What a certificate of insurance is and how to read one

A certificate of insurance (COI) is a standardized, one-page summary of an insurance policy. A broker or agent issues it on behalf of the insured to confirm that specific coverage was in force on the date the certificate was prepared. It lists the lines of coverage, the carriers, the policy numbers, the effective and expiration dates, and the limits of liability.

The most common form is the ACORD 25, the certificate of liability insurance, published by ACORD, the standards body for insurance data. It is the document a general contractor asks a subcontractor for before they set foot on site, the document a landlord requires before handing over keys, and the document a client requests before signing a vendor agreement.

Here is the point most people get wrong. A COI is information only, and the form says so. It documents that coverage existed on the issue date, but it does not amend, extend, or alter the underlying policy, and it confers no rights on the party holding it. If the certificate and the policy disagree, the policy governs. A certificate issued in January tells you nothing about whether the policy lapsed in March.

That gap between what a COI shows and what people assume it guarantees is exactly what Advocate is built to close. Rather than trusting a stale certificate on file, Policy Organizer reads each COI into structured data and Coverage Gap Analysis checks it against the coverage you actually require, so a snapshot becomes a monitored, verifiable control.

The ACORD 25 reads top to bottom and answers four questions. Who is covered, by whom, for what, and until when. Once you know where each answer lives, you can spot a problem in seconds instead of squinting at a PDF, and it is the same anatomy Advocate structures into benchmark-ready fields automatically.

These two terms sit inches apart on the form and get confused constantly, but they confer very different protection, and getting them wrong is where risk transfer quietly fails.

A certificate holder is the party that received the certificate. Being listed here gives you notice of coverage and a record that you verified it. That is all. It extends none of the policy's protection to you. If a claim arises from the insured's work, being the certificate holder does nothing to put that claim on their policy.

An additional insured is granted actual coverage under the other party's policy, and that grant comes from an endorsement, not the checkbox. For ongoing operations the standard is CG 20 10, and for completed operations it is CG 20 37. When both are in force and named correctly, the insured's carrier can defend and indemnify you for claims arising from their work.

A waiver of subrogation and primary and non-contributory language work the same way. Each needs a supporting endorsement, not just wording typed into the description box, and the IRMI glossary explains how these endorsements operate.

The practical rule. When you require a COI to transfer risk, demand the endorsement itself rather than settling for a certificate holder listing or a checked box, and requirements vary by contract and jurisdiction, so verify against the actual policy. This is exactly the distinction Advocate checks on every certificate, flagging an additional insured claim that has no endorsement behind it.

Three parties touch every certificate. Brokers and agents issue COIs on behalf of the insured, the business buying the insurance requests them from its broker, and a third party exposed to the insured's risk is who requires them in the first place.

General contractors require COIs from every subcontractor so a sub's liability claim lands on the sub's policy rather than the GC's. Property owners and managers require them from tenants and vendors, clients require them from agencies and service providers before a contract starts, and lenders and franchisors require them as a condition of financing or the operating agreement. The common thread is risk transfer, and the Insurance Information Institute covers why small businesses carry these lines in the first place.

For a broker or an owner managing a roster of these obligations, the hard part is not requiring the certificate. It is confirming, on an ongoing basis, that every one still meets the requirement. That is the job Advocate takes over for a certificate of insurance for contractors and for small business owners tracking dozens of vendors.

The structural problem with certificates is that each one describes a single moment, while the obligation runs for the life of the contract. A COI collected at onboarding can be stale within weeks. A policy lapses for non-payment, a carrier non-renews, a limit drops below the contractual minimum, or the additional insured endorsement was never actually issued behind the checkbox.

Manual COI tracking, meaning a shared inbox, a spreadsheet of expiration dates, and a folder of PDFs, fails on three fronts. It misses expirations, because no human watches every renewal date across hundreds of vendors. It accepts non-compliant certificates, because reading limits and endorsements against each contract's requirements by hand is slow and error-prone. And it leaves no defensible audit trail when a claim finally arrives and someone asks whether coverage was ever verified.

For brokers and property owners the gap is not merely administrative. A missed lapse or an unverified limit becomes E&O exposure, audit risk, and uncovered liability. The precise risks a certificate of insurance was supposed to mitigate.

This is the problem Advocate was built for. Because a certificate is a snapshot, Advocate makes the check continuous. It collects certificates with automated notices, re-reads each one on arrival, and re-verifies it against your requirements every time, so compliance is a live state rather than a folder of expired PDFs.

