Risk management
How general contractors can reduce compliance risk before work starts.
Most compliance failures are not discovered on the job site — they surface when something goes wrong. The fix is to make proof collection a condition of mobilization, not an afterthought.
A subcontractor with lapsed insurance is a financial and legal liability the moment they step on your site. If an incident occurs before you have confirmed current coverage, the exposure lands on your general liability policy — or on you personally, depending on the contract structure. The challenge for most SMB GC teams is that the chase happens too late: documents get requested during mobilization, when the sub is already scheduled and the pressure to start is high.
Why pre-work timing matters
That urgency creates shortcuts — accepting a COI that is about to expire, skipping the W-9 because payroll will sort it out, approving a vendor without checking that the endorsement covers your project. Pre-work compliance closes that gap by making document collection happen at award, before scheduling is set and before the sub has any leverage over the timeline.
Where GC teams most often fall short
Most compliance exposure on SMB GC teams comes from the same handful of workflow gaps, not from negligence.
- Requesting documents too late. Sending a COI request the week of mobilization gives the sub no time to update expired coverage. You either delay the start date or accept the risk.
- No single place to check status. When the latest COI is in someone's inbox, the spreadsheet is a week out of date, and the PM is in the field, there is no way to answer "is this sub compliant right now?" in under a minute.
- Expiration tracking by memory. A COI that is current at mobilization can expire mid-project. Without automated tracking and reminders, lapses go unnoticed until there is a reason to look.
Building a compliance gate
A compliance gate is a simple rule: a subcontractor does not appear as ready-to-work until their required documents have been submitted and reviewed. The mechanism that enforces this does not need to be complex.
- Assign required documents to the vendor at the time of award — COI, W-9, and any project-specific proof — before the first request goes out.
- Send a direct upload link. No login, no portal account, no PDF email attachment guessing game. A link the sub can open on their phone and upload from.
- Review the submission and mark it accepted or rejected. If something is missing or expired, the sub stays blocked until it is corrected.
- Share the status with field and finance teams. Everyone making a mobilization or payment decision should be able to see whether the sub is ready, expiring, or blocked without asking.
What to require before mobilization
The exact requirements vary by contract, trade, and project type, but most SMB GC teams work from a consistent base set.
- Certificate of insurance (COI) — current coverage, correct limits, your company named as additional insured where required.
- W-9 — for payment processing and 1099 reporting.
- Contractor's license — where required by trade or jurisdiction.
- Additional insured endorsement — on larger projects or where your contract requires it.
- Project-specific riders — excess coverage, pollution liability, or other requirements from the owner contract.
Starting with a defined list makes the request consistent and the review faster. Subs know exactly what you need, and your team knows exactly what to check.
Keeping coverage current mid-project
Compliance does not end at mobilization. A 12-month general liability policy that starts in October will expire mid-project on a job that runs through the following spring. Without automated tracking, that expiration goes unnoticed until there is a reason to check — usually a bad one.
The practical fix is to track expiration dates at the document level and trigger reminders before they lapse. Automated reminders sent to the sub 30 and 14 days before expiration remove the need for anyone on your team to remember or calendar the follow-up.
For more on how this works in practice, see the COI tracking software page, the no-login vendor portal, and the subcontractor compliance checklist.