Subcontractor COI Tracker: ACORD 25 Review for GC AP

A subcontractor COI tracker is a per-policy-per-sub workpaper. A typical commercial sub on your projects carries four to seven separate policies — Commercial General Liability, commercial Auto, Workers Compensation plus Employers Liability, Umbrella or Excess, and trade-specific layers like Builders Risk, Pollution, or Professional. Each policy sits with its own carrier, on its own policy number, with its own expiration date. The standard ACORD 25 Certificate of Liability Insurance carries roughly 77 extractable fields. An active, current ACORD 25 with the matching endorsement documents on file is the precondition to onboarding a sub, releasing every monthly pay app, and releasing retainage at closeout.

The tracker captures every active policy line across every sub, compares each line against that sub's subcontract Schedule of Insurance Requirements, records the additional insured and waiver-of-subrogation endorsements that back the certificate, and calendars renewals so a policy lapse doesn't become the first thing anyone notices on a Monday morning.

One point is load-bearing for everything that follows: the ACORD 25 describes coverage, it does not grant it. The "additional insured" indicator on the certificate is a representation by the broker, not the policy itself. Without the matching endorsement document on file — CG 20 10 for ongoing operations, CG 20 37 for completed operations, or CG 20 33 for the blanket version of the ongoing-operations grant — your additional insured status is unenforceable when a claim actually lands.

This piece is for the GC AP coordinator, risk manager, contract administrator, or project administrator owning subcontractor insurance compliance on US commercial, multi-residential, or public-works projects. It isn't for the sub obtaining their own coverage, isn't a multi-jurisdictional insurance reference, and isn't a claims-handling guide. It's also distinct from your own outgoing GL audit at year end — for that, see general liability premium audit preparation for general contractors, which is the GC's premium-side workflow rather than the subcontractor-compliance workflow.

Reading the ACORD 25 Field by Field

The ACORD 25 is a single page with a deceptive amount of structure. Walk it the way an AP coordinator actually keys it, top to bottom, and the form maps cleanly to tracker columns.

Producer block (top-left). Broker or agency name, address, phone. The producer phone column matters because the broker is usually the fastest path to a missing endorsement document or a binder letter at renewal.

Insured block (top-right). The subcontractor's legal name and address. Match it against the subcontract's named-insured field exactly. "ABC Mechanical Inc" on the COI and "ABC Mechanical LLC" on the subcontract is a flag — different legal entity, different policy, possibly an entity restructure the sub didn't tell you about.

Insurer rows (Insurer A through Insurer D, sometimes E). Each row is a separate carrier and NAIC code. The coverage table below references these letters, so different policy lines on the same certificate routinely sit with different carriers — CGL with Travelers, Auto with Progressive Commercial, Umbrella with a specialty market, WC with the state fund.

The coverage table. Most of the form's information density lives here. Each policy line carries the type-of-insurance code (CGL, Auto, Umbrella, WC + EL), policy number, effective and expiration dates, indicator boxes (additional insured, subrogation waived, claims-made vs occurrence for CGL, any-auto vs scheduled for Auto), and limit fields. CGL carries each-occurrence, general aggregate, products-completed-ops aggregate, personal and advertising injury, fire damage, and medical payments. Auto carries combined single limit. WC carries the statutory designation plus EL each-accident, EL disease per-employee, and EL disease policy limit. Umbrella / Excess carries per-occurrence and aggregate. Each is a tracker column. Expiration date drives the renewal cadence; limits drive the contract-minimum compare; indicator boxes drive the endorsement-audit demand.

Description of Operations / Locations / Vehicles / Special Items. Free-text. The broker often types in additional insured wording here ("ABC General Contractor and Project Owner XYZ are additional insureds with respect to ongoing operations of the named insured per CG 20 10 04 13") and references endorsement form numbers. That wording is not the endorsement; it's a representation that an endorsement exists.

Certificate Holder block (bottom-left). The GC's name and address, sometimes with the project owner listed as additional certificate holder. A COI made out to your parent entity instead of the project-specific entity, or to a stale legal name, isn't evidencing coverage to the right party.

Authorized Representative block (bottom-right). Signature and date. A stale signature date sometimes signals the broker hasn't reissued since a mid-term policy change.

