How to read an ACORD 25 certificate of insurance, box by box

A certificate of insurance is one page, and most of it is administrative. Producer, insured, carrier codes, a revision date.

Four things on it decide whether the vendor standing in your unit is actually covered. Everything else is context.

The certificate itself grants you nothing

Start here, because it changes how you read everything else.

The bold text across the top of every ACORD 25 says the certificate is issued as a matter of information only and confers no rights upon the holder. That is not boilerplate to skim. It is the legal status of the document you are holding.

A certificate is a summary of a policy, prepared by an agent, at a moment in time. It is not the policy. It does not amend the policy. If the certificate says you are an additional insured and the policy has no such endorsement, you are not an additional insured. You have a piece of paper that is wrong.

This is why "we have their COI on file" is a weaker statement than most compliance programs treat it as.

Coverage limits are two numbers, and people check one

The general liability block gives you per-occurrence and general aggregate. Typical requirement is $1M per occurrence and $2M aggregate.

Per occurrence caps what a single claim can draw. Aggregate caps what the whole policy year can draw across every claim, for every job that vendor works, not just yours.

A roofer carrying $1M per occurrence and $2M aggregate who has already had two large claims this year has a nearly exhausted policy and a perfectly valid certificate. The certificate has no field for "how much of the aggregate is left." Nobody can tell you from the document.

Also check whether the aggregate applies per project. There is a box for it. A per-project aggregate is materially better for you than a shared one, and it is the kind of thing that never comes up until it matters.

Dates are the single most common failure, and they are trivial to check

Every coverage row has an effective date and an expiration date.

A certificate collected in March for a policy expiring in June is compliant in March and useless in July. Nobody notices, because the certificate is in the file and the file says compliant.

This is the entire reason expiration tracking exists as a product category. The failure mode is not that anybody made a bad decision. It is that a date passed and no system was watching.

Teams that track this on a calendar reminder catch most of them. The ones they miss surface on incident or on audit, and by then the exposure has already happened. A lapse in March is a claim in September that nobody saw coming.

The additional insured box is a yes/no that is usually not a yes

There is a column marked ADDL INSD with a checkbox per coverage line.

A check in that box means the agent is representing that you have additional insured status. It does not tell you the form number, the scope, or whether the endorsement is attached. Those live in the policy, and often the answer is narrower than you assumed.

What you actually want to confirm:

The endorsement exists, by form number. CG 20 10 covers ongoing operations. CG 20 37 covers completed operations. A vendor who gives you only the first is not covered for the work after they finish it, which is when a lot of property claims actually arise.

Primary and non-contributory wording. Without it, your own policy can be pulled in to contribute alongside theirs.

Waiver of subrogation. This stops their carrier turning around and pursuing you after paying a claim.

None of those three are boxes on the certificate. They are usually a line of text in the description of operations, or they are nowhere.

The description of operations box is where the answer hides

This is the free-text field at the bottom, and it is the least standardized part of a standardized form.

It is where an agent writes the things the form has no box for. It is also where exclusions get disclosed, sometimes in a single clause that undoes the coverage above it.

Read it every time. Look for:

What you find	What it means
Named certificate holder as additional insured, with form numbers	The good case. Verify the forms match the requirement.
"Additional insured status applies as required by written contract"	Conditional. It depends on your contract actually requiring it.
Any exclusion for a specific operation	The coverage above may not apply to the work you hired them for.
Blank	Assume nothing beyond the boxes. Ask for the endorsements.

A roofing exclusion on a roofer's general liability certificate is not a hypothetical. It happens, and it survives review because the limits at the top of the page look correct.

Workers compensation is where a small vendor gets interesting

Two things to check, and both are commonly wrong on small trades.

First, whether there is coverage at all. A sole proprietor may be exempt in your state and legitimately carry none. That is a business decision you get to make, not a box to tick, because if their uninsured helper is hurt on your property, the question of who employed them gets expensive.

Second, employer liability limits, which are separate from statutory coverage. Statutory covers the employee's benefits. Employer liability covers the suit that follows.

There is also an experience modification rate, which is not on the certificate but tells you whether this contractor's claims history is better or worse than average for their trade. Worth asking for on high-risk work.

What a twelve-point review actually looks like

For every certificate, before a vendor is cleared:

Is the named insured the entity you contracted with, exactly, including DBA
Is your legal entity named as certificate holder
General liability per occurrence and aggregate meet your minimum
Is the aggregate per project or shared
Effective date is on or before the work start date
Expiration date is after the expected completion date
Additional insured box checked on general liability
Endorsement form numbers present, covering ongoing and completed operations
Primary and non-contributory wording present
Waiver of subrogation present
Workers compensation active, with employer liability limits
Description of operations read in full, and no exclusion touches the work

Twelve checks per certificate at 15 to 30 minutes each is where a compliance program dies. That arithmetic is the reason teams spend 15 to 20 hours a week on this and still fall behind.

Where automation actually helps, and where it does not

Reading the boxes is a solved problem. IDCore extracts policy numbers, carrier, limits, dates, named and additional insureds, endorsements, and exclusions, then matches them against your per-property requirements. That collapses steps 3 through 12 from half an hour to seconds, at a 90% automation rate with the edge cases flagged for a person.

What automation does not fix: a certificate that is accurate and still insufficient. If a vendor genuinely does not carry what you require, no amount of reading gets you to compliant. Somebody has to place coverage or the work does not happen.

That is the gap most compliance tools stop at, and it is why IDCore can write the policy in the flow rather than just reporting the deficiency.

Which of the twelve does your current process actually check?