You hired a careful subcontractor, paid every invoice on time, and never had a claim. Then your workers' compensation premium audit arrives — and you owe thousands of dollars in extra premium for that same subcontractor. Why? Because you could not produce a valid certificate of insurance for them on audit day.
That scenario plays out every year for general contractors, builders, remodelers, and any small business that hires 1099 subcontractors. A missing certificate is not treated as a filing gap. At audit time, payments to undocumented subcontractors are routinely reclassified as your own payroll exposure — and billed at your trade rates. One missing piece of paper becomes an invoice arriving a year later.
The fix is a simple, repeatable routine: collect the right certificate before work starts, verify what it actually shows, and refresh it before it expires. Here is how to do it.
What a Certificate of Insurance Actually Is
A Certificate of Insurance (COI) is a one-page summary of a business's active insurance coverage. In construction and most subcontracted trades, it almost always arrives on the industry-standard ACORD 25 form, titled "Certificate of Liability Insurance."
It tells you, at a glance:
- Who is insured (legal business name and address)
- Which policies are in force (general liability, auto, umbrella, workers' compensation)
- Policy numbers, effective dates, and expiration dates
- Limits of liability for each coverage
- Who issued the certificate (the producer or agent) and when
The single most important sentence on the form is the disclaimer at the top: the certificate does not constitute a contract and does not confer rights on its own. A COI is a snapshot issued on a specific date — it is evidence that coverage existed when issued, not the policy itself. If you need actual protection under someone else's policy, that comes from an endorsement to the policy, not from a line on the certificate.
Think of it this way: the COI is the dashboard warning light summary. The policy plus its endorsements is the engine underneath. You check the dashboard every time, and you ask to see the engine paperwork when the stakes are high.
What Every Subcontractor COI Must Show
Before a subcontractor sets foot on your jobsite or starts billable work, their COI should answer seven questions. If any answer is missing or wrong, send it back.
1. The insured name matches your contract exactly
The "Insured" box must show the subcontractor's exact legal business name — the same name on your subcontract, their W-9, and their invoices. A certificate in a personal name when you contracted with an LLC, or an old DBA that no longer matches, will not satisfy an auditor. Mismatched names are one of the most common reasons a technically valid certificate gets rejected at audit.
2. Policies, numbers, and dates are current and cover the work period
Check that each required policy is listed with a policy number, an effective date in the past, and an expiration date in the future. Confirm the coverage window spans the entire period the subcontractor will be on your job — not just the day the certificate was printed.
At minimum, most hiring contractors require:
- Commercial general liability (CGL)
- Business auto (if the sub drives for the work, including hired and non-owned autos)
- Umbrella or excess liability (when your contract or the project owner requires higher limits)
- Workers' compensation and employers' liability (or a valid state exemption certificate where the trade and state allow it)
If a policy expired mid-project and no renewal certificate followed, you have a gap. Auditors test the audit period, not the start date — a certificate that was valid in January but lapsed in June leaves June through December exposed.
3. Limits meet your contract minimums
Compare each line's limits against what your subcontract requires. A typical small-project requirement might read "$1,000,000 per occurrence / $2,000,000 aggregate" for general liability, plus employer's liability limits and auto limits. If the certificate shows lower limits, the subcontractor is not compliant yet — even though they sent you a real certificate.
Watch the general aggregate especially on busy subcontractors. A $2 million aggregate shared across all their jobs erodes with every claim. Larger projects often require a per-project aggregate endorsement so your job gets its own full limit rather than whatever is left over.
4. You are listed as certificate holder — spelled correctly
The "Certificate Holder" box should show your company's legal name and address, exactly as you want it to appear in the insurer's records. This is what routes cancellation notices to you and ties the certificate to your job in an audit file. A COI naming a different company, a misspelled entity, or no holder at all does not document coverage for you.
Being the certificate holder gives you information rights — including notice if the policy is cancelled — but it does not by itself give you coverage under their policy.
5. Additional insured status is shown — and backed by an endorsement
If your contract requires you (and often the project owner) to be an additional insured on the subcontractor's general liability policy, two things must both be true:
- The "Additional Insured" box is checked for the relevant policy on the COI, with the project or contract referenced in the Description of Operations section.