That's roughly 77 distinct fields once you count each policy line's separate limits, indicators, and dates. Coordinators who flatten the form into "did the COI come in" miss every audit failure that lives at the field level.

A short pass on the neighbouring forms because the wrong form is itself a flag. ACORD 25 is the Certificate of Liability Insurance — every policy line in this article lives here. ACORD 27 is Evidence of Property Insurance, a personal-lines form rarely correct on commercial work. ACORD 28 is Evidence of Commercial Property Insurance, the right document when the subcontract requires Builders Risk evidence on jobs where the sub provides project-specific Builders Risk. The tracker may carry a Builders Risk policy row populated from an ACORD 28 alongside the rest of the rows populated from the ACORD 25; same column structure, different evidence form on intake.

Why the Tracker Is Row-per-Policy-per-Sub, Not Row-per-Sub

Most COI trackers built quickly default to one row per sub with CGL, Auto, WC, and Umbrella as columns. It looks tidy. It also collapses every detail that matters. CGL with Travelers expiring March 31, Auto with Progressive expiring July 15, WC with the state fund expiring November 1, Umbrella expiring April 30 — four separate carrier relationships, four separate expiration dates, four separate endorsement sets — flattened into one row whose "next expiration" date is whichever happens to be soonest, with the other three quietly running on their own clocks.

The structure that works is a row per policy per sub. Same sub, five rows. A sub on two projects with different additional insured requirements can either replicate rows per project (more rows, simpler audit) or carry a project-specific endorsement column on a single row per policy (fewer rows, more lookup work). Either works; the tracker should be explicit about which.

Group the columns the way an audit reads them.

• Identity: sub legal name, sub vendor ID (the same one your AP system uses for invoice payment), project, policy type, carrier name, NAIC code, AM Best rating where the subcontract requires one.
• Policy: policy number, effective date, expiration date.
• Limits: per policy type. CGL has each-occurrence, general aggregate, products-completed-ops aggregate. Auto has CSL. WC + EL has the statutory designation plus the three EL limits. Umbrella has per-occurrence and aggregate. Hold them as separate columns rather than collapsing — meeting CGL each-occurrence but not products-completed-ops aggregate is still a fail.
• Endorsements: additional insured indicator on certificate (Y/N); additional insured endorsement form number (CG 20 10, CG 20 33, CG 20 37, or insurer-equivalent — the form number itself, not just "yes"); endorsement document on file (Y/N); waiver of subrogation indicator (Y/N); waiver endorsement form number (CG 24 04 or insurer-equivalent); waiver endorsement on file (Y/N); primary and non-contributory wording on file (Y/N) where required.
• Compliance: contract-minimum limits column populated from the Schedule of Insurance Requirements, gap flag, action-required column, last reviewed date, next renewal due date.

The endorsement group is the half that distinguishes a working tracker from a checkbox log. A column that just records "Y" against "additional insured" hides every endorsement-level audit failure. The form-number column catches a sub holding only CG 20 10 when the subcontract requires both CG 20 10 and CG 20 37, or holding CG 20 33 blanket when the subcontract specifies a scheduled CG 20 10.

Comparing the COI Against the Subcontract's Schedule of Insurance Requirements

Every commercial subcontract carries a Schedule of Insurance Requirements specifying minimum policy types, minimum limits per policy type, required endorsements, required certificate holder language, and any required AM Best rating. The compare puts the extracted ACORD 25 limits next to the schedule and produces a verdict per policy line.

For a typical commercial sub:

• CGL each-occurrence and aggregate. Subcontract minimum is commonly $1M each-occurrence, $2M general aggregate, $2M products-completed-ops aggregate, with higher minimums for high-risk trades. Each limit faces off against its contract counterpart independently — don't average.
• CGL aggregate dilution. A standard CGL aggregate is shared across every project the sub is working that policy year. Most subcontracts that care about this require a per-project aggregate endorsement (CG 25 03 Designated Construction Project Aggregate, or CG 25 04 Designated Location). If the subcontract requires it and the COI doesn't reflect it, that's a flag even when the headline limits look fine.
• Commercial Auto. $1M CSL is typical. Confirm the any-auto vs scheduled / hired / non-owned indicator pattern matches the subcontract.
• WC + EL. Statutory WC, plus EL minimums commonly at $1M each-accident, $1M disease per-employee, $1M disease policy limit. Confirm the policy is in force in the project state — out-of-state WC is a flag because employees may not be covered by the home-state policy depending on jurisdiction. Subs from monopolistic states (North Dakota, Ohio, Washington, Wyoming) will reflect a stop-gap EL policy alongside the state-fund WC.
• Umbrella / Excess. $2M to $10M is typical depending on trade. Confirm the umbrella's underlying policy schedule includes CGL, Auto, and EL — some umbrellas exclude EL, which matters when the subcontract requires the umbrella to drop down over EL.
• Trade-specific layers. Builders Risk evidence (often via ACORD 28); Pollution Liability for environmental, abatement, excavation with contaminated-soil exposure; Professional Liability for design-build and design-assist subs.

