Certificate of Insurance (COI) Requirements for Vendors

A certificate of insurance (COI) is a one-page summary proving a vendor carries active insurance coverage — and collecting, verifying, and tracking COIs from every contractor who sets foot on your property is one of the cheapest, highest-leverage risk controls a building owner has. When an uninsured roofer falls, an uninsured electrician’s work causes a fire, or a lapsed-coverage contractor damages a tenant’s space, the claim does not disappear because the vendor was supposed to be insured. It lands on the building owner who never checked.

The failure mode is almost always the same: the COI was collected once at onboarding, filed, and never looked at again — and it expired eight months ago. This guide covers what a COI actually is, the coverages and endorsements to require, the limits appropriate for commercial work, and the tracking discipline that keeps a lapsed certificate from becoming your uninsured loss.

What is a certificate of insurance and what does it prove?

A certificate of insurance is a document issued by a vendor’s insurance broker summarizing their active policies — the types of coverage, policy numbers, limits, and effective and expiration dates — as evidence that coverage exists as of the issue date. It is proof of coverage; it is not the policy itself, and that distinction matters.

Two limits of the COI are important to understand:

• It is a snapshot, not a guarantee of continuity. A COI confirms coverage was in force when issued. It says nothing about whether the policy was cancelled the next week. That is exactly why tracking expiration dates and re-collecting certificates is non-negotiable.
• The certificate does not amend the policy. The words on the COI do not, by themselves, grant you rights under the vendor’s policy. To actually be protected — named as additional insured, given a waiver of subrogation — those must be real endorsements on the underlying policy. This is why sophisticated owners require the endorsement pages, not just the certificate’s checkboxes.

Treat the COI as the front door: it tells you a vendor is insured and points to the coverages, but the endorsements behind it are what protect you.

What coverages and endorsements should you require from vendors?

At minimum, require commercial general liability, workers’ compensation, and auto liability from any vendor working on your property, and require that your entity be named as additional insured with a waiver of subrogation on the liability policy. Higher-risk trades warrant additional coverages. The exact requirements belong in your vendor contract, and the COI verifies compliance with them.

Core coverages to require:

1. Commercial general liability (CGL) — covers third-party bodily injury and property damage from the vendor’s operations. The foundational coverage for anyone on site.
2. Workers’ compensation — covers the vendor’s own employees for on-the-job injury. Without it, an injured worker may pursue the property owner. Requirements are set by state law across VA, DC, and Maryland.
3. Commercial auto liability — for vendors driving to and operating vehicles at your property.
4. Umbrella / excess liability — additional limits above the primary policies, appropriate for larger or higher-exposure work.
5. Trade-specific coverage where the risk warrants — professional liability for design work, pollution liability for environmental trades, garage-keepers or riggers coverage where relevant.

The endorsements that actually protect you:

• Additional insured — names your ownership entity (and often the manager) as insured under the vendor’s liability policy, so their coverage responds to claims arising from their work. Require it on a policy endorsement, not merely stated on the certificate.
• Waiver of subrogation — prevents the vendor’s insurer from turning around and pursuing you to recover what it paid.
• Primary and non-contributory language — makes the vendor’s coverage respond first, before your own.

What insurance limits should a commercial vendor carry?

Appropriate limits scale with the risk of the work — a common baseline for general commercial vendors is $1 million per occurrence and $2 million aggregate on general liability, with higher limits or umbrella coverage required for higher-hazard trades like roofing, elevator, electrical, or structural work. The right number is a risk decision, set in your contract, not a universal figure.

Calibrate limits to exposure:

• Lower-risk vendors (janitorial, landscaping, routine interior work) — standard general-liability limits are typically sufficient.
• Higher-risk trades (roofing, elevator, electrical, mechanical, structural, anything at height or affecting life-safety systems) — require higher limits and/or umbrella coverage matched to the potential severity of a loss.
• Match limits to your leases and lender requirements — some leases and loan covenants dictate minimum vendor-insurance standards for work in the building; your requirements should never fall below those.

Set the required coverages and limits once as a standard vendor-insurance schedule in your contracts, tier it by trade risk, and then hold every vendor to it before they start work. Consistency is what makes the standard enforceable.

How do you track certificates of insurance so none lapse?

You track COIs by maintaining a central record of every vendor’s coverage with expiration dates and automated reminders, verifying each certificate against your requirements before work begins, and re-collecting an updated certificate before the old one expires. The tracking discipline — not the initial collection — is where most owners fail and where the real protection lives.

A workable COI-tracking process:

• Verify before first work. Check each COI against your required coverages, limits, and endorsements before the vendor starts — and require the additional-insured and waiver endorsement pages, not just the certificate.
• Log expiration dates centrally and set reminders ahead of each one. A certificate that expired mid-engagement is functionally no certificate at all.
• Re-collect on renewal, automatically, before lapse — every year, every active vendor.
• Flag deficiencies and stop work for vendors out of compliance until they cure. The rule only works if it is enforced.
• Keep the records with the vendor and project history, so you can prove compliance if a claim or audit arrives.

This is precisely the kind of unglamorous, high-consequence tracking that a maintenance-management system handles well — the same platform that runs your preventive maintenance program can hold vendor records and flag expiring certificates, so COI compliance is a standing report rather than an annual fire drill. Rigorous vendor governance is a core part of professional facility management: the owners who never suffer an uninsured-vendor loss are simply the ones who verified the endorsements and never let a certificate lapse.

Frequently asked questions

What is the difference between a certificate of insurance and the actual policy?

A certificate of insurance is a one-page summary confirming that coverage exists as of its issue date; the policy is the full contract that defines what is actually covered. The certificate does not amend the policy — rights like additional-insured status or a waiver of subrogation only exist if they are real endorsements on the underlying policy, which is why owners should require the endorsement pages, not just the certificate.

What should be listed as additional insured on a vendor’s COI?

Your property-owning entity — and typically your property manager — should be named as additional insured on the vendor’s general liability policy by endorsement, so that policy responds to claims arising from the vendor’s work. Confirm it appears as a policy endorsement, not merely as text typed onto the certificate.

What insurance limits should I require from contractors?

Limits should scale with the risk of the work. A common baseline for general commercial vendors is $1 million per occurrence and $2 million aggregate on general liability, with higher limits or umbrella coverage for higher-hazard trades like roofing, elevator, electrical, and structural work. Set the schedule in your contract and never fall below what your leases or lender require.

Why do certificates of insurance need to be tracked after collection?

Because a COI only proves coverage was in force on its issue date — policies can be cancelled or simply expire. Without expiration tracking and automatic re-collection, a certificate on file quietly becomes worthless, and an owner relying on it can be left uninsured for a vendor’s loss. The tracking discipline is the actual protection.

Should COI tracking be part of facility or property management?

Yes. Verifying and tracking vendor certificates of insurance is a standard part of professional facility and property management, and it pairs naturally with the maintenance-management system that already holds vendor and asset records — turning COI compliance into an automated, ongoing report instead of a periodic scramble.