- You hold a copy of the actual additional insured endorsement, or the policy number and form number are documented and verifiable.
Common endorsement forms include the CG 20 10 series for ongoing operations and the CG 20 37 series for completed operations. You generally want both: one covers injuries and damage while the work is happening, the other covers defects discovered after the job is done. A certificate that checks the box without an endorsement behind it confers nothing — the fine print on the ACORD form says so explicitly.
For high-risk trades (roofing, electrical, excavation, waterproofing), ask the subcontractor's agent to attach the endorsement pages to the certificate. It takes one extra email and eliminates the most expensive misunderstanding in the stack.
6. Waiver of subrogation and primary-and-noncontributory wording, if required
Many subcontracts require the subcontractor's insurer to waive its right to sue you to recover claim payments (a waiver of subrogation), and to treat the subcontractor's policy as primary while yours sits excess (primary and noncontributory). Like additional insured status, these require endorsements — the checked box on the certificate only points to them.
Verify each requirement line by line: general liability, auto, and workers' compensation often each need their own waiver. A blanket "waiver applies" note without specifying which policies is worth a follow-up call to the issuing agent.
7. The Description of Operations ties the certificate to your job
The bottom "Description of Operations / Locations / Vehicles" box should reference your project name or address, the contract number if you use one, and any special wording your contract requires ("General contractor and owner named as additional insured for ongoing and completed operations per written contract," for example). Generic certificates with an empty description box are harder to defend at audit because nothing connects the coverage to your payments.
Three Costly Misconceptions
"A certificate means I am covered"
No. A certificate means coverage existed on the issue date for the named insured. Your protection as the hiring party comes from being correctly added to their policy by endorsement — and from your own policies being adequate. Never treat collection as a substitute for carrying your own general liability and workers' compensation coverage.
"The certificate holder and the additional insured are the same thing"
They are not. Every COI has a certificate holder; only some confer additional insured status. Holder gets you information and cancellation notice. Additional insured — via endorsement — can give you defense and indemnity under their policy for claims arising from their work. If your contract requires the second, a certificate showing only the first is noncompliant.
"I have to accept whatever limits they carry"
Coverage requirements should reflect the scope and risk of the work, and your contract sets the floor. A subcontractor hanging interior doors does not need the same limits as the crew doing hot roofing or trenching. Set tiered requirements by trade risk, put them in writing before bidding, and enforce them uniformly. Uniform enforcement is what makes the file audit-proof.
When to Demand a New COI
Collect once and you are covered for about as long as a gallon of milk lasts. Build these five triggers into your process:
- Before work starts — no certificate, no work. Make the COI part of your prequalification packet alongside the signed subcontract, W-9, and any required licenses. The first payment should never go out before the file is complete.
- At every renewal or expiration. Policies commonly renew annually, but staggered dates mean something expires nearly every month across a roster of subs. Track expiration dates in your accounting or project system and request renewals 30 days before lapse.
- At the start of each new project. Even with a current certificate on file, issue a project-specific certificate request naming the new certificate holder entities, project address, and any owner-mandated wording. Auditors and project owners both prefer project-tied documentation.
- When limits, insurers, or names change. A mid-term cancellation and rewrite, a carrier change, a DBA-to-LLC conversion, or an added owner all invalidate the old snapshot. Require the sub to send an updated certificate within a few days of any change.
- Annually, even for evergreen relationships. Your favorite electrician of six years still needs a fresh certificate every policy year. Auditors sample the audit period; a two-year-old certificate proves nothing about last quarter.
A practical rule: the person who can stop payment is the person who enforces collection. Give your bookkeeper or office manager written authority to hold the first check until the file is complete. "No COI, no work" only works when it is not negotiable — and not personal.
The Audit Bill for Skipping It
Here is why strictness pays. Workers' compensation and general liability policies are both subject to premium audit — typically every year. The auditor reconciles your estimated payroll and subcontract costs against what actually happened, and asks for proof that each subcontractor carried their own coverage during the audit period.