Use a three-state gap flag. Pass — every limit matches or exceeds, every required endorsement on file. Soft Flag — administrative or documentation gap (waiver form number not yet recorded, certificate holder address slightly off); pay app continues with a note. Hard Flag — limit below minimum, missing required policy type, missing additional insured endorsement document, expired policy line, or out-of-state WC where in-state is required. Pay-app release is held until cured.

Action-required entries have a verb, an artefact, and a gate state: "Request CGL limit increase to $1M / $2M / $2M; hold pay app #4." "Request additional insured endorsement document CG 20 10 plus CG 20 37; hold pay app #4." Each row reads as an instruction the coordinator can act on.

The volume is what makes this slow. Thirty to eighty subs, four to seven policies per sub, three to twelve active projects with separate Schedules, produces somewhere between several hundred and several thousand discrete compares per cycle.

The Additional Insured Endorsement Audit: Why the Certificate Indicator Isn't Enough

Most COI failures that show up in claims happen here. The ACORD 25 has an "additional insured" indicator box. The broker checks it. The certificate is delivered, the indicator is checked, the tracker records "Y," the file is closed. Two years later, a third-party injury claim from the sub's scope is tendered to the sub's CGL carrier under the GC's additional insured rights and the carrier denies the tender because the policy doesn't actually grant additional insured status to the GC. The denial is not an edge case; it's the predictable result of treating the indicator as the audit.

The ACORD 25 is informational. A checked indicator is a representation by the broker, not the grant itself. The grant lives on the policy as an endorsement, identified by a specific form number. When a claim is tendered, the carrier's coverage decision is made against the policy and its endorsements, not against the certificate.

That makes the form number the load-bearing field. Three ISO endorsements do most of the work in commercial construction.

CG 20 10 (Additional Insured — Owners, Lessees or Contractors — Scheduled Person or Organization) grants additional insured status for the named insured's ongoing operations only. Since the 1993 ISO revision, CG 20 10 stops covering completed operations.

CG 20 37 (Additional Insured — Owners, Lessees or Contractors — Completed Operations) grants additional insured status during the products-completed-operations period, which is when most construction-defect and latent-injury claims actually arrive. For most commercial subcontracts, both CG 20 10 and CG 20 37 are required so the GC has protection both during the sub's work and after the sub's scope is complete. Asking for one and not the other is the audit failure most often hidden behind a single "additional insured" tracker column.

CG 20 33 (Additional Insured — Owners, Lessees or Contractors — Automatic Status When Required in Construction Agreement With You) is the blanket version of the ongoing-operations grant. It activates automatically whenever the sub's subcontract requires the sub to provide additional insured status in writing, removing the per-project scheduling step at onboarding. The trap is that CG 20 33 is still ongoing-operations only — completed operations under a CG 20 33 program still requires a separate CG 20 37.

The historical context is the source of why this distinction matters. IRMI's analysis of the ISO additional insured endorsement changes for the construction industry explains the underlying revision: ISO's 1993 revision of CG 20 10 limited additional insured coverage to the named insured's ongoing operations, removing protection against completed-operations claims; the CG 20 37 endorsement was introduced in 2001 to restore completed-operations coverage for the additional insured. That gap, between the certificate's checkbox and the policy's actual completed-operations grant, is what the audit catches.

