Building a Certificate of Insurance Process That Scales

The request that eats your afternoon

A general contractor's project manager emails your account executive at 4:40 p.m. on a Friday. He needs a certificate naming the owner, the construction manager, and the lender as additional insureds, with waiver of subrogation on general liability and workers compensation, primary and non-contributory wording, and 30-day notice of cancellation. The job starts Monday. He attached a 60-page subcontract and highlighted nothing.

Nobody owns this request. The account executive forwards it to a CSR, who cannot tell whether the blanket additional insured endorsement responds to this contract. The producer is on the road. Someone issues the certificate with the boxes checked, because the client is loud and it is Friday.

That last sentence is the problem. A certificate confers no coverage; it is a snapshot of policies that already exist. When it says something the policy does not, you have created an errors and omissions exposure with your agency's name on it. Certificates are the highest-volume, lowest-margin, highest-liability task in a commercial lines agency, which is why they deserve a process instead of goodwill and speed.

Why the volume breaks agencies

Certificate work fails for structural reasons, not because people are careless.

• Requests arrive everywhere. Direct-to-CSR email, the producer's inbox, a voicemail, a portal message, a text to an account executive's cell. No queue means nothing to measure.
• Intake is incomplete. Requests arrive missing the holder name, the address, the project description, or the contract pages that define the requirements. Every gap becomes a round trip, and the backlog stays invisible until it surfaces as an angry client rather than a report.
• Judgment and clerical work are fused. Typing a holder into AMS360 is clerical. Deciding whether CG 20 10 covers ongoing operations for this contract is judgment. Combine them and you pay senior wages for data entry while rushing what matters.
• Renewals arrive as a cliff. Every certificate issued in the last twelve months needs reissuing when the policy renews, and they come due together.

A worked example, so the volume is not abstract

These numbers are illustrative rather than measured results. They show only how the math behaves.

Assume 400 commercial accounts averaging six certificate requests per year: 2,400 annually, roughly 10 per business day. Assume 12 minutes of handling for a clean request against a template and 35 minutes for one needing contract review, endorsement verification, or a carrier request. At 70 percent clean, daily handling lands near 3.5 hours. Add 20 percent rework from bad intake and you have a half-time position doing nothing but certificates, spread across four people who each think it is a minor part of their day.

If certificate work is not on somebody's queue with a name and a clock on it, you do not have a process. You have four people absorbing interruptions and calling it service.

The anatomy of a clean COI workflow

A workable process has six stages. The discipline lives in stages one and three.

1. Single intake channel. One address routed into a shared queue or service ticket in your agency management system. Producers and account executives forward rather than handle.
2. Structured intake form. Required fields, not a freeform note: holder legal name and address, description of operations or project, required limits, additional insured yes or no, waiver of subrogation yes or no, contract pages, due date, requester contact.
3. Requirement triage. Classify each request routine, verify, or escalate. Routine matches an existing template and holder profile. Verify means confirming the endorsement on file supports the ask. Escalate means the contract demands what the policy does not provide.
4. Issuance. Pull from a locked master template so named insured, producer block, policy numbers, dates, and limits populate from the policy record rather than being typed.
5. Delivery and holder record. Send to holder and requester, attach the certificate to the account file, add the holder to the account's certificate holder list.
6. Renewal flag. Mark whether the holder receives an automatic reissue at renewal, and until when.

Stage three is where agencies save themselves. A certificate requiring an endorsement the policy does not carry is not a certificate task. It is an endorsement request with a deadline.

ACORD 25 vs ACORD 24, and the forms around them

Using the wrong form is among the most common avoidable errors, especially when a lender is the holder.

Two rules prevent most form errors. If the holder is a bank, ask what the loan documents require before picking a form. If the description of operations will not fit, use the additional remarks schedule rather than shrinking the font.

Additional insured and waiver of subrogation: the two boxes that create liability

This is where speed becomes an E and O claim. The rule is not negotiable: the certificate reflects the policy, and the policy does not change because the certificate says so.

