Risk transfer has become compliance theater

A moving company is hired to move a new resident into a large apartment building. Before it can begin work, the property manager asks for a certificate showing $1 million of general liability and a $5 million umbrella.

Nothing unusual about that request. We see versions of it every day.

The mover sends the certificate showing $5 million of excess liability. The property manager checks the limits, everything looks right, and the mover is cleared to start.

One problem remains: The $5 million excess policy sits over the mover's general liability policy, but not its auto policy.

For a moving company, that distinction matters. Loading and unloading exposures implicate commercial auto coverage, yet buildings frequently focus their requirements almost entirely on general liability and umbrella limits. Sometimes they don't require auto liability at all.

A true $5 million umbrella over commercial auto can be extremely expensive for a moving company, so when movers are repeatedly required to show $5 million in limits, one solution we often see is an excess policy over general liability only.

The mover spends real money buying it. The certificate shows $5 million. The property manager checks the box. And the coverage the building was probably most concerned about may still not be there.

Nobody necessarily did anything wrong. The mover bought the coverage necessary to satisfy the requirement. The agent accurately reflected it on the certificate. The property manager verified the limits they were told to verify. Everyone did their job.

I'm just not sure we transferred the risk we thought we did.

A sensible concept evolves into a compliance exercise

This is increasingly what contractual risk transfer looks like. What started as a sensible concept - making sure the party creating a risk has adequate insurance to stand behind it - has evolved into a compliance exercise where we often spend more time determining whether a certificate matches a contract than asking whether the insurance addresses the exposure.

The requirements also tend to move in one direction. A general contractor carries a $5 million umbrella, so its insurer requires subcontractors to carry $5 million as well. Contracts require additional insured status, primary and non-contributory wording, waivers of subrogation, and completed operations coverage. Those requirements get passed downstream, often with little distinction between the exposures involved.

Many of these requirements are completely appropriate; some are critical, but does the painter really need the same $5 million umbrella as the roofing contractor simply because the general contractor carries $5 million?

Maybe. Some jobs could justify it. Someone should at least ask.

Instead, by the time the requirement reaches the contractor, the risk discussion is usually over. The contractor wants the job and doesn't want to challenge a customer over its insurance requirements. They call their agent and say, "I need a COI."

The agent reviews the requirements and explains that the contractor doesn't currently have one of the requested limits or endorsements.

"Just give them the certificate."

You explain that a certificate doesn't create coverage, and satisfying the requirement will require an endorsement or additional insurance, which comes with an additional premium.

"Why are you charging me? They just need a piece of paper."

The business owner isn't being unreasonable either. They have a crew waiting to start a job. They don't want a 20-minute insurance lesson; they don't want to spend thousands of dollars on additional coverage, and they certainly don't want to push back on a customer and risk losing the work. They just want the COI.

That may be the clearest sign of the problem. We've reached a point where the document proving compliance can become more important to everyone involved than understanding the coverage it's supposed to prove.

An answer that isn’t working

The industry's answer has increasingly been to outsource or automate the verification. That can make sense. A large property owner or general contractor may receive thousands of certificates and can't expect every property manager or project manager to become an insurance expert. Automating a checklist, however, doesn't necessarily make the checklist smarter.

I once had a client's certificate rejected eight times by a third-party verification company because the contract required a $1 million umbrella and my client carried a $5 million umbrella. They could not get past the fact that the numbers didn't match. Five million dollars was apparently insufficient to satisfy a $1 million requirement.

Put that next to the moving company example, and the problem becomes obvious. A compliance process can reject $5 million because it doesn't understand that $5 million is more than $1 million, while another process can approve $5 million without understanding that the coverage may not address the exposure everyone thought it did.

Everyone verified compliance without verifying the risk transfer.

And none of this is free.

The contractor pays an additional premium. Its insurance agency spends time reviewing contracts, issuing certificates, requesting endorsements and dealing with rejected certificates. Carriers spend time processing and underwriting those requests. Property managers chase paperwork. Verification companies charge for their services. Jobs get delayed.

Eventually, those costs work their way back into what businesses charge. The painter builds them into the bid. The general contractor builds the subcontractor's price into the project. The property owner builds the cost into the rent. Ultimately, much of it reaches the consumer, who has no idea they're paying for any of it.

If those costs produce meaningful protection against loss, that's the price of responsible risk management.

If the mover buys an excess policy it doesn't otherwise need, the building still doesn't get excess coverage over the auto exposure it was actually worried about, and everyone spends hours proving the mover complied - what exactly did we accomplish?

Who is responsible?

No single villain is responsible. The carrier wants to protect its insured and transfer losses downstream. The attorney wants broad contractual protection. The general contractor or property owner doesn't want to accept less insurance than it can require. The contractor doesn't want to lose the job. The verification company enforces the requirements it was given. And the insurance agent provides the coverage it was asked to provide.

Everyone can behave rationally from where they sit and still produce an irrational result.

The starting point shouldn't be last year's requirements. It should be the exposure. What loss are we trying to protect against? What insurance responds to it? What limit is reasonable? Which contractual protections matter?

If there are good answers, require the coverage. Even if it's expensive. Good risk transfer isn't always cheap. If the only answer is "that's what our standard contract says," we should probably ask whether we're still managing risk or simply managing compliance.

The goal was never to produce the most impressive-looking certificate of insurance. It was to make sure the party creating a risk has appropriate coverage to back it up.

The certificate isn't the objective. The risk transfer is.

 © Entire contents copyright 2026 by InsuranceNewsNet.com Inc. All rights reserved. No part of this article may be reprinted without the expressed written consent from InsuranceNewsNet.com.

Michael Kovalev, CIC, is the owner of Kovalev Insurance Agency in Newton, Mass. Contact him at michael.kovalev@innfeedback.com.