What Makes a Certificate of Insurance Deficient

"Compliant" is meaningless without your own thresholds

A certificate of insurance is a snapshot of what a policy showed on the day it was issued. It is not a pass or a fail on its own, because there is no universal standard to pass — a $1,000,000 general aggregate satisfies one contract and fails the next. A certificate is only ever compliant against a specific set of requirements, which is why the useful question is never "is this COI good?" but "does this COI meet the five things our contract asks for?"

Everything below assumes you have written those requirements down. If you haven't, that is the actual first task, and no amount of software substitutes for it.

1. A limit below your required minimum

The most common deficiency and the easiest to miss, because the certificate does show a number — it is simply the wrong one. General aggregate is where this bites most often: a certificate showing a $1,000,000 each-occurrence limit and a $1,000,000 general aggregate satisfies a $1M/$1M requirement and fails a $1M/$2M one, and the two look nearly identical on the page.

Check each limit you actually require, separately: each occurrence, general aggregate, products/completed operations aggregate, personal and advertising injury, damage to rented premises. A certificate frequently fills some of these and leaves others blank.

2. Additional insured status not shown

If your contract requires you to be named as an additional insured, the certificate needs to show it — usually as a mark in the ADDL INSD column against the relevant coverage line, and often with supporting language in the description of operations. An unmarked column is not a technicality: without the endorsement, the policy may not respond to a claim against you at all.

Note the limit of what a certificate can tell you here. The ACORD 25 itself states that it confers no rights and does not amend the policy. The mark indicates an endorsement is claimed to exist; the endorsement itself is a separate document.

3. Waiver of subrogation not confirmed

Same shape as additional insured, different column — SUBR WVD. Where a contract requires the insurer to waive its right to recover against you, an unmarked column means the requirement is unmet on the face of the document.

The mark sits on each coverage line separately, so a waiver shown on general liability says nothing about workers’ compensation. Check the line your contract names. Our API checks the waiver on general liability and on workers’ compensation as two separate rules; it does not check a waiver on the automobile or umbrella lines.

4. A required coverage that is not on the certificate at all

Umbrella and excess liability is the usual case: the contract requires it, and the certificate's umbrella section is simply empty. So is workers' compensation for a sole proprietor who has opted out. An absent section is not a low limit — it is no coverage shown, and it is worth reporting differently from a limit that fell short, because the remedy is different.

5. Dates that expire inside your window

A policy that is valid today but expires in eleven days will not cover a job that runs for six weeks. Checking "not expired" is the weak version of this test; checking "remains valid for at least N more days" is the one that prevents the gap. Every coverage section carries its own effective and expiration dates, and they are frequently not the same.

Certificates also arrive with unreadable dates — faxed, scanned at an angle, or printed from a specimen template with placeholder characters where a year should be. An unreadable date is not a valid one, and it should stop the check rather than pass it.

6. The certificate holder is wrong

A certificate issued to a different entity — a parent company, a prior project owner, an affiliate with a similar name — provides you nothing, however good the coverage looks. It is a quick check and it is skipped constantly, because the document appears correct in every other respect.

The failure mode nobody itemizes: a field that was never read

Every check above assumes the numbers in front of you were actually read off the document. Certificates arrive as scans, faxes, and phone photographs, and any automated extraction — ours included — will sometimes encounter a cell it cannot read.

The dangerous outcome is not a blank. It is a plausible value: an amount inferred from the row above it, or a date reconstructed from a placeholder. A limit that was guessed looks exactly like a limit that was read, and it can turn a deficient certificate into a clean one silently.

That is a design decision rather than an accuracy problem, and it is worth asking of any tool you use: when it cannot read a field, does it tell you? Our answer: an unreadable field comes back as null, named in a withheld list, and marked unreadable — a request for a clearer copy, not a coverage deficiency. If a rule you set depends on it, the verdict is cannot_determine, never compliant. An absence of findings should never be mistaken for an absence of checking.

Checking this automatically

Each item above is a rule with a threshold, which means the whole review is mechanical once the requirements are written down. The COI / ACORD 25 Verification API takes a certificate and your requirement thresholds and returns a verdict — compliant, deficient, or cannot_determine when a value a rule needs could not be read — with an itemized list of exactly which of these failed and why — including which rules it evaluated, so a clean result can be distinguished from a check that never ran.

Or try it on a real certificate right now, free and without signing up: the COI checker runs the same code this API does, including the part that tells you which fields it could not read.

And if you would rather test this than take our word for it: the COI Extraction Honesty Test is an open, synthetic test set for exactly this failure — four documents, documented ground truth, free to run against any tool.

Related reading: Automating ACORD 25 Verification for Vendor Onboarding.