The endorsement, not the certificate, is the thing that proves cover

The certificate of insurance is a summary of cover, issued for information. The additional insured endorsement is part of the policy itself, and it is what actually extends cover to somebody who is not the policyholder. Collecting certificates and calling that compliance records that a producer typed some numbers onto a form on a particular day. It does not establish that your company is an additional insured on that subcontractor's policy.

The distinction stays invisible until a claim, at which point it is the only thing anybody cares about. It also changes what a tracking system has to hold, which is where software teams get it wrong: they build 1 expiry date per subcontractor, when the real unit is a document per policy per project. A sub carrying 4 policies on a 3-project agreement is 12 rows, not 1.

Two documents doing two different jobs

That fourth row is not an interpretation you have to take on trust. Read the disclaimer block printed on the next COI that arrives: the document says in its own words that it is not the evidence. What that wording means for your contracts is a question for your broker — but read one first, because most people who spend a day a week chasing COIs have never read the top of the page.

Three things only the endorsement can settle

• Who is covered. A specifically named party, or a class defined by a written-contract requirement, or nobody at all. A certificate box with your company's name typed into it is a statement about the certificate, not about the policy.
• For what, and for how long. Cover during ongoing operations and cover for completed operations are separable, and the second is the one that matters after handover — a 12-month policy, a 30-month build and a completed-operations tail measured in years are 3 different clocks over the same work.
• How it sits against your own cover. Whether the subcontractor's policy responds first, whether it contributes with yours, and whether the insurer gave up its right to come back at you are separate grants, each of which lives in policy language rather than in a tick box.

What the compliance record actually has to hold

The unit of record is not a subcontractor. It is a policy, held by a legal entity, applicable to a project, evidenced by documents that each carry their own dates. That is 4 objects — entity, policy, evidence, requirement — and most systems ship with 1. Modelled properly, the tracking problems disappear before anyone writes an alerting rule.

• The entity. Which legal entity holds the policy, checked against the entity on the subcontract. A trading name on the certificate and a different company on the agreement is the most common quiet defect in a compliance file.
• One row per policy. Type, insurer, policy number and expiry — general liability, workers compensation, commercial auto and any excess layer are 4 separate policies renewing on 4 dates, and which of them your contract requires differs by market and by job.
• The endorsement as a stored file, not a checkbox. If the document is not in the record, the record is a claim about a document.
• The form reference and edition exactly as printed on the endorsement you received. Copy it from the page in front of you rather than from a template or from memory — the edition is the part that changes what the wording says.
• Project applicability. Which projects this evidence covers, because requirements differ per job and per owner, and a sub compliant on one site can be non-compliant on the next one that afternoon.
• The requirement it was checked against: the version of that project's insurance exhibit in force when the check was made.
• Two dates, not 1. The policy's expiry, and the date a person opened the document and verified it, with their name against it.

A certificate answers the question was it asked for. Only the endorsement answers the question was it granted.

Where this shows up before anyone is on site

Insurance is a qualification rather than a price, and it still moves prices. A bidder who cannot meet the requirement either buys the cover and carries it in the number, or excludes it and stays cheap, which is one of the routes by which the lowest number turns out to be missing scope. Requirements heavier than the invited pool can carry also suppress bids outright, which is one branch of you invited forty subs and three of them bid.

The requirement should travel with the package that creates it, which makes it part of the boundary decision described in how a bid package boundary is drawn. After award it becomes a date problem, and the way dates escape has its own diagnosis in an expired certificate found after the sub is on site.

Whether this lives inside your project platform or beside it comes down to one row in the evaluation — can it hold more than 1 expiry per company, per project — which belongs to the wider list in questions to settle before choosing a project platform. Where the answer is no, a compliance register is a small, boring build: a document store, an entity model with 4 objects in it, and a scheduled check. That is internal tools and operations work. This page sits in bidding, prequalification and subcontractor management, part of our construction and contracting work.

• subcontractors
• compliance
• risk
• definitions