The demand-the-endorsement workflow:

1. ACORD 25 lands from the sub or broker at onboarding or renewal.
2. Check the additional insured indicator. If unchecked, hard flag immediately.
3. If checked, request the endorsement document directly from the broker (faster than the sub). Acceptable forms are the ISO standards (CG 20 10 plus CG 20 37, or CG 20 33 for blanket ongoing) or a manuscript endorsement that names the GC and the project and grants the equivalent scope. Insurer-specific equivalents (Travelers, Liberty Mutual, Zurich) are typical and acceptable when the wording matches.
4. On receipt, record the form number — not just "Y" — on the tracker. Confirm the endorsement names the GC (and, where required, the project owner), and confirm the scope matches what the subcontract requires.
5. If the endorsement document doesn't arrive by a defined deadline, the tracker holds the next pay-app release and escalates per the cadence below.

Waiver of Subrogation and Trade-Specific Coverage Checks

Apply the same indicator-vs-document discipline to waiver of subrogation. The ACORD 25's "subrogation waived" box has the same status as the additional insured box: a representation, not the grant. Demand the form number.

For CGL the standard ISO grant is CG 24 04 (Waiver of Transfer of Rights of Recovery Against Others to Us). Insurer-specific waiver forms are common and acceptable when the wording matches. WC waivers are state-specific endorsements — confirm the WC waiver covers the project state, not just the sub's home state. Auto waivers are their own endorsement when the subcontract requires them.

Why this matters: most commercial subcontracts require the sub's insurers to waive their right of subrogation against the GC and the owner. After a covered loss is paid, the carrier is otherwise entitled to sue any third party who contributed — including the GC. The waiver endorsement extinguishes that recovery action. Without it on file, the recovery suit is in play even when the certificate showed the indicator checked.

The trade-specific coverage check is whether the sub's policy set is the right shape for the work the sub is performing — not just whether each policy meets its limit.

• Steel erection, demolition, structural concrete, crane lift, scaffold. Higher CGL each-occurrence and umbrella minimums are common — $2M each-occurrence and $5M to $10M umbrella aggregate are typical floor numbers; the subcontract's Schedule should already reflect the trade.
• Roofing and exterior cladding. Some carriers exclude or sublimit roofing entirely. Hot-work exclusions matter on welding-heavy or torch-applied scopes. A CGL with a roofing exclusion on a roofing sub is unusable.
• Excavation, earthwork, environmental, abatement, demolition with potential disturbance. Pollution Liability is the additional layer. Contractors Pollution Liability (CPL) typically runs $1M to $5M depending on scope. The additional insured grant on the Pollution policy is its own endorsement, separate from the CGL endorsement — don't assume CG 20 10 carries over.
• Design-build, design-assist, engineering, and any sub with delegated design responsibility. Professional Liability or E&O at $1M to $5M is standard. One quirk for the tracker: Professional Liability typically does not extend additional insured status — the GC's protection on professional risk is contractual indemnity, not additional insured rights against the sub's E&O policy. Record the policy and the limit; intentionally leave the additional insured column blank for the Professional row, with a note explaining why.
• CCIP and OCIP wrap-ups. When the GC or owner runs a Contractor- or Owner-Controlled Insurance Program covering enrolled subs for on-site work, the sub's individual CGL, Excess, and sometimes WC requirements shift. The tracker carries an enrolment flag per sub and applies the contract-minimum compare to the residual policies only. Subs who think they're enrolled but aren't (paperwork stuck somewhere in the wrap administrator's queue) are a recurring source of mid-project surprise.

For underwriting depth on any of the above — what specifically a CPL excludes, how a CG 25 03 actually attaches, what a wrap-up does and doesn't cover — IRMI's construction insurance reference is the standard practitioner source. This article stays at the tracker level on purpose.

The Expiration Cadence: 60, 30, 15, 7 Days

A working tracker carries 30 to 80 active subs, four to seven policies each, across 3 to 12 active projects. That's somewhere between a few hundred and a few thousand expiration dates a year. Every policy row's expiration date drives a defined sequence; non-response at each step drives a defined escalation.

