How to Read a Contractor's Certificate of Insurance (COI): A GC's Verification Guide

A Certificate of Insurance is not proof of coverage—it's a snapshot that can be outdated, incomplete, or outright fraudulent. This guide covers exactly what to verify on every COI you receive, how to spot fakes, and why "they gave me a certificate" is not the same as "they have adequate coverage."

What Is a Certificate of Insurance (COI)?

COI Definition and Purpose

A Certificate of Insurance is a one-page summary document issued by an insurance agent or broker. It lists a contractor's active policies, coverage limits, and policy dates at the time of issuance.

The standard format in construction is the ACORD 25 form. This standardization makes verification faster—once you know where to look, the information is in the same place on every certificate.

Key point: A COI is an informational document, not a legal contract. It proves that coverage existed when the certificate was issued. It does not guarantee that coverage will exist when you need it.

Why COIs Matter for General Contractors

When a subcontractor causes property damage or worker injury on your project, you need their insurance to respond. Without it, claims flow uphill—to your policy, your balance sheet, or both.

Under OSHA's multi-employer policy, GCs can be cited for subcontractor safety violations. If that sub has no workers' comp and an employee is injured, you may be liable for medical costs exceeding $500,000 for serious injuries.

COI verification isn't paperwork—it's risk transfer verification.

COI vs. Actual Policy: Know the Difference

A COI is a snapshot. The actual insurance policy is the legal contract between the contractor and insurer. The certificate has no legal standing—carriers explicitly disclaim any obligation based on what's listed on a certificate.

When should you request actual policy documents? For high-value projects (over $5M), specialty risks, or when you need to verify specific endorsements aren't just checked on the COI but actually exist in the policy language.

Anatomy of an ACORD 25 Form: Section-by-Section Breakdown

The ACORD 25 form is divided into distinct sections. Here's what to verify in each one.

Producer Information (Top Left)

The "producer" is the insurance agent or broker who issued the certificate. This section should include:

• Agency name and full address
• Phone number and email
• Contact name (the person who can verify the certificate)

Red flag: No phone number, a generic email (Gmail, Yahoo), or contact information that doesn't match any real agency when you search it.

Insured Information

The "named insured" must match the contractor's legal business name exactly. This is who the policy actually covers.

Common issues:

• DBA mismatch: Contract is with "Smith Electric, LLC" but COI shows "John Smith dba Smith Electric"—different legal entities
• Name variations: "ABC Plumbing Inc." vs "ABC Plumbing Incorporated"—verify with their CSLB license to confirm the exact legal name
• Old names: Company restructured or renamed but COI shows previous entity

Insurer(s) Affording Coverage

This section lists the insurance companies providing coverage, each with a letter designation (A, B, C, etc.) and their NAIC number—a 5-digit identifier assigned by the National Association of Insurance Commissioners.

Verification steps:

• NAIC lookup: Search the NAIC number at naic.org to verify the company exists
• A.M. Best rating: Check the carrier's financial strength. A-rated or better is standard for commercial construction. Below B+ is a concern.
• State authorization: Verify the carrier is licensed to write policies in your state

Coverages, Policy Numbers, and Limits

The center of the ACORD 25 shows each type of coverage with policy numbers, effective dates, and limits. Key sections:

• Commercial General Liability (CGL): Occurrence limit (per claim) and aggregate limit (total per policy period). Standard minimum: $1M/$2M.
• Workers' Compensation: Shows "WC Statutory Limits" for the state and Employer's Liability limits (typically $500K/$500K/$500K). See our California workers' comp requirements guide.
• Commercial Auto: Combined single limit for bodily injury and property damage. Standard: $1M.
• Umbrella/Excess: Additional limits above primary policies. Required for projects over $1M in value.

Description of Operations/Locations/Vehicles

This free-text box is where critical endorsements are noted:

• Project-specific coverage (your project address should be listed)
• "Additional Insured" status for your company
• "Waiver of Subrogation" in favor of certificate holder
• "Primary and Noncontributory" language

Important: Text in this box doesn't create coverage—it only describes what's supposed to exist in the actual policy. Always request copies of the actual endorsement pages for high-value projects.

