Subcontractor Insurance Verification: A GC's Complete Process Guide

Subcontractor insurance verification is not a checkbox. It is the last line of defense between a job-site incident and a six-figure gap in coverage landing on your policy. Done right, it takes a trained eye, a defined checklist, and a system that doesn't rely on memory. Done wrong—which is most of the time—it creates the illusion of compliance while leaving you exposed.

By Nick Streicher, Founder, StrikeDocs. Published 2026-04-30.

This guide covers the full verification workflow: which coverage types to require, how to read the endorsements that actually matter, what limits are sufficient versus cosmetic, and how to build an expiration-tracking system your office will actually use. It also includes real data from 59 COIs we processed through StrikeDocs, because the gap between what GCs think they're getting and what's on the page is wider than most people expect.

Why subcontractor insurance verification fails in practice

The failure mode is almost always the same: someone collects the certificate, glances at the coverage boxes to confirm there are numbers in them, and files it. The certificate goes into a folder—physical or digital—and is not looked at again unless a claim forces the issue.

At that point, three things tend to be true simultaneously. First, the subcontractor's policy expired mid-project and nobody caught it. Second, the Additional Insured endorsement names the wrong entity, or uses a form that only covers completed-operations exposure and not ongoing operations, or both. Third, the Primary and Noncontributory language required by your subcontract is either missing from the endorsement entirely or exists only as a typed note in Box 23 of the ACORD 25, which most carriers will ignore when the claim hits.

None of these problems are hidden. They are all visible on the face of the certificate and its attached endorsements—if you know what to look for and take the time to look.

The reason verification degrades is volume and repetition. A GC managing 20 active subcontractors across three projects is receiving and re-receiving COIs constantly: new projects, renewals, mid-term carrier changes, additional insured requests from owners pushing down their requirements. When the volume is high and the process is manual, corners get cut. The solution is a standardized process that can be executed consistently at scale, not one that depends on institutional knowledge walking out the door with a senior project manager.

The five coverage types you must collect

Your subcontract should specify minimum coverage requirements before work begins. The certificate you collect should confirm every line. Here are the five types that belong on virtually every commercial subcontract, with notes on where each one tends to break down.

1. Commercial General Liability (GL)

GL is the baseline. It covers bodily injury and property damage arising from the subcontractor's operations, including completed-operations exposure. The two limits that matter most are each-occurrence and general aggregate. A $1M/$2M structure is the market floor for most commercial work; owner contracts on larger projects frequently require $2M/$4M or higher.

GL is also where Additional Insured, Primary and Noncontributory, and Waiver of Subrogation endorsements attach. If these aren't on the GL policy, they're not protecting you.

2. Workers' Compensation and Employer's Liability (WC)

WC is the one coverage type where you are not trying to protect your own balance sheet—you're trying to confirm that the subcontractor's employees are covered by the sub's carrier and not by yours. In most states, if a subcontractor doesn't carry WC and an employee is injured, the GC can be held responsible as the statutory employer. The statutory limits for WC vary by state; the Employer's Liability portion typically reads $100K/$500K/$100K at minimum, though $500K/$500K/$500K is common on commercial projects.

3. Commercial Auto

Any subcontractor who drives to your site, hauls materials, or operates owned, hired, or non-owned vehicles needs auto coverage. "Hired and Non-Owned Auto" is frequently missing from subs who don't own a fleet—they assume personal auto covers business use, which it typically does not for commercial operations. Confirm the auto policy explicitly covers hired/non-owned in addition to any owned vehicles.

4. Umbrella / Excess Liability

Umbrella policies sit above GL, auto, and sometimes WC. They matter when the underlying limits are insufficient to cover a serious incident. If your subcontract requires $5M in total GL coverage and the sub carries $1M primary, the umbrella needs to be structured to follow form and bring the total to the required level. Confirm the umbrella is not writing on a standalone basis with exclusions that gut the underlying coverage.

5. Professional Liability / Errors & Omissions

Not every trade needs this. Design-build subs, engineers of record, architects, and technology consultants do. Professional liability covers claims arising from errors in professional services—it does not appear on a standard GL policy and will not respond to design defect claims if the sub doesn't carry a separate policy. This is the coverage type most commonly overlooked because most GC subcontract templates weren't updated to include it when design-build delivery became common.

What the certificate actually proves (and what it doesn't)

The ACORD 25 Certificate of Insurance is a summary document. It is produced by the subcontractor's broker, not by the carrier. It lists coverage types, policy numbers, effective dates, and limits, and it can include endorsement descriptions in the remarks section. What it does not do is create any coverage that doesn't exist in the underlying policy. It is not a guarantee. The ACORD 25 form itself says this explicitly in the disclaimer at the top of the document.

