Check four things on the certificate: the coverage types and limits, the dates, that your association is named as an additional insured, and that the document came from the insurance agent rather than from the vendor. Then diary the expiration date, because one check is not enough. A certificate is a snapshot of coverage on the day it was issued. Policies get canceled, lapse for non-payment, or run out, and the paper in your file keeps looking valid long after the coverage is gone.
What you are looking at on a COI
Most certificates use the standard ACORD form. The fields that matter to a board:
- The insured. This must be the exact company doing your work, matching the name on the contract. A certificate for a related or differently named business does not protect you.
- The insurer. The insurance company or companies carrying the risk.
- Coverage types and limits. General liability, workers' compensation, auto, and any umbrella or excess policy. Each one carries a per-occurrence limit and an annual aggregate.
- Policy numbers, effective dates and expiration dates. Together they give you the window when the policy is active.
- The certificate holder. This should be your association.
- The description box. Additional insured status and other special terms are usually noted here.
Step 1: Confirm the coverage types and limits meet your requirement
Before you can verify a COI, your association has to have written down what it requires. The figures are your board's to set, and the usual source is your own insurer or lender. The carrier writing your master policy will tell you what it expects a vendor on the property to carry. Larger jobs generally warrant more. Get that number from your agent, put it in your written insurance requirement and in the contract, and then you have something to check a certificate against.
What the requirement should name:
- General liability, at a per-occurrence limit and an annual aggregate your board has set for the risk.
- Workers' compensation for any company with employees. This is the policy that keeps an injured worker's claim from landing on the association. Do not waive it casually.
- Auto liability if vehicles are used on the property.
Check that the certificate shows these policies at or above your association's own limits. It is not enough that insurance "exists."
Step 2: Confirm the dates are current
Look at the expiration date on every policy line. "Current" means active today, not "was active when they signed." A certificate showing a policy that expired last month is not proof of anything. If any coverage has lapsed or is within a few weeks of expiring, get an updated certificate before work continues.
Step 3: Confirm additional insured and, ideally, primary/non-contributory
This is the step boards most often miss, and it is the one that matters most when something goes wrong.
- Additional insured status means your association is covered under the company's policy for claims arising from its work. Without it, that policy protects the company only. Your association is left arguing with their insurer, or paying out of its own policy.
- Primary and non-contributory language means the company's policy pays first, before your association's policy is touched.
- Waiver of subrogation stops the company's insurer from coming after your association to recover what it paid.
Not every certificate will include all of these, and the exact language should track what your contract requires. Confirm the additional insured status appears on the certificate itself. A promise in the contract is not the same thing.
Step 4: Make sure the certificate is real
Certificates can be edited, faked, or issued for coverage that was later canceled. A certificate is a representation, not a guarantee. For any significant contract:
- Confirm with the issuer. The certificate lists the insurance agency or broker that produced it. A quick call or email to that agent confirms the policy is active and the certificate is genuine.
- Watch for edited PDFs. Mismatched fonts, altered dates, or numbers that do not line up are red flags.
- Match names exactly. The insured on the certificate must match the entity on your contract.
Step 5: Track every expiration date from now on
Here is the core problem: even a perfectly valid certificate tells you about coverage on its issue date. A policy canceled next month for non-payment leaves you exposed, and nobody sends you a notice. The certificate in your file still looks fine.
Real verification is not an event. It is a routine. That means:
- Track every company's expiration dates and ask for a renewed certificate before each one lapses.
- Re-confirm the policy periodically, not just at renewal, because mid-term cancellations happen.
- Do not let a company keep working on an expired certificate. The gap between "expired" and "renewed certificate received" is exactly when an uninsured incident hurts the most.
For a community with several companies, this is real administrative work. A calendar of expiration dates, reminders, and follow-ups. It is also the biggest gap between "we have certificates on file" and "we are protected."
A quick verification checklist
Run this for each company before work begins, and again at every renewal:
- Insured name matches the contracted company exactly
- General liability at or above the limit your association set
- Workers' compensation present (if they have employees)
- All policies active today, not expired
- Association named as additional insured, per contract
- Certificate confirmed with the issuing agent for significant contracts
- Expiration dates logged for follow-up before they lapse
Where a platform closes the monitoring gap
The steps above are straightforward once. The hard part is doing them for every company, forever, without letting a lapse slip past.
That is the part a platform carries. On VendoRFP a person reads each certificate and records what the document says: the carrier, the limits, and the expiration date. Where a company typed a figure the certificate does not carry, the certificate wins and the record is corrected before a board sees it. Insurance then runs on a 30-day renewal window, and once that window closes the vendor cannot propose for or be awarded new work at your community until the document is current. That is Step 5 above, taken off a volunteer's calendar. Every company's status reads at a glance on one screen.
A certificate is a snapshot, and the whole problem is that it stops being true without telling you. VendoRFP is where a board watches the date rather than the paper. You post the work. Local vendors propose against it, and your board reads the proposals together before it signs one. The agreement runs between your community and the vendor it chose. The gate is three documents: general liability, workers' compensation, and the credential the vendor's own trade requires. Every expiration date is verified against the limits your community set, which is often the number its own insurer or lender asks for. Invoicing stays with the vendors: each sends its own, and every one lands beside the visit records it covers.
A certificate on file is not proof that the policy is live today. It is proof of one moment. Checking is a standing routine, and the point of putting it somewhere durable is that the routine outlasts the board that started it.