Certificate Holder Box

Your company name and address goes here. Being listed as "certificate holder" means you'll receive notice if the policy is cancelled.

Critical distinction: Certificate holder ≠ additional insured. Being a certificate holder gives you notification rights only. It does not give you any coverage under their policy.

Cancellation Clause

Standard ACORD 25 language states the insurer "will endeavor to" provide notice if the policy is cancelled. This language is essentially meaningless— "endeavor to" creates no legal obligation.

How to get actual cancellation notice:

• Request a "Notice of Cancellation" endorsement naming you specifically. This adds you to the policy as someone who must be notified.
• Standard notice period is 30 days for non-payment, 10 days for other cancellation. Your subcontract should specify the notice period you require.
• Some carriers charge $25-$100 extra for this endorsement. If a sub refuses because of cost, that tells you something about their financial priorities.
• For projects over 12 months, cancellation notice is essential—policies renew annually, and you need time to address any lapses.

If you can't get a cancellation endorsement, build policy expiration tracking into your project management. Request updated COIs 30 days before any policy expires.

The 5 Coverage Types Every GC Must Verify

Commercial General Liability (CGL)

CGL covers third-party bodily injury and property damage caused by the contractor's operations. This is the foundation of construction insurance.

• Occurrence limit: Maximum payout per incident. Minimum: $1M.
• General aggregate: Maximum total payout per policy period. Minimum: $2M.
• Products-completed operations: Coverage for claims arising after work is done. Critical—many claims surface years after project completion.
• Personal & advertising injury: Covers libel, slander, copyright infringement.

Per-Project Aggregate: Why It Matters

Standard CGL has one aggregate limit for all projects combined. If a sub has a $2M aggregate and already paid $1.5M in claims on other projects this year, only $500K remains for your project.

Require per-project aggregate endorsement for projects over $5M. This dedicates the full aggregate limit to your specific project, regardless of claims elsewhere. Without it, you're sharing limits with every other job that sub is working.

Workers' Compensation

Workers' comp covers medical expenses and lost wages for employee injuries. California requires coverage for all employees—no exceptions for construction.

• Statutory limits: Set by state law (California is unlimited for medical, 2/3 wages for temporary disability)
• Employer's Liability: Covers lawsuits from injured workers. Standard: $500K per accident, $500K per employee for disease, $500K aggregate for disease.

If a sub has no workers' comp and one of their employees is injured on your site, you become liable under California Labor Code 2750.5. See our complete guide to California workers' comp requirements.

Commercial Auto Liability

Covers liability from vehicle accidents. Required for any sub whose employees drive to your jobsite or transport materials.

• Owned autos: Vehicles titled to the contractor
• Hired autos: Rented or leased vehicles
• Non-owned autos: Personal vehicles used for business (employees using their own cars)

Minimum combined single limit: $1M. Require "any auto" coverage symbol to ensure all three categories are included.

Umbrella/Excess Liability

Provides additional limits above primary CGL, auto, and employer's liability policies. Think of it as "overflow" coverage when primary limits are exhausted.

• Umbrella: Broader coverage that can fill gaps in underlying policies
• Excess: Simply adds limits, follows underlying policy terms exactly

When to require umbrella/excess:

• Projects over $1M value: Require $1M umbrella minimum
• Projects over $5M: Require $2M-5M umbrella
• Projects over $25M: Require $5M-10M umbrella

Professional Liability (E&O)—When Applicable

Professional liability (Errors & Omissions) covers claims arising from professional services—design errors, engineering mistakes, consulting failures.

Required for:

• Design-build subcontractors
• Engineering specialty subs (structural, MEP design)
• Any sub providing design services beyond means and methods

Standard CGL specifically excludes professional liability. If your sub performs design work and doesn't carry E&O, you have a coverage gap.

Pollution Liability (CPL)—When to Require It

Contractor's Pollution Liability (CPL) covers environmental contamination claims—something standard CGL specifically excludes.