Before checking either box, confirm three things:

• The endorsement exists on the bound policy. Blanket additional insured wording, often via the CG 20 33 and CG 20 38 family, typically applies only where a written contract requires it before the loss. Scheduled forms such as CG 20 10 for ongoing operations and CG 20 37 for completed operations name specific parties.
• The scope matches the ask. A contract requiring completed operations coverage is not satisfied by an ongoing operations endorsement. On auto, designated insured status usually needs a separate form such as CA 20 48.
• The waiver is actually in place. General liability waivers commonly run through CG 24 04. Workers compensation waivers need a state-specific endorsement, often carry additional premium, and in some states must be filed.

If any of the three fails, the output is not a certificate. It is an endorsement request to the carrier, a note to the producer, and a written status update to the client. Uncomfortable once, protective forever.

Document every issuance the same way: who asked, what contract language was relied on, which endorsements were verified, who issued it. One activity note plus the attached certificate. In three years that note is your defense.

Holder lists and auto-issuance at renewal

Holder lists are the highest-return feature most agencies underuse. AMS360, Applied Epic, EZLynx, HawkSoft, and NowCerts all support holder records tied to the policy plus some form of batch reissue at renewal.

The operating pattern:

1. Every issued certificate creates or updates a holder record on the account, with a renewal-reissue flag and an expiration date for that flag.
2. Thirty to forty-five days before policy expiration, run a report of renewing accounts with active holder lists.
3. Reissue only after the renewal is bound and the endorsement schedule is confirmed. Auto-issuing from unconfirmed data reproduces last year's errors at scale.
4. Prune the list. Holders tied to a completed project or terminated lease come off.
5. Send as a batch, then log the batch on the account.

Pruning matters more than it sounds. A list nobody has cleaned in three years turns renewal automation into a mailing of your client's insurance information to parties with no current interest.

Setting SLAs the team can actually hit

Publish tiers internally and to producers. A blanket "same day" promise fails because the requests are not the same work.

Measure three things weekly: volume by type, percentage issued within tier, and rework rate. Rework rate is the honest one, because it exposes bad intake and bad templates rather than slow people.

Handing the workflow to a remote CSR without losing control

Certificate issuance is one of the cleanest functions to move to a dedicated remote team member, because judgment separates cleanly from production. The producer keeps selling, the account executive keeps the relationship, and a trained insurance CSR runs the desk inside your systems.

What makes the handoff work:

• Documented SOP before the person, not after. Intake fields, form selection rules, template locations, the additional insured and waiver checklist, escalation triggers. If it lives in a senior CSR's head, extract it first.
• A hard escalation line. The remote CSR issues routine and verified requests. Contract interpretation, coverage opinions, and endorsement requests route to a named licensed person on your side, in writing.
• Least-privilege system access. Certificate issuance and activity notes, read access to policy and endorsement records, no ability to change coverage or bind. NDAs signed, access provisioned by role, workstation controls in place.
• Recorded quality review on a sample. Ten to twenty certificates a week checked against the checklist for the first 60 days, then a smaller ongoing sample, scored on form selection, holder accuracy, and endorsement verification.
• A real onboarding runway. Expect two to four weeks before a trained CSR is independent on routine work, longer on construction-heavy books. Day-one independence is a staffing promise, not a workflow.

The point is not only cost. It is that certificates finally have an owner and a clock.

Where to start

Pick the smallest changes that produce visibility, then build on them.

1. Open one intake channel this week. A single email address routed to a shared queue, plus a note to producers that forwarding is now the process.
2. Write the intake form. Eight to ten required fields. Send incomplete requests back with the missing fields named.
3. Build the additional insured and waiver checklist. One page, three questions, three outcomes. Every issuer uses it, including your most senior CSR.
4. Audit holder lists on the next 20 renewals. Count the stale holders. That number tells you whether auto-issuance is an asset or a risk.
5. Baseline volume and rework rate for 30 days. You cannot decide whether to add capacity, rebuild templates, or move the desk to a dedicated remote CSR until you know today's cost.