When entering into contracts with third-party vendors, contractors, or tenants, many companies require a certificate of insurance to verify that insurance coverage exists. However, these seemingly straightforward documents harbor numerous pitfalls that can leave the certificate holder exposed to significant risk. Below we discuss these limitations and how to proactively address them.

What is a Certificate of Insurance?

A Certificate of Insurance (“COI”) is a document that purports to verify the existence of insurance coverage. Companies routinely require COIs from third parties to shift the responsibility and cost of purchasing insurance coverage to another entity. If a claim can be made against another entity’s insurance, it minimizes the impact on the organization’s loss history. Additionally, certificates provide reassurance that in the event of a loss for which a third party is liable, financial resources are available beyond that third party’s own assets.

Critically, Certificates are NOT Insurance Policies

COIs provide very basic information about the insurance policy such as the policy number, policy period, insurance company name, policy limits, and the type of insurance. Most crucially, a certificate of insurance is not an insurance policy itself. It does not provide the certificate holder with any rights under the policy, and does not set out the contract’s terms, exclusions, or conditions of coverage. Therefore, organizations cannot rely on the certificate alone, because when a loss occurs, they risk discovering too late that adequate coverage does not exist, leaving them exposed to significant financial risk.

Most COIs are Issued by Brokers, Not Insurance Companies – and this Matters

Most COIs are issued by insurance brokers rather than by insurance companies, adding another layer of uncertainty. COIs do not guarantee that the insurance company has recognized or is even aware of the coverage represented by the document. In some cases, the insurance company may not even be aware that a certificate was issued.

Additionally, when a COI is issued by a broker, insurance companies generally argue they are not bound by representations in the broker’s certificate, contending that the broker is the agent of the policyholder rather than the insurance company. This distinction matters tremendously because the agency of the broker can determine whether coverage exists at all.

Inaccuracies, Cancellation, and Other Hidden Risks

Relying exclusively on COIs presents other risks as well. Sometimes, COIs are incomplete or misleading as to the scope of coverage provided by the policy. Certificates also run the risk of being fraudulent, such as in situations where no insurance was purchased at all. In these instances, the certificate holder may have no recourse, especially if the statute of limitations for a claim against the broker has expired.

The COI may state that you have been added to the policy as an additional insured, even though the underlying policy contains no such endorsement. The policy may also exclude the very risk for which coverage is sought, or, even where coverage exists, it may be subject to high deductibles or self-insured retentions that materially limit the coverage expected.

Another significant risk is cancellation of the policy. Under modern ACORD forms, insurance companies are not required to notify certificate holders of cancellation unless the policy itself requires such notice. As a result, the certificate holder may believe coverage remains in force long after it has been terminated.

If the Insurance Company Denies the Additional Insured Coverage Under the Policy, Consider Estoppel

If an insurance company denies the additional insured coverage, the additional insured should consider whether an estoppel argument could be made. Under this doctrine, courts have prevented insurance companies from disclaiming coverage based on representations made in a COI that conflict with the underlying policy. For instance, in Int’l Amphitheater Co. v. Vanguard Underwriters Ins. Co., the court held that where a COI and policy conflict, the certificate generally controls. The court reasoned that policyholders should not be held to have knowledge of exclusions they were never told about. 532 N.E.2d 493, 502 (Ill. App. Ct. 1998).

However, certificate holders should not rely on such outcomes, because whether estoppel arguments are successful depends on several factors. Generally, estoppel arguments are strongest when the insurance company itself issues the COI. See e.g., Bucon, Inc. v. Pennsylvania. Mfg. Ass’n Ins. Co., 547 N.Y.S.2d 925 (App. Div. 1989). For broker-issued COIs, success depends on whether the broker had authority to bind the insurance company and case-specific factors such as whether the insurance company received a copy of the certificate or whether the broker made knowing misrepresentations about the scope of coverage. See e.g., Lenox Realty v. Excelsior Ins. Co., 679 N.Y.S.2d 749 (App. Div. 1998); Brown & Brown of Texas, Inc. v. Omni Metals, Inc., 317 S.W.3d 361 (Tex. App. 2010).

Best Practices to Protect Your Organization: Careful Contract Drafting and Reviewing the Underlying Policy

While estoppel may provide a remedy in some cases, the best approach is to address the risks proactively through careful contract drafting and policy review. The risks outlined above are exacerbated by the fact that the certificate holder rarely receives a copy of the actual insurance policy, relying entirely on the certificate as proof of adequate protection. For the certificate holder, it is the additional insured endorsement and the policy itself that confers coverage rights, not the COI.

Therefore, certificate holders must be proactive and insist on receiving a copy of the insurance policy itself. That includes drafting contracts to specifically require delivery of the policy, then reviewing the policy carefully to determine what rights they have in the event of a loss. If the policy and COI do not meet the certificate holder’s needs, they should insist that the documents are revised accordingly.

Additionally, given the risk of cancellation of the policy without notice, certificate holders should draft their contracts to require that the insurance policy obligates the insurance company to provide at least 30 days’ notice of cancellation to the certificate holder, allowing enough time to secure new insurance or mitigate the risk of loss. Or, at minimum, certificate holders should require evidence of renewal for subsequent policy periods.