Require pollution liability for:

• Demolition contractors (asbestos, lead, PCBs)
• Abatement and remediation trades
• Earthwork and excavation (unknown contaminants)
• Painting (lead paint, VOCs in occupied spaces)
• Any work on AQMD-regulated projects
• Occupied tenant improvements with abatement scope

Minimum limits: $1M occurrence/$2M aggregate. For hazmat-heavy scopes, require $2M/$4M.

Builder's Risk vs. CGL: Know the Difference

Subs often confuse liability coverage (CGL) with property coverage (builder's risk). They're completely different:

• CGL: Covers liability for injury to people or damage to others' property caused by the sub's operations
• Builder's Risk: Covers damage to the work itself during construction (fire, theft, weather, vandalism)

When a sub says "but I have insurance" after their installed materials get damaged or tools get stolen, they're usually thinking of CGL—which doesn't cover property losses. Builder's risk is typically carried by the owner or GC for the entire project, not individual subs. Verify who carries it and what's covered before work starts.

Recommended Minimums by Project Type

Insurance requirements should scale with project size and risk profile, not just trade. A painting sub on a $500K residential job has different exposure than the same trade on a $15M occupied commercial TI.

High-risk trades require higher limits regardless of project size:

• Roofing, structural steel, tower/crane work: Add $1-2M umbrella minimum
• Demolition, excavation, hazmat abatement: Add $2M umbrella minimum
• Window installation at height, exterior cladding: Add $1M umbrella minimum

Cost reality: Umbrella coverage typically runs $3,000-$5,000 per million in limits. When a sub pushes back on higher limits, the actual cost increase to their bid is minimal. Don't let "that'll kill my price" be an excuse for inadequate coverage.

Additional Insured Status: What It Really Means

Certificate Holder vs. Additional Insured

This is the most misunderstood concept in COI verification. Being a "certificate holder" means almost nothing. Being an "additional insured" means you have actual coverage rights.

Always require additional insured status. If the sub's operations injure someone or damage property, you want their insurance defending and paying—not yours.

Cross-Liability Coverage

When multiple parties are insured under the same policy (you as AI, the sub as named insured), some older policy forms have cross-suit exclusions that prevent one insured from making claims against another. This defeats the purpose of being an additional insured.

Modern ISO forms include "Separation of Insureds" language that treats each insured independently. For non-standard or older policies, verify the policy allows cross-liability between insureds—otherwise your AI status may be worthless when you need it most.

CG 20 10 and CG 20 37 Endorsements

The insurance industry uses standardized endorsement forms. For additional insured status, you need two:

• CG 20 10: Additional Insured—Owners, Lessees or Contractors. Covers ongoing operations only (while work is being performed).
• CG 20 37: Additional Insured—Owners, Lessees or Contractors— Completed Operations. Covers claims arising after work is done.

Why you need both: A roofing sub installs your roof (CG 20 10 applies). Two years later, the roof leaks and causes $100K in damage. Without CG 20 37, that claim hits your policy, not theirs.

Some carriers issue a combined form (CG 20 10/37). Verify the exact endorsement numbers in the Description of Operations box.

Primary and Noncontributory Endorsement

Without this endorsement, both your policy and the sub's policy might respond to a claim—and fight over who pays first. With primary and noncontributory:

• The sub's policy responds first (primary)
• Your policy doesn't contribute until theirs is exhausted (noncontributory)

Include this language in your subcontract: "Subcontractor's insurance shall be primary and noncontributory to any insurance carried by Contractor."

Indemnification: The Contract Language That Makes Insurance Work

Insurance endorsements are only enforceable if your subcontract language matches. The AI endorsement extends coverage "for liability arising out of" the sub's work—but the specifics depend on what your contract requires.

Your subcontract should include:

• Indemnification clause requiring the sub to defend and hold you harmless
• Specific insurance requirements (limits, endorsements, notice periods)
• Language requiring the sub's insurance to be primary and noncontributory
• Right to suspend work for insurance lapses

The insurance follows the contract. If your contract says you need CG 20 10 and CG 20 37, and the sub's COI only shows CG 20 10, they're non-compliant—even if their insurance would otherwise cover completed operations. The endorsements must match what you contracted for.