Advocate benchmarks and tracks commercial insurance portfolios, and it complements your agency management system rather than replacing it. The same engine that benchmarks a portfolio on price and coverage runs certificates end to end. To date it has organized 71,117+ policies representing $7.3B+ in premium across 5,633 carriers.

Policy Organizer reads policy PDFs and ACORD forms, including the ACORD 25, and structures them into benchmark-ready data in a median of 45 seconds, normalized to Advocate's open Data Standards on the way in.

Coverage Gap Analysis then reviews each certificate against your required coverage standards, drawing on a Coverage Library of 615 profiles across 21 industries, and surfaces gaps, audit risk, and E&O exposure across blanket, layered, and excess programs. COI Tracking collects certificates with automated collection notices, verifies them on arrival, and flags gaps and exceptions the moment a certificate comes in, so renewals are requested before coverage lapses and every review leaves a defensible record.

Verification runs against your actual requirements and the underlying endorsements, not a checkbox. Coverage varies by policy and contract, so Advocate is built to check each certificate against the real thing. Start on the free tier, no credit card required, with value in 10 seconds.

Ask ten people for the COI meaning and you get ten half-answers, because the form packs a dozen insurance terms into one page and assumes you already know them. The short version. A certificate of insurance is evidence of insurance, not the insurance itself. The policy is the contract, and the COI is a dated receipt that the contract existed, issued by the broker who placed it.

The wrong reading costs money. People treat a COI as a guarantee when it is not, a checked box as coverage when it is not, and a certificate holder slot as protection when it is not.

The definitions below spell out what each term does and does not give you, and they are the same distinctions Advocate checks automatically on every certificate. For the deeper mechanics of a single line, the certificate of liability insurance page walks the ACORD 25 liability sections in detail, and the Insurance Information Institute covers why each commercial line exists.

The three parties named on or around a COI, what coverage each attaches to, and what proof to demand.

You do not need to read a certificate of insurance left to right. Read it in the order that catches problems fastest. Identity first, then the money, then the fine print. A broker triaging a stack of COIs runs the same five passes every time, captured in the how-to steps on this page, and once you know the sequence you can clear a compliant certificate in under two minutes and quarantine a bad one just as fast.

The one habit that matters most. Never stop at a checked box. A checked ADDL INSD box is a claim that additional-insured status exists, not the proof. The proof is the endorsement, CG 20 10 for ongoing operations and CG 20 37 for completed operations, which lives in the policy, not on the certificate. Two more traps live in the numbers. General liability carries three separate limits, not one, and an A.M. Best rating is never printed on the ACORD 25, so you look it up separately at A.M. Best.

These are exactly the checks that do not scale by hand across a book of vendors, which is why Advocate runs them automatically inside COI tracking software and across the broader insurance software platform, matching limits, confirming endorsements, and vetting carriers on every certificate.

A baseline many commercial contracts require. Higher-risk work and lenders push these up.

A certificate of insurance is only useful if you know the number you are looking for before you open it. Most commercial contracts anchor on a familiar set of minimums, and reading the COI is really a matter of confirming each required limit is met or exceeded and that the right endorsements sit behind it.

Typical requirements. Commercial general liability at $1M per occurrence and $2M general aggregate, commercial auto at $1M combined single limit, an umbrella or excess layer of $5M or more over the underlying general liability and auto, plus statutory workers' compensation with $1M employers' liability. Higher-risk work, construction, habitational property, and anything a lender touches push these up. A limit that sits below your contractual minimum is the single most common COI defect, and it is trivial to miss by eye across dozens of vendors.

This is the requirement-matching Advocate runs on every certificate, the same logic it applies for a certificate of insurance for contractors and for small business vendor rosters, drawing on a Coverage Library of 615 profiles across 21 industries. The limits table below shows a common baseline, but requirements vary by contract, jurisdiction, and lender, so verify against the actual policy.

The three roles on and around a certificate of insurance blend together constantly, but a loss payee is the one most often placed on the wrong coverage. A loss payee is named on first-party property coverage and is paid for physical loss or damage to a specific asset, for example a lender or lessor with a financial interest in equipment or a building.

That is fundamentally different from an additional insured, who is added to third-party liability coverage to be defended and indemnified for claims arising from the named insured's work. Lenders on real estate or equipment financing often require both at once, loss payee status on property and additional insured status on liability, so a single COI has to satisfy two different coverage parts correctly.

Getting the role right is the difference between being paid and being told you have no standing to claim. Advocate reads and verifies each role against your requirements as part of COI tracking, and the same benchmarking engine powers renewal reviews for insurance brokers and compliance at scale for loan servicers.