Certificate of insurance for vendors

The practical answer

A vendor certificate of insurance is how you confirm that a company working on your property, in your building, at your event or inside your systems can pay for the damage they cause. Collecting one is easy. Collecting one that means something takes a specific request and a specific review.

This page covers the collection side: how to ask so the vendor's agent can actually act, how to set requirements that fit the vendor rather than a template, and what to read when the PDF arrives.

How to request one so it arrives correctly

The vendor cannot issue a certificate. Only the producing agency can, and they will issue exactly what they are told to. A request that contains everything they need is answered in a day, and one that does not turns into three rounds of email.

• The exact legal entity names to be shown as certificate holder and as additional insured, spelled as they appear on the contract.
• The mailing address for the certificate holder block.
• The coverages and limits required, line by line.
• The endorsements required, by name: additional insured for ongoing and completed operations, primary and non-contributory, waiver of subrogation, and a request that copies of the endorsement pages be attached.
• The project, property, site or contract reference to appear in the description box.
• A direct way to return it. An upload link the agency can use without an account beats a reply-to-all thread.
• A due date, and the name of the person who will chase it.

Tiering requirements by vendor risk

The same requirement for a software supplier and a roofing crew is wrong twice. A workable structure has a baseline and a small number of tiers:

• Low touch, no premises access: general liability at the baseline limit, plus professional liability or cyber where they handle data or give advice.
• On-site, low hazard, such as cleaning, landscaping and interior maintenance: baseline general liability, workers compensation, commercial auto with hired and non-owned, additional insured status.
• On-site, high hazard, such as roofing, electrical, elevator, tree work and anything at height or with heat: raised limits, umbrella, completed operations status, and a hard look at exclusions.
• Public-facing, such as events, exhibitors, food service and alcohol: liquor liability where alcohol is served, and higher general liability limits because the claimant is a member of the public.
• Fleet and delivery: auto limits that reflect the vehicles actually used, with any auto rather than owned autos only.
• Data and systems access: cyber liability and technology errors and omissions, which never appear on a standard ACORD 25 coverage grid and have to be asked for explicitly.

What to check when it arrives

• The named insured is the company you contracted with, not an affiliate or a trading name.
• Policy effective and expiration dates cover the engagement, and the expiry is recorded for chasing.
• Limits meet the requirement on each line, and the general aggregate is not the number being used to satisfy an each-occurrence requirement.
• The additional insured and waiver columns are backed by endorsement pages, with your legal entity named or blanket wording that reaches you.
• Commercial auto includes hired and non-owned when the vendor's people drive.
• Workers compensation covers the state where the work happens, and the officer exclusion box is read.
• The producer is a real agency. If anything looks edited, call the number on the certificate rather than the number the vendor gave you.

The renewal problem

A vendor certificate is correct for about a year and then silently stops being evidence. Nothing on your side changes on the day it expires, which is why expired certificates accumulate quietly in every program that relies on people remembering.

The two mechanics that fix it are unglamorous. Diary every expiry when the certificate is filed, and chase the producing agency rather than the vendor, because the agency is the only party who can reissue. A request sent to a vendor contact who has left the company is the most common single reason a certificate goes stale.