Waiver of Subrogation: Should You Require It?

What Subrogation Means

When an insurance company pays a claim, it acquires the right to "step into the shoes" of the insured and recover from whoever caused the loss. This is subrogation.

Example: Your sub's employee is injured due to a condition you created on site. The sub's workers' comp pays the claim, then sues you to recover what they paid.

A waiver of subrogation prevents this—the insurer agrees not to pursue recovery against the parties named in the waiver.

Blanket vs. Scheduled Waivers

• Blanket waiver: Waives subrogation rights against any party the insured has agreed to hold harmless in a written contract. Broader coverage, slightly higher premium.
• Scheduled waiver: Only waives subrogation for specifically named parties. Must be added to the policy for each project.

For commercial construction, require blanket waivers when available. The 2-5% premium increase is worth the certainty that you're covered without having to chase down project-specific endorsements.

EMR: The Safety Metric That Matters

The Experience Modification Rate (EMR) is the single best indicator of a subcontractor's safety culture. Insurance carriers literally price workers' comp premiums based on it—and you should use it to vet subs.

What EMR Tells You

EMR compares a contractor's claims history to the industry average:

• EMR = 1.0: Average claims for their trade and size
• EMR < 1.0: Better than average safety record
• EMR > 1.0: Worse than average—more claims, higher risk

A contractor with a 1.25 EMR has 25% more claims than average. They pay 25% more for workers' comp. More importantly, they're 25% more likely to have an incident on your project.

EMR Thresholds for Hiring

How to verify EMR: Request the sub's EMR verification letter directly from their workers' comp carrier. Some COIs list EMR, but always verify independently. In California, you can also contact WCIRB (Workers' Compensation Insurance Rating Bureau).

OCIP/CCIP: When Standard Requirements Don't Apply

On larger projects, the owner or GC may provide insurance for all contractors through a "wrap-up" program. This changes what you need from subs.

Owner Controlled Insurance Program (OCIP)

The project owner purchases GL and workers' comp for all contractors. Subs "enroll" in the program and are covered under the owner's policy.

Contractor Controlled Insurance Program (CCIP)

Same concept, but the GC purchases the wrap-up coverage. Common on large commercial and infrastructure projects.

What Changes Under Wrap-Up

• Subs don't need to provide GL or WC for enrolled work
• You still verify their auto liability and off-site coverage
• EMR requirements still apply—most wrap-ups have EMR eligibility thresholds
• Enrollment is project-specific; their standard COI covers other work

If you're bidding wrap-up projects: Your standard insurance requirements don't apply for enrolled coverage. Work with the wrap-up administrator to understand what subs must provide versus what the program covers.

How to Spot a Fake Certificate of Insurance

Fake COIs are a real problem in construction. Some contractors alter legitimate certificates. Others create them from scratch. Here's how to identify fraud.

Red Flag #1: Font and Formatting Inconsistencies

Legitimate ACORD forms have consistent typography. Watch for:

• Mixed fonts or font sizes within the same section
• Misaligned text boxes
• Crooked lines or uneven spacing
• Pixelation around edited areas

Red Flag #2: Suspicious Policy Numbers

Most insurance policy numbers contain letters and follow carrier-specific patterns. Red flags:

• All-numeric policy numbers (most carriers use alphanumeric)
• Sequential numbers (12345, 11111)
• Policy numbers that are too short or too long for that carrier

Red Flag #3: Limits That Don't Add Up

Insurance math has rules. These are impossible:

• Occurrence limit greater than aggregate (you can't have $2M per incident and $1M total)
• Unrealistically high limits for company size ($10M umbrella for a 3-person painting crew)
• Missing standard coverages (GL but no workers' comp for a contractor with 20 employees)

Red Flag #4: Editable PDF

Open the PDF in Adobe Reader. If you see form fields or a "Clear Form" button, it's editable—meaning anyone could have typed anything into it. Legitimate certificates are "flattened" PDFs that cannot be edited.

