For municipalities, universities & public agencies

Keep every vendor, permit holder and public works contractor insured, on the record.

Name: 2026 Subcontractor COI Compliance & Risk Transfer Benchmark
Creator: Pikorua Security
License: https://creativecommons.org/licenses/by/4.0/

Cities, counties, school districts and universities collect certificates in half a dozen departments. Pikorua Security checks each one against the right requirement for that relationship and keeps an audit trail that holds up for an auditor or a public records request.

Start free trial Talk to sales

COI intake · City of Port Ellis

Risk Management

SE-2026-0417

Riverfront Harvest Fair · Sat, Nov 7, 2026

Applicant: Port Ellis Harvest Association

Alcohol served or sold

General liability$1,000,000 / $2,000,000, policy period covers the event dateACORD 25
City as additional insuredCity of Port Ellis, its officers, officials, employees and volunteers, for operations under the permitCG 20 12
Workers' compApplicant reports no employees; signed exemption on fileAffidavit
Liquor liabilityAlcohol will be served. No liquor liability on the certificateACORD 25

Hold issuance: 1 item

Who you track

Five populations, five different ways a certificate goes wrong.

A public entity does not have one vendor list. It has suppliers, permit holders, concessionaires, contractors and facility users, each with its own insurance standard and its own department.

Vendors and service contracts

Hundreds of recurring suppliers, from HVAC maintenance to IT installers. The AI endorsement has to name the entity, its officers, officials, employees and volunteers, exactly as the contract reads.

Special event permits

Festivals, races and block parties, often organized by volunteers. The certificate has to cover the event date, and liquor liability has to appear whenever alcohol does.

Concessionaires

Boathouses, golf course grills, stadium vendors. Leased premises bring property coverage on the ACORD 28 and liquor liability into the rule set.

Public works contractors

The entity is the owner. Completed operations matters for years after acceptance, and a permit-based AI form does not protect the entity on its own project.

Facility users and campus groups

Universities and park districts rent rooms, fields and halls. Small users often buy event coverage through a tenant user program; the certificate still needs to match the rental.

Additional insured wording

The right AI form depends on the relationship, not the vendor.

The most common public-sector defect is a correct-looking endorsement used in the wrong place. CG 20 12 covers the entity for operations it permitted. It does not protect the entity on a project the contractor performs for it.

Relationship	Form commonly used	What Pikorua Security checks
Event or right-of-way permit	CG 20 12	Entity scheduled (or permit-issuer wording), event or work dates inside the policy period, liquor liability when alcohol is served
Premises-related permit (signs, awnings, canopies, sidewalk vaults)	CG 20 13	Premises and hazard described as the permit allows
Vendor or service contract	CG 20 26	Exact legal name plus officers, officials, employees and volunteers; primary and non-contributory (CG 20 01); waiver (CG 24 04)
Public works performed for the entity	CG 20 10 + CG 20 37	Completed operations for the period the contract requires, per project aggregate (CG 25 03); CG 20 12 alone is rejected
Concession or facility lease	CG 20 11 or CG 20 26	Premises match the agreement, ACORD 28 property on improvements, liquor liability where alcohol is sold
Vendor autos on public business	CA 20 48	Entity designated as an insured for auto liability, limit per contract

Edition dates matter here too. 04 13 and later AI forms apply only to the extent permitted by law and no more broadly than the contract requires, so the contract wording itself becomes part of what Pikorua Security verifies.

Sovereign immunity preservation

Insurance requirements that do not give away your immunity.

Most public entities hold some form of governmental or sovereign immunity under state law, often paired with statutory caps on tort damages. Contract insurance requirements can sit awkwardly beside that protection. Naming the entity as an additional insured brings a vendor's insurer into the entity's defense, and risk managers ask whether that arrangement could be read as consent to suit or as a waiver of the cap.

Preservation clauses answer the question in writing. They typically state that nothing in the agreement, including the insurance requirements and the entity's additional insured status, waives any immunity or limitation of liability the entity has under law. Some entities ask the vendor's insurer to acknowledge the same point by endorsement, and some limit the required coverage to claims that immunity does not bar.

The right wording depends on your state's statutes and your counsel's drafting. Pikorua Security does not provide legal advice. What it does is make sure the requirement you chose is actually met on every file, and that you can prove it later.

What Pikorua Security does with the clause

Stores it in the requirement profile for each contract type, alongside limits and AI forms.
Checks for it when you require an insurer acknowledgment or manuscript endorsement, and flags packets without it.
Records it in the audit trail with the page it was found on and the date it was verified.

Whether a clause is enforceable is a legal question for your counsel. Pikorua Security is software and is not an insurance agency or broker.

Public audit trail

Every decision, timestamped and exportable.

When the auditor, a council member or a records request asks who accepted a certificate and on what basis, the answer is one export. Filter the log below, then copy it as CSV.

Audit trail · PW-2026-031 · Benton & Hale Civil Inc.

