negatively amend, extend or alter the coverage afforded by the policies below. This certificate of insurance does not constitute a contract between the issuing insurer(s), authorized representative or producer, and the certificate holder.”

You may be thinking, “Well, what good does the certificate of insurance do if the policy can be canceled or modified after I get the certificate?” That is an excellent question and the answer lies in the concept of self-interest. Most companies buy insurance to protect the owners from unexpected or extraordinary loss. Unless they are in difficult financial straits, there is no real motivation to delete or remove coverage. The additional cost they may incur to add your company as an additional insured is minimal in comparison to the cost of the policy, and it has probably been factored into their pricing.

So how do you actually acquire the status of an additional insured?

You need to request that the other party provide three things:

  • A certificate of insurance with the proper coverage amounts listed
  • An endorsement form that names your company as an additional insured
  • A copy of the policy declarations so you can review the exclusions and limitations that might limit your coverage as an additional insured

Here is a six-step checklist to help you better manage your certificates of insurance:

  • Require each contractor or vendor to provide a certificate of insurance (send them a sample certificate to eliminate confusion)
  • Require that your organization be added as an additional insured
  • Review the COI to make sure the coverage limits meet your minimum requirements
  • Get a copy of the policy endorsement naming your organization as an additional insured (be sure to verify that your organization’s name is spelled correctly)
  • Review the policy’s limitations and exclusions to be sure your coverage is adequate
  • Review coverage amounts and update certificates annually

Keeping track of third-party insurance coverage can be a lot of work and it's easy to get behind, leaving you and your company exposed (see this Contractor Prequalification Questionnaire Checklist to make sure you're collecting all the right information). If you don’t have the time or team to keep this information current, you should consider using a third-party prequalification company to verify the coverage and terms. Be sure to pick one that uses automated processes to keep the Certificates current and notifies you of lapses.


Download this free guide: How to Read a Certificate of Insurance