Red Flag #5: Missing or Suspicious Contact Info

• No producer phone number
• Generic email domain (gmail.com, yahoo.com for a supposedly licensed agency)
• Producer name doesn't appear when you search for them
• Address doesn't match the agency when you search

Red Flag #6: Expired Dates

• Certificate date is older than 30 days
• Policy effective date is in the past (policy may have already expired)
• Suspicious timing (certificate issued day before you requested it with policy dates starting that same day)

Red Flag #7: Spelling Errors

Misspellings are an immediate red flag:

• "Certificate of Insurence"
• Misspelled insurance company names
• Typos in standard insurance terminology

Red Flag #8: Non-ACORD Format

The ACORD 25 is the industry standard. It has the ACORD logo in the bottom left and "ACORD 25" in the form number. Custom forms without ACORD designation are unusual for commercial coverage and warrant extra verification.

How to Verify Authenticity

• Call the producer directly—but not using the number on the COI. Look up the agency on the insurance carrier's website or through an independent search. Fraudsters put their own phone numbers on fake certificates.
• NAIC lookup: Verify the insurance company exists and is authorized to write policies in your state.
• State insurance department: Most states have online databases to verify licensed producers and carriers.
• NCCI verification: For workers' comp, you can verify coverage through NCCI or your state's workers' comp rating bureau.

COI Verification Checklist

Use this checklist for every COI you receive. For high-value or high-risk projects, verify by phone with the producer.

Common COI Mistakes GCs Make

Mistake #1: Only Checking at Project Start

A COI shows coverage at one point in time. Policies expire, get cancelled, or lapse for non-payment.

Certificate management options:

• 20+ active subs: Use dedicated software like myCOI, Ebix, Jones, or BCS. These track expirations, send automated renewal requests, and flag non-compliant certificates.
• Fewer subs: Spreadsheet tracking with calendar reminders works, but requires discipline. Set reminders for 30 days before every policy expiration.

Regardless of method, request updated COIs:

• 30 days before any policy expiration date listed on the COI
• Annually for all active subcontractors
• Immediately if you learn of any coverage change

Mistake #2: Accepting Any COI Without Review

"They gave me a COI" is not the same as "they have adequate coverage." A certificate with $100K limits, expired dates, and your company not listed as additional insured provides zero protection. Review every certificate against your requirements.

Mistake #3: Not Requiring Additional Insured Status

Being a certificate holder provides notification rights at best. Being an additional insured provides actual coverage. Every subcontract should require additional insured status with CG 20 10 and CG 20 37 endorsements.

Mistake #4: Ignoring Workers' Compensation Verification

Workers' comp claims are the highest-cost exposure for most GCs. If a sub's employee is injured and they have no coverage, you may be liable under Labor Code 2750.5. Penalties can exceed $100,000, plus you're responsible for medical costs. Verify workers' comp on every COI.

Mistake #5: Assuming Current COI Means Continuous Coverage

A new certificate showing current coverage doesn't guarantee there were no gaps. If a sub's policy lapsed for two weeks and they got reinstated, that two-week period is uninsured—retroactively.

Why this matters: If an incident occurred during the lapse but the claim surfaces months later, you're exposed. The current policy won't cover it, and there was no policy in force when it happened.

For long-duration projects, request a coverage history letter from the sub's broker confirming continuous coverage since project start. For new subs, verify their prior policy overlapped with the new one.

Mistake #6: Not Keeping Records

Completed operations claims can arise years after project completion. A roofing leak, a foundation crack, an electrical fire—any of these can surface long after the sub has moved on.

Retention recommendation: Keep COIs for at least the statute of limitations for construction defect claims in your state (10 years in California for latent defects).

Beyond the COI: Complete Subcontractor Verification

COI verification is one piece of subcontractor due diligence. A contractor can have perfect insurance and still be a risk because of licensing issues, safety violations, or financial problems.