This distinction matters because it means you cannot verify coverage from the certificate alone. You can verify that the broker represented that certain coverage exists as of the date the certificate was issued. For material terms—particularly Additional Insured status and Primary and Noncontributory language—you need to see the actual endorsement forms, not just a note in the remarks box.

See our breakdown of how to read an ACORD 25 and what a COI actually covers for more detail on the document's structure and limitations.

Endorsement verification: the step most GCs skip

Endorsements are where verification either holds up or falls apart. There are three endorsements that belong on every commercial subcontract, and each one requires more than a checkbox.

Additional Insured

The certificate should show you as an Additional Insured on the sub's GL policy. But the form number matters. The two most common ISO forms are CG 20 10 (ongoing operations) and CG 20 37 (completed operations). If your subcontract requires both ongoing and completed-operations AI coverage—which it should—you need both forms. A certificate that lists only CG 20 10 leaves you exposed to completed-operations claims after the project closes. A certificate that lists only CG 20 37 leaves you exposed during active construction.

Some subs use a blanket AI endorsement rather than a scheduled one. Blanket endorsements are acceptable if they're triggered by the subcontract—confirm the endorsement language actually extends to "any person or organization required by written contract" or equivalent. Scheduled endorsements must name you correctly; a typo in the entity name is sufficient grounds for a carrier to contest AI status at claim time.

Waiver of Subrogation

A Waiver of Subrogation prevents the sub's carrier from suing you to recover losses after paying a claim to the sub. Without it, the carrier can step into the sub's shoes and pursue recovery against you even though you're listed as AI. Like the AI endorsement, this needs to attach to GL, WC, and auto separately. Confirm it appears on all three.

Primary and Noncontributory

This endorsement establishes that the sub's policy responds first, before your policy contributes anything. Without it, if both policies could theoretically apply to a loss, carriers often argue about which is primary, leading to coverage disputes that delay claims resolution and can result in your policy sharing costs it shouldn't. The typed note "Primary and Noncontributory" in the ACORD 25 remarks section is not an endorsement. It is a statement by the broker. The actual endorsement must be attached.

Limits: what's adequate and what's theater

Limit requirements in subcontracts are frequently set once and never revisited. The $1M GL per-occurrence requirement in a subcontract template written in 2012 has not kept pace with construction cost inflation, litigation trends, or the expectations of upstream owners who are now pushing $5M and $10M requirements onto GCs.

Review your subcontract minimum requirements at least annually. Key benchmarks:

GL each-occurrence: $1M is the floor. Commercial projects with any significant public exposure should require $2M. Projects with owner requirements above $2M should flow those requirements down to any sub whose scope contributes to that exposure.
GL aggregate: At least 2x the per-occurrence limit. A sub who burns through their aggregate on a single incident earlier in the year is effectively uninsured for the rest of the policy period.
Umbrella: Set the total combined requirement (GL + umbrella) and let the sub structure the underlying-to-excess split. Don't let a sub satisfy a $5M requirement with a $5M GL when $1M GL plus $4M umbrella would be both cheaper for them and structurally equivalent.
WC Employer's Liability: $500K/$500K/$500K is the practical minimum on commercial work. Some states allow lower statutory limits; your subcontract should specify the higher requirement explicitly.

If the numbers on the certificate don't meet your minimums, the sub is not compliant. Do not allow work to proceed until you have a new certificate with corrected limits or a documented risk-transfer decision made by someone with authority to make it.

Expiration tracking and renewal workflows

A certificate that was compliant in March is not automatically compliant in October. Policies renew annually. Mid-term cancellations happen. Carriers non-renew. The 30-day notice of cancellation provision that appears on some certificates is helpful but not guaranteed—and even when it's present, 30 days is not much runway if the sub struggles to find replacement coverage.

A functional expiration tracking system needs to:

Log every policy expiration date at the time the certificate is collected.
Generate a reminder at 60 days before expiration to request a renewal certificate.
Generate a hard stop at 14 days before expiration if no renewal certificate has been received.
Flag any project where a sub's policy has lapsed and the sub still has active scope.

Spreadsheets can handle this if someone owns the process. The failure mode with spreadsheets is that nobody owns the process—the column is there but the lookup doesn't happen. Whatever system you use, it needs an owner and a defined escalation path when a sub is non-compliant.

For multi-state projects, also track state-specific WC requirements. Several states—including California, New York, and Washington—operate state-funded WC monopoly funds or have specific endorsement requirements that differ from standard ISO forms. A WC certificate that is valid in Georgia may not satisfy a New York project's requirements. See our COI compliance requirements by state post for state-specific details.

What we learned running 59 real COIs through StrikeDocs

We ran 59 subcontractor certificates through StrikeDocs and extracted structured data from each one. The findings below are from that corpus. They reflect what is actually showing up on certificates in the field, not what subcontract templates say should be there.