Append-only

Audit events for contract PW-2026-031
Timestamp (ET)	Actor	Event	Detail
2026-10-14 09:12:04	System	Received	Packet received via agent upload link: 6 pages, SHA-256 9f2c7e1a…a41e
2026-10-14 09:12:19	System	Parsed	ACORD 25 (2016/03) and 4 endorsements: CG 20 12 04 13, CG 25 03 05 09, CG 20 01 04 13, CA 20 48 10 13
2026-10-14 09:12:21	System	Deficiency	Rule PW-AI-01 failed: CG 20 10 and CG 20 37 required for work performed for the City; CG 20 12 submitted
2026-10-14 09:13:02	System	Notice	Deficiency notice sent to Benton & Hale Civil Inc. and Lindqvist Insurance Group
2026-10-16 15:40:47	Agent upload	Received	Revised endorsements: 2 pages, SHA-256 41bd09c3…7f02
2026-10-16 15:41:03	System	Parsed	CG 20 10 04 13 and CG 20 37 04 13 with City of Port Ellis scheduled
2026-10-16 15:58:30	jtorres (Risk Analyst)	Approved	Cleared for notice to proceed. Bonds confirmed separately by Procurement
2026-10-16 16:02:11	jtorres (Risk Analyst)	Export	Audit packet exported for public records request PRR-2026-0932

Append-only. Events cannot be edited or deleted by users, including administrators. Corrections are new events that reference the original.

File integrity. Each uploaded file is hashed on receipt, so the document you produce later is provably the one that was approved.

Retention. Set retention by record type to match your schedule. Exports include the rule that applied on the date of each decision.

Across departments

One vendor record, many intake desks.

Risk management owns the standards. Each department works its own queue without re-collecting what another already verified.

Procurement: Contract award triggers the request. Purchase orders wait on verification for the vendors you choose to gate.
Special events: The permit application carries the upload link. Liquor and event-date rules apply by permit type.
Public works: Notice to proceed waits on CG 20 10, CG 20 37 and the per project aggregate. Completed ops is tracked after acceptance.
Facilities & parks: Rentals and concessions run on the lease or use agreement, with badge or key holds through access control.

to manually review one COI and multi-page endorsement packet against contract specifications: 25 to 40 min; to manually review one COI and multi-page endorsement packet against contract specifications; CFMA Time Study
average cycle to collect, audit, chase and resolve one non-compliant COI by hand: 28 days; average cycle to collect, audit, chase and resolve one non-compliant COI by hand; Pikorua Security Benchmark Data
average resolution with Pikorua Security, down from 28 days: 4.2 days; average resolution with Pikorua Security, down from 28 days; Pikorua Security customer data

Keep reading

Endorsement guides

Trade guides for public works

Product

Trust & reading

FAQ

Questions public risk managers ask first.

Pikorua Security is an automated compliance verification software platform. Pikorua Security does not provide legal advice, insurance underwriting, or claims adjusting services, and is not an insurance agency or broker. Receipt of a certificate of insurance does not guarantee coverage under the underlying policy.

Talk to sales

Which additional insured form should a public entity require?

It depends on the relationship. Work under a permit usually calls for CG 20 12, and premises-related permits for signs or awnings for CG 20 13. Vendors and service contractors commonly provide CG 20 26. When a contractor builds or repairs something for the entity, the entity is the owner, so CG 20 10 with CG 20 37 (or a blanket form such as CG 20 38) is the usual standard. Pikorua Security lets your risk manager set the rule per relationship type and rejects the wrong form automatically.

What is a sovereign immunity preservation clause?

It is contract language, sometimes repeated in an insurer acknowledgment, stating that the insurance requirements and the entity's status as an additional insured do not waive any governmental immunity or statutory limit on liability the entity has under state law. Whether you need one, and how it should read, is a question for your counsel. Pikorua Security records the clause in the requirement profile and checks that any acknowledgment you require is attached.

Can Pikorua Security support audits and public records requests?

Yes. Every document, parse result, rule decision, notice and approval is written to an append-only log with timestamps, the user or system that acted, and a file hash. You can export a complete packet for any vendor, permit or contract as of any date, and set retention to match your records schedule.

Can different departments run their own intake?

Yes. Procurement, special events, parks, public works and facilities can each work their own queue, while risk management owns the rule sets and sees every vendor across departments. A contractor who holds a permit and a service contract has one record and one certificate history.

Do event organizers and small vendors need an account?

No. Applicants and their insurance agents receive a zero-login upload link with the permit application or contract award. They see which requirement each document satisfies, and the permit office sees the result as soon as it verifies. Pikorua Security is software and does not sell event insurance or act as an agent or broker.

14-day free production trial

See which permits and contracts are missing the right coverage today.

Upload one department's current certificates. Pikorua Security checks each against the requirement for that relationship in about 10 minutes.

Start free trial Explore demo