Subcontractor Compliance Checklist: Documents to Verify

Last updated July 2026.

A subcontractor compliance checklist is the fixed set of documents and checks every subcontractor must clear before they start work and keep clearing while they are on the job. At minimum it covers a signed subcontract, a verified certificate of insurance with the required limits and endorsements, workers compensation coverage or a valid exemption, a W-9, and current state and local licenses. Everything else is industry-specific.

The value of a checklist is not that it lists things. It is that it makes the standard identical for every sub, so nobody gets waved through because the project manager knows them. Below is the checklist itself, then the part most companies skip, which is what "verified" actually means for each line.

The subcontractor compliance checklist

Insurance: the items that actually fail

Insurance is where a compliance checklist earns its keep, because it is the only section that expires. Four failures account for most of the real gaps.

Limits below the subcontract minimum. The certificate shows a 1 million dollar general liability per occurrence limit and your subcontract requires 2 million. This one is easy to catch and easy to miss, because it looks like a normal certificate unless someone compares the numbers.

Certificate holder instead of additional insured. Being listed as certificate holder gives you notice, not coverage. Additional insured status comes from an endorsement on the policy. If your contract requires additional insured status, ask for the endorsement form, and check whether it covers completed operations as well as ongoing work. Additional insured vs certificate holder explains the difference in full.

Endorsements described but not attached. The Description of Operations box saying "Owner is additional insured, waiver of subrogation applies, primary and non-contributory" is a statement by the agent, not proof of an endorsement. It carries no weight against the carrier. Request the endorsement forms for anything material.

The policy expiring mid-project. Almost every real coverage gap is a renewal that never happened. A certificate accepted in January for a policy expiring in March covers the first ten weeks of a twelve-month job. This is why the checklist has a recheck column at all.

What should be on the checklist for high-risk trades?

Baseline coverage is not enough for scopes with a specific exposure profile. Add these where they apply:

• Roofing, welding and demolition: confirm there is no exclusion for the work being performed. Hot work and demolition exclusions are common and turn a valid-looking certificate into no coverage at all.
• Excavation, environmental and abatement: contractors pollution liability, plus confirmation the general liability pollution exclusion does not swallow the scope.
• Anything with a vehicle: commercial auto with an owned, hired and non-owned schedule, not a personal auto policy.
• Design-build and engineering scopes: professional liability, which general liability does not cover.
• Work around children or vulnerable populations: abuse and molestation coverage, which is excluded on most standard forms.
• Anyone accessing your systems or data: cyber liability and technology errors and omissions.
• Crane, rigging and steel erection: higher umbrella limits, and confirm the umbrella actually sits above the required underlying limits rather than a lower schedule.

How do you verify each item without it taking a week?

Collecting documents is easy. Verifying them is the work, and it is where most programs quietly stop. A workable verification standard per item looks like this:

1. Read the certificate, do not just file it. Compare each limit against your requirement, confirm the policy dates cover the work window, and confirm the named insured matches the legal entity you contracted with. A certificate for "Smith Roofing LLC" does not cover work performed by "Smith Roofing and Sheet Metal Inc."
2. Confirm the certificate is genuine. Altered certificates are more common than people assume, and the tell is usually a mismatch between the producer, the carrier and the policy numbering. Can a certificate of insurance be fake covers how to spot one.
3. Check the carrier, not just the coverage. Pull the NAIC number off the certificate and confirm the rating. An A- VII floor is the standard requirement.
4. Verify the license with the issuing authority. State contractor license boards publish searchable databases. A license number typed into your file is not a verified license.
5. Match the W-9 to your payment records. The legal name and TIN on the W-9 must match what you will report. The federal 1099-NEC reporting threshold rose from 600 to 2,000 dollars for payments made on or after January 1, 2026, so more small subs now fall below it, but the W-9 requirement itself has not changed.
6. Date-stamp everything. The compliance question at audit is not "is this sub compliant today", it is "was this sub compliant on the days they worked".

Who owns the checklist?

Whoever gets blamed. In practice ownership lands in one of three places, and each has a characteristic failure mode. Project management owns it and prioritizes schedule over paperwork. Accounts payable owns it and catches problems only at payment, after the work is done. Risk management owns it and has the right instincts but no visibility into who is actually on site this week.

The arrangement that works is a single system of record all three can see, with payment release gated on compliance status. That way project management cannot wave someone through, AP does not have to chase, and risk sees the whole picture. Who is responsible for tracking certificates of insurance goes through the ownership question by organization type.

Running the checklist at scale

One subcontractor takes about twenty minutes to verify properly the first time. Forty subcontractors across six projects, each with an annual renewal cycle and different requirements per owner, is a full-time job done by hand. That is the point at which the checklist stops being a document and needs to become a system.

Two changes do most of the work. First, stop retyping certificate data: extraction reads the limits, dates and endorsements off the ACORD 25 automatically and compares them to your rules. Second, stop tracking expirations in a spreadsheet that cannot email anyone. Certificates typically arrive from a dozen different agents into whichever inbox they were sent to, so pulling every mailbox into one place is often the prerequisite before any of it can be automated.

From there, the checklist runs itself: a document arrives, it is read and checked against the requirement set for that project and trade, a verdict is recorded with a reason, and reminders go out before anything expires. Subcontractor compliance software covers what that looks like end to end, and the vendor onboarding checklist covers the same discipline for non-construction vendors.

The short version

Signed contract, verified certificate with the right limits and real endorsements, workers compensation or exemption, W-9, active license. Verify rather than collect, add trade-specific coverage for high-exposure scopes, date-stamp the evidence, and recheck at every expiration. Gate payment on it, or the checklist becomes a form nobody reads.