• 60 days out — renewal request to sub. The coordinator emails the sub with the broker copied, requesting the renewed ACORD 25 and the updated endorsement documents (CG 20 10 plus CG 20 37 or CG 20 33, CG 24 04, project-state WC waiver, any project-specific endorsements). 60 days is enough lead time for a broker to issue replacements and for the sub to address any underwriting issues at renewal.
• 30 days out — escalation to PM. If the renewed COI hasn't landed, the coordinator emails the project manager and the sub's primary contact directly, not just the broker. The PM owns the relationship; the coordinator owns the file.
• 15 days out — escalation to risk or legal. No COI on file goes to the risk manager (or legal) for a formal demand letter referencing the subcontract's insurance default clause. The next pay-app hold is on the table; the sub should be told so explicitly.
• 7 days out — pay-app hold. The tracker flags the sub's next pay app as held. The PM and the sub are both notified. The action-required column reads "Hold pay app #N pending renewed COI for [policy line]." This is the gate that makes the cadence work; without it the earlier escalations are advisory.
• 0 days — coverage gap. The policy has expired and no renewal is on file. Project access on the affected scope is suspended; the next pay app is held; the mid-project lapse decision tree applies.

Some GCs run a tighter cadence (45 / 30 / 15 / 7) for high-risk trades or strict owner-side compliance terms. The shape is what matters: a defined first-reminder window, a PM handoff, a legal handoff, a pay-app trigger, and a gap state.

The cadence runs per policy row, not per sub. A sub with five policies has five expiration dates and potentially five active cadences in flight at once. Renewing the CGL on March 31 doesn't reset the Auto cadence running toward July 15. Calendar entries, ICS files into Outlook, scheduled email reminders, or a platform-side alert are the trigger; the escalation tree is the human structure underneath. Both have to exist.

Mid-Project Policy Lapse: The GC's Decision Tree

A policy lapse on an active project means the sub is, for the lapse window, working uninsured under the lapsed line. Additional insured status is gone with the underlying policy. Subrogation waivers are gone. WC obligations may, depending on jurisdiction, fall back on the GC for the sub's payroll on the project during the lapse.

Identify the lapse type first; the response depends on it.

• Failure to renew on time but renewal in flight. Most common. The broker confirms the renewed policy will issue within a defined cure period — often 5 to 10 days. The coordinator holds the next pay app, requires a binder letter or written broker confirmation, and clears the hold when the renewed COI and endorsements arrive.
• Carrier cancellation for non-payment of premium. A different failure mode. Demand evidence of reinstatement or replacement coverage. This case escalates faster than a routine renewal lapse because non-payment to a carrier sometimes precedes other operational problems with the sub.
• Carrier non-renewal at term. The sub needs to place coverage elsewhere. Cure period applies, but expect a different carrier on the renewed COI and a fresh round of endorsement document collection.
• Mid-term cancellation at the sub's request. Rare. Usually shows up alongside ownership changes, mergers, or carrier consolidation. Treat as carrier non-renewal; confirm the new policy's named insured matches the sub's current legal entity.

When the lapse can't be cured quickly, the GC's options:

• Hold the next pay app. Default response. The subcontract's insurance default clause supports the hold; the sub has direct financial motivation to cure.
• CCIP or OCIP wrap-in. If the project carries a wrap-up and the lapsed line is one the wrap-up covers (CGL is the typical case; WC sometimes; Auto rarely), enrol the sub on the wrap subject to the administrator's enrolment terms. Project-specific; most jobs don't have it.
• Deny project access. Suspend the sub's access until coverage is restored. Document the suspension. The right response when WC has lapsed (statutory exposure to the GC is immediate in most jurisdictions) or when the work scope can't be safely paused on a CGL lapse without schedule damage.
• Material breach and termination. When the lapse is prolonged or part of a pattern of compliance failures, the subcontract's insurance default clause typically supports termination for cause. A legal step, not a coordinator step; the tracker flags and routes.

A practical point worth saying out loud: the sub's broker is usually the fastest path to a binder letter or replacement certificate. Calling the broker directly with the sub copied often resolves a lapse in hours rather than days. The tracker carries the broker contact (extracted from the producer block on the most recent ACORD 25) for exactly this reason.

How the Tracker Wires into Onboarding, Pay-App Release, and Retainage Release

A COI tracker that lives in isolation is a list of policies. A COI tracker wired into the GC's payment and access controls gates work. Three gates apply over a sub's life on a project.

Onboarding gate. Before the sub is set up in the vendor master, before the first work day, before the first pay app is released, the tracker requires a current ACORD 25 with all required policy lines, every limit at or above the contract minimum, and the additional insured plus waiver of subrogation endorsement documents on file. Vendor setup stalls until the tracker shows green.

