Construction & Vendor Risk Management: A Guide for GCs and Property Managers
Most construction risk management advice is about schedules and budgets. This guide is about the other half: the risk that walks onto the job with every sub you hire and every vendor you send to a property. An uninsured roofer, a suspended license, a contract that never moved the liability off you — those are the claims that land on a GC or a management company, and every one of them is controllable before the work starts.
Subcontractor and vendor risk management comes down to four controls: verify insurance, endorsements and licenses before anyone starts work; transfer the risk in the contract with an indemnity clause and additional insured requirements; monitor every policy and license while the work goes on; and document each check with a date, so you can prove it after an incident. A certificate of insurance on file is evidence for the first control, not a substitute for the other three.
In this guide
- What risk management means when you hire subs and vendors
- The four controls: verify, transfer, monitor, document
- A subcontractor and vendor risk register
- Contractual risk transfer: the clauses that carry the risk
- What a certificate of insurance does and doesn't protect
- For general contractors and for property managers
What risk management means when you hire subs and vendors
Search for risk management software and you will find two different products. One is project risk: schedule slips, cost overruns, weather, the risk log in a project management tool. The other is the risk that comes from the people you hire to do the work. This guide is about the second one, because it is the one that ends up as a claim with your name on it.
When a sub or vendor causes an injury or damage, the claim follows the money. If their insurance has lapsed, if it never named you, or if the contract never said the loss was theirs, it comes back to you — and through you to your own policy, your premiums and the owner relationship.
This guide covers
Covered elsewhere
The four controls: verify, transfer, monitor, document
Every piece of subcontractor and vendor risk management fits one of four controls. Skip one and the other three leak.
Verify before work starts
Collect the certificate of insurance, the endorsement pages and the W-9, and check the contractor's license with the state board — before the sub mobilizes or the vendor gets the work order. A missing document is cheap to fix the day before the job and expensive the day after an incident.
How to verify a contractor license →Transfer the risk by contract
The subcontract or vendor agreement is what makes a loss the sub's problem: an indemnification clause, an insurance exhibit with minimum limits, and a requirement to name you as additional insured. Insurance is the money behind the promise; the contract is the promise.
General contractor insurance requirements →Monitor while the work goes on
Policies renew, change limits, and lapse mid-project. Licenses get suspended. A certificate you checked in March says nothing about June. Track each policy's own expiration date and re-check licenses during the job, not just at onboarding.
How to track subcontractor insurance →Document every check
When a claim arrives, the question is what you knew and when. A dated record of each certificate received, each requirement checked and each reminder sent is the difference between "we had a process" and "we had a COI somewhere".
COI audit checklist →A subcontractor and vendor risk register
A risk register lists each risk, how it shows up, the control against it, and the evidence that the control worked. For the risk your subs and vendors bring, seven rows cover almost everything.
| Risk | How it shows up | Control | Evidence you'll need |
|---|---|---|---|
| Uninsured or lapsed coverage | The policy expired mid-job and the renewal never arrived | Track every policy's own expiration; chase renewals before the date | A certificate current on the day of the incident |
| Limits below your minimums | GL at $500K when the owner's contract requires $1M | One requirement standard per job or property, checked on every certificate | The requirement in force and the certificate that met it |
| Missing endorsements | "Additional insured" typed in the description box, no endorsement behind it | Ask for the endorsement pages; check the ADDL INSD and SUBR WVD boxes per coverage | The endorsement forms, not just the certificate |
| Unlicensed or suspended contractor | A license suspended mid-project while the certificate still looks clean | Check the state board before hire and re-check during the job | A dated license check |
| Contract doesn't transfer risk | No indemnity clause, no insurance exhibit, owner requirements not flowed down | Subcontract or vendor agreement with an insurance exhibit and flow-down | The signed agreement on file |
| Workers' comp gap | A one-person crew with no WC policy and an injured helper | Require WC, or the state's exemption certificate where one applies | The WC certificate or the exemption |
| Can't prove diligence | An insurer or owner asks what you checked, and the answer is an inbox | Keep a timestamped record of every upload, change and reminder | An audit trail and a dated compliance report |
If you want to rank subs and vendors against each other on these rows, the contractor compliance scorecard guide turns the register into a score.
How TrackMyVendor automates this
- Each coverage row carries its own expiration date, so a workers' comp policy ending months before the general liability is visible instead of hiding behind one date per sub.
- Licenses are re-checked against the state board daily, so a suspension mid-project shows up on the contractor's record instead of at the next audit.
- Per-project requirements hold each job's or property's minimums and flag the subs and vendors who fall short of them. Pro
- Every upload, change and reminder is timestamped in the audit trail, so what you checked and when is on the record.
- The compliance report exports as a dated PDF or Excel file for an owner, a lender or your insurer. Pro
Contractual risk transfer: the clauses that carry the risk
Contractual risk transfer is how a GC or property manager moves the cost of a sub's or vendor's mistakes onto the party who made them. It takes the contract and the insurance together — one without the other leaves a gap.
Indemnification (hold harmless)
The sub or vendor agrees to defend you and pay for losses arising from their work. It is only as good as the money behind it, which is why it is paired with insurance requirements. Many states restrict how broad a construction indemnity clause can be — for example, whether a sub can be made to cover your own negligence — so the exact wording belongs with your attorney.
Additional insured
An endorsement on the sub's or vendor's policy that makes you an insured under it, so you can claim directly. For construction work this usually means CG 20 10 for ongoing operations and CG 20 37 for completed operations. Being the certificate holder is not the same thing.
Waiver of subrogation
The sub's insurer gives up the right to recover from you after paying a claim. Without it, the insurer that paid for the sub's loss can turn around and sue you for it.
Primary and noncontributory
The sub's policy pays first, and doesn't ask your policy to share the loss. Without this wording, a claim from their work can still hit your loss history and your premiums.
Flow-down
Whatever the owner requires of you, you require of your subs, and they of theirs. An owner's insurance exhibit that stops at the GC leaves the GC holding every requirement it didn't pass down.
Not legal advice. This section explains what each clause is for so you know what to ask for. Indemnity and insurance wording varies by state and by contract; have an attorney review your subcontract and vendor agreement templates.
What a certificate of insurance does and doesn't protect
The certificate is the document most risk management falls back on, and the one most often over-trusted.
A COI tells you
A COI does NOT
The last row is the one most systems miss. A clean certificate and a suspended license can sit in the same file for months, because nothing about the insurance changes when a state board acts. See what a COI is and certificate holder vs. additional insured for the details of the form itself.
For general contractors and for property managers
The controls are the same; the roster, the vocabulary and who you answer to are not.
General contractors
Subcontractor risk, job by job
Owner requirements that flow down to every sub, subs who rotate between jobs, and a license that can be suspended mid-project.
Subcontractor risk management → Subcontractor compliance without a risk manager → Compliance software for general contractors →Property managers
Vendor risk, property by property
Each owner's requirements, vendors with resident contact, and high-risk trades — roofers, elevator contractors, security, restoration — across a portfolio.
Vendor risk management for property managers → Vendor insurance compliance for property managers → Vendor COI tracking for property managers →Run the four controls without the spreadsheet
Subs and vendors upload certificates, endorsements and W-9s through a one-time link from their phone — no account, no portal. Every policy is tracked on its own dates, licenses are re-checked daily, and every step is on the record. Your first 25 subs are free.