Only 33.9% of policies carried an Additional Insured endorsement. This is the single most required endorsement in commercial subcontracts and it was missing on two-thirds of policies in the sample. Some of this is a document-collection problem—the AI endorsement exists on the policy but wasn't attached to the certificate. Some of it is a genuine gap. Either way, if you're not verifying endorsement attachment explicitly, you're approving non-compliant certificates at a high rate.
Waiver of Subrogation appeared on only 21.3% of policies, and Primary and Noncontributory on only 15.5%. These three endorsements—AI, WoS, and P&NC—form a package. In practice, all three appear together less than 15% of the time. GCs who require all three in their subcontracts but don't verify all three at certificate review are getting less coverage than their contracts specify.
69.5% of documents contained two or more policies, with an average of 2.9 policies per document. This means the typical COI in the corpus represents multiple coverage lines that each need to be verified independently. A manual reviewer who confirms GL limits but doesn't cross-check the WC or auto policy details on the same document is doing partial verification. Structured extraction makes it practical to check every policy line on every document, not just the first one that looks correct.

Additional context from the corpus: GL was the most common coverage type (47 policies, 27.0% of all policies extracted), followed by WC (37 policies, 21.3%) and Auto (35 policies, 20.1%). Umbrella appeared in 25 policies (14.4%). Professional liability appeared in only 9 policies (5.2%)—consistent with the pattern of it being under-collected even when the scope warrants it.

Here is an example of the structured extraction output StrikeDocs produces for a single COI:

{
  "policies": [
    {
      "type": "GL",
      "each_occurrence": 1000000,
      "general_aggregate": 2000000,
      "policy_number": "GL-REDACTED-001",
      "effective": "2025-06-01",
      "expiration": "2026-06-01",
      "endorsements": [
        "CG 20 10 04 13 - Additional Insured - Owners, Lessees or Contractors - Scheduled Person or Organization",
        "Primary and Non-Contributory"
      ]
    },
    {
      "type": "WC",
      "each_accident": 500000,
      "disease_policy_limit": 500000,
      "disease_each_employee": 500000,
      "policy_number": "WC-REDACTED-002",
      "effective": "2025-06-01",
      "expiration": "2026-06-01",
      "endorsements": []
    },
    {
      "type": "AUTO",
      "combined_single_limit": 1000000,
      "policy_number": "AU-REDACTED-003",
      "effective": "2025-06-01",
      "expiration": "2026-06-01",
      "endorsements": [
        "CA 20 48 10 13 - Designated Insured for Covered Autos Liability Coverage"
      ]
    }
  ],
  "certificate_holder": "[GC ENTITY NAME REDACTED]",
  "producer": "[BROKER NAME REDACTED]"
}

Notice what's missing: Waiver of Subrogation on any line, CG 20 37 for completed operations, and umbrella coverage entirely. This would be a non-compliant certificate under a standard commercial subcontract—and it would look fine to a reviewer doing a fast visual scan.

Building a verification checklist your office can execute consistently

The goal is a checklist that a project coordinator can run without needing to call someone who's been in the industry for 20 years to interpret what they're looking at. Here is a structure that works:

Collection

[ ] Certificate received before sub mobilizes
[ ] Certificate dated within 90 days
[ ] All required coverage types present: GL, WC, Auto, Umbrella (if required), Professional (if required)

Limits

[ ] GL each-occurrence meets subcontract minimum
[ ] GL aggregate meets subcontract minimum
[ ] WC Employer's Liability meets subcontract minimum
[ ] Auto CSL meets subcontract minimum
[ ] Umbrella/Excess meets combined limit requirement

Endorsements

[ ] Additional Insured — ongoing operations (CG 20 10 or blanket equivalent) attached
[ ] Additional Insured — completed operations (CG 20 37 or blanket equivalent) attached
[ ] Named insured on AI endorsement matches certificate holder name exactly
[ ] Waiver of Subrogation on GL attached
[ ] Waiver of Subrogation on WC attached
[ ] Waiver of Subrogation on Auto attached
[ ] Primary and Noncontributory endorsement attached (not just noted in remarks)

Expiration

[ ] All policy expiration dates logged in tracking system
[ ] 60-day renewal reminder scheduled

Escalation

[ ] Any deficiency documented and communicated to sub in writing
[ ] No work authorization issued until deficiencies resolved or risk-transfer decision documented

This checklist does not replace judgment. A blanket AI endorsement needs to be read to confirm it's triggered by written contract. A WoS endorsement needs to be checked for any exclusions. But it gives every reviewer a consistent starting point and a paper trail that demonstrates due diligence.

For the ACORD 25 form structure that underlies all of this, see our ACORD 25 Certificate of Insurance explained post.

Subcontractor insurance verification is not complicated. It is detailed, repetitive, and consequential—which is exactly why it needs a system instead of a habit. The data from our COI corpus makes clear that even basic endorsement requirements are missing far more often than they should be. Build the process, own the checklist, and don't accept a certificate that doesn't clear every line.