License Verification

Before checking insurance, verify the contractor is legally allowed to work. In California:

• How to verify a contractor license in California
• Understanding CSLB license classifications

Safety Record Check

Past safety performance predicts future safety performance:

• OSHA violation types and penalties — Check for citations
• Contractor red flags in federal databases
• EMR (Experience Modification Rate) — Request directly from the sub

Federal Compliance

Federal violations can signal financial distress or pattern of non-compliance:

• SAM.gov debarment explained — Federally debarred contractors cannot work on federal projects
• DOL back wage orders — Wage theft indicates financial and compliance problems
• EPA ECHO construction guide — Environmental violations for demolition, earthwork, hazmat trades

Full Due Diligence

For complete subcontractor vetting, see our subcontractor prequalification checklist.

Or use SiteVetter to verify contractors across CSLB, SAM.gov, OSHA, DOL, and EPA databases in seconds—get a timestamped due diligence report for your compliance files.

Frequently Asked Questions

What should I look for on a contractor's certificate of insurance?

Verify the named insured matches the contractor's legal business name, check that policy dates cover your project, confirm coverage limits meet your requirements ($1M/$2M minimum for GL), ensure you're listed as additional insured (not just certificate holder), and look for CG 20 10, CG 20 37, and primary/noncontributory endorsements.

How do I know if a COI is fake?

Red flags include: inconsistent fonts, misaligned text, editable PDF format, all-numeric policy numbers, occurrence limits higher than aggregate (mathematically impossible), missing producer contact info, spelling errors, and non-ACORD format. Verify by calling the producer using contact info you find independently—not the number on the certificate.

What's the difference between certificate holder and additional insured?

Certificate holder is purely informational—you might get notified of cancellation, nothing more. Additional insured means you have actual coverage rights under their policy. If the sub causes a claim, their insurer defends you and pays damages. Always require additional insured status, not just certificate holder.

How long should I keep subcontractor COIs on file?

Keep COIs for at least 2-3 years after project completion. In California, where the statute of limitations for latent construction defects is 10 years, consider retaining COIs for the full period. Completed operations claims can emerge years after work is done.

Can I verify a COI is real?

Yes. Call the producer using contact information from the insurance carrier's website or an independent search—not the number on the certificate. Use NAIC lookup to verify the carrier exists. For workers' comp, verify through NCCI or your state's workers' comp rating bureau.

What happens if my subcontractor's insurance expires mid-project?

Document first, then stop work. The proper sequence:

1. Send written notice (email is fine) citing the lapse and your contract's insurance requirements
2. Give a cure period per your contract (typically 24-48 hours for insurance)
3. If not cured, issue written stop-work notice
4. Document everything—you may need this paper trail if disputes arise

Don't just tell them verbally to stop. Your subcontract should include language allowing suspension for insurance lapses—and you need written documentation to enforce it.

Do I need the actual policy or is a COI enough?

For most projects, a properly verified COI is sufficient. For high-value projects (over $5M), high-risk trades, or when you need to verify specific endorsement language, request copies of the actual policy declarations page and relevant endorsements.

What is CG 20 10 and why does it matter?

CG 20 10 is the ISO endorsement form number for "Additional Insured—Owners, Lessees or Contractors." It extends the sub's liability coverage to you for claims arising from their ongoing operations. Without it, you're a certificate holder with no coverage rights—just paperwork.

Should I require completed operations coverage?

Yes. CG 20 37 extends additional insured status to completed operations—claims that arise after work is done. A roofing leak two years later, a plumbing failure that floods a building, an electrical issue that causes a fire—without completed operations coverage, these claims hit your policy.

Conclusion

A Certificate of Insurance is only as good as your verification process. Taking 5 minutes to properly review a COI can save your company from six-figure claims.

Key takeaways:

• A COI is a snapshot, not a guarantee of coverage
• Certificate holder ≠ additional insured—always require AI status
• Verify both ongoing (CG 20 10) and completed operations (CG 20 37) coverage
• Fake COIs are common—know the red flags and verify independently
• COI verification is one part of complete subcontractor due diligence

Ready to verify contractors faster? SiteVetter checks CSLB license status, federal databases, OSHA citations, and DOL violations in seconds. Search a contractor on the homepage to see their complete verification profile.