Pay-app release gate. Each pay-app cycle the tracker checks four things against the work-period dates: COI active across those dates, every required policy line still at or above contract minimums, no policy line expired during the work period, and any flags raised since the last pay app cleared. The pay-app cycle reads from the tracker; when the tracker is red, the pay app is held even when the AIA G702 and G703 pay application processing workflow is otherwise clean. A clean cover sheet doesn't cure a missing endorsement.

Retainage release gate. At substantial completion or final completion, the tracker checks that the COI is active at the release date and that the completed-operations endorsement covers the work period. This is where CG 20 37 earns its keep; without it, the additional insured grant has effectively expired with the sub's last day on site even though the policy is still in force. The state-by-state mechanics of when retainage actually has to be released belong in construction retainage invoice tracking by state, and the parallel workpaper that schedules each sub's two-stage release against state caps and final unconditional waivers is what the closeout team reads alongside this COI check; the COI gate sits inside that calendar.

The tracker is the upstream control surface. The pay-app cycle and the retainage release calendar are downstream; both check the tracker. The AP coordinator running the pay-app cycle reads the tracker's gap-flag and action-required columns; the closeout team reads the same columns at retainage release; a single corrected COI updates both gates at once.

Spreadsheet, Dedicated Platform, or Extraction-Augmented Spreadsheet

The tracker has to run somewhere. Three operational shapes are common, and the choice between them is less about the GC's headcount than about where the bottleneck currently sits.

Excel and SharePoint. Most mid-market GCs run subcontractor COI tracking on a spreadsheet, sometimes with conditional formatting against expiration dates, sometimes with a SharePoint workflow for renewal reminders, often with the coordinator running the cadence by hand. Excel handles the row-per-policy structure cleanly; what it doesn't handle is bulk extraction from incoming ACORD 25 PDFs, automatic flag-fire when contract minimums aren't met at intake, or reliable cadence at scale. The bottleneck is data entry and human attention, not data structure.

Dedicated COI platforms. CertFocus, myCOI, TrustLayer, BCS, and Jones (among others) sell purpose-built platforms with broker portals for direct certificate intake, automated renewal reminders, document storage, and — variably — extraction of certificate data into the platform's tracker. They handle scale on a subscription model that typically scales with sub count or document volume, and they require sub onboarding into the platform itself. The fit is GCs running 200+ active subs across 20+ projects with a dedicated risk function.

Extraction-augmented spreadsheet. The middle path. Keep the tracker in the spreadsheet (or whatever workpaper format the AP function already runs), and use document extraction to populate tracker rows directly from incoming ACORD 25 PDFs — flagging missing additional insured or waiver endorsements at intake, surfacing sub-minimum limits as the COI lands, and feeding expiration dates straight into the renewal cadence. The coordinator stays in control of the workpaper and the audit discipline; the extraction step removes the data-entry bottleneck.

This is where invoice and financial document extraction fits the COI tracking workflow. AI-powered ACORD 25 data extraction for subcontractor COI tracking populates one row per policy line with carrier, policy number, dates, limits, and indicator boxes ready for the contract-minimum compare and the endorsement audit, with a source-page reference on every row for cross-checking against the original PDF. Same prompt produces the same column structure across every certificate, which is what turns a stack of PDFs into a tracker rather than another data-entry queue.

What this shape doesn't replace is the audit work. The contract-minimum compare is still a comparison run against the subcontract's Schedule of Insurance Requirements. The endorsement audit is still a demand-the-document workflow that records form numbers against policy rows. The cadence and the lapse decisions are still the GC's calls. Extraction removes the data-entry bottleneck; the tracker discipline is what makes the data worth extracting.

The choice between the three shapes comes down to where the bottleneck actually sits today. If the structure can't model the policies cleanly — single-column "additional insured Y/N" hiding the form number, no per-project endorsement column, no separate waiver tracking by line — Excel isn't the wrong tool, the spreadsheet design is. Fix the design before reaching for a platform. If the structure is right but coordinators can't keep up with the volume of incoming COIs and renewals, the extraction-augmented shape is usually the cheapest path to capacity. If the bottleneck is broker-side coordination across hundreds of subs, the dedicated platform's broker portal and reminder automation are what justify the subscription. Most GCs sit in the second case for several years before crossing into the third, and a fair number stay there indefinitely because the audit discipline matters more than the platform.