Proof means a valid COI (and where applicable, exemption documentation) covering the dates the sub worked for you. If you cannot produce it:
- Workers' compensation audit: payments to the undocumented subcontractor are treated as payroll to your own employees and charged premium at your trade classification rates. Construction trade rates are punishing — a $40,000 payment to an undocumented sub can generate several thousand dollars in additional premium, depending on your state and class codes.
- General liability audit: a similar charge applies for uninsured subcontractors, often as a percentage of the subcontract cost or reclassified under your own contracting operations rate.
- State enforcement on top: several states layer penalties for using uninsured subcontractors, and a workplace injury involving an uninsured sub can pull you into the claim as the statutory employer.
None of this requires anyone to get hurt. The audit adjustment alone is the penalty — applied to every undocumented dollar, for the whole policy year, at rates far above what the subcontractor's own small policy would have cost them.
Sole proprietors with no employees complicate the picture: some states allow them to exempt themselves from workers' compensation, while others do not. When an exemption is legitimate, collect the state-issued exemption certificate and keep it with the COI file — it is the document the auditor accepts in place of a workers' compensation listing. When no exemption exists and no coverage is shown, assume the auditor will charge you.
Build a Routine That Survives Turnover and Busy Season
The contractors who sail through audits do not have better memories — they have a checklist that runs without them.
Your pre-work packet
- Signed subcontract with insurance requirements, additional insured language, and waiver requirements spelled out
- W-9 (collect before first payment — it also drives your 1099-NEC filing)
- Current COI naming you as certificate holder, meeting your limits
- Additional insured and waiver endorsements where required
- Licenses, state exemption certificates, or auto ID cards as applicable
Your tracking minimum
- Subcontractor legal name and trade
- Each policy's expiration date, with a 30-day advance reminder
- Certificate file (PDF from the agent — not a photo of a photo)
- Project(s) the certificate covers
- Who verified it and when
A shared folder with a naming convention (SubName_Trade_G-L-exp2026-11-01.pdf) plus a simple expiration spreadsheet beats an inbox search every time. If you run project management or accounting software with vendor-compliance fields, use them — the best system is the one your office manager actually opens.
Sample verification checklist for each incoming COI
- Insured name matches contract and W-9
- All required policies listed with numbers and dates covering the work period
- Limits meet or exceed contract minimums
- Certificate holder is your correct legal entity
- Additional insured box checked and endorsement attached (if required)
- Waiver of subrogation shown per required line (if required)
- Description of Operations references your project
- Issued or updated within the last few weeks, signed by the producer
- Expiration dates logged for renewal follow-up
When a certificate fails, reply with the specific deficiency ("Your general liability aggregate is $1M; our contract requires $2M — please have your agent update and reissue") rather than a vague rejection. Agents fix specific requests fast; they guess at vague ones slowly.
What to do when a sub pushes back
Small subcontractors sometimes bristle — especially one-person shops being asked for paperwork that costs them money. Three responses keep the relationship intact:
- Explain the audit math once: the charge lands on you, so the requirement is not optional.
- Tier requirements by risk so low-risk trades are not priced off your bid list.
- Offer a brief onboarding window (a week, not a quarter) for new subs to have their agent issue the certificate — but hold mobilization until it arrives.
The subcontractors worth keeping already carry coverage and have an agent who issues certificates weekly. Resistance to producing a COI is itself useful prequalification information.
Keep Your Subcontractor Records Audit-Ready
COI discipline and bookkeeping discipline are the same discipline. The payments you track per subcontractor all year — the same totals that flow into your profit-and-loss, your 1099-NEC filings, and your premium audit worksheets — are only defensible when each vendor file pairs the dollars with the documents: contract, W-9, COIs spanning the full work period, exemption certificates where valid, and invoices. Reconcile subcontractor ledgers monthly, file certificates where your bookkeeper can find them in seconds, and review expirations alongside your regular bill-pay cycle. Clean vendor records turn the annual audit from a scramble into a file handoff.
Simplify Your Subcontractor Bookkeeping
As your roster of subcontractors grows, keeping every payment, certificate, and expiration organized is what keeps audits boring. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — version-controlled, auditable, and AI-ready. Get started for free and make next year's audit the easiest one yet.
