What this is
What is an insurance adequacy review?
What is an insurance adequacy review?
An insurance adequacy review compares the insurance a contractor holds, by type and limit, against the actual exposure of the work they are contracted to do. It asks whether the cover matches the risk, which is distinct from confirming the cover simply exists or has not expired.
How is adequacy different from a certificate check?
A certificate check confirms a policy is current and lists its stated limits. Adequacy asks whether those limits are enough for what could plausibly go wrong on this specific scope of work, which requires assessing the exposure first and only then judging the cover against it.
Why does this need risk management involvement, not just procurement?
Procurement can confirm a certificate matches a contract clause. Judging whether a limit is actually adequate for a given exposure, a fire, a product recall, an environmental release, requires the kind of loss-scenario thinking risk management does, which is why the review is carried out jointly rather than by procurement alone.
Scope
When is an insurance adequacy review required?
This review sits downstream of a risk classification and upstream of the contract terms it is meant to enforce. Using it to confirm a certificate exists, rather than to judge whether the cover fits the risk, collapses it into a check it was not built to be.
Use this template when
- A contractor is being prequalified and the required cover for their risk tier needs setting and checking
- The scope of a contractor's work has changed materially since the last review, in method, hazard or location
- A contract is being renewed or extended and the original limits need reconfirming against current exposure
- An incident or near miss involving a contractor raises a question about whether the cover in place was ever adequate
- A risk tier has been reassigned and the required limits attached to it need to be reapplied
Do not use it for
- Insurance Certificate Record, which holds the contractor's insurance certificates with coverage amounts and expiry dates as documents, not as an adequacy judgement
- Workers Compensation Clearance, which confirms a statutory account is current and paid, not whether commercial limits fit the risk
- Insurance Expiry Review, which tracks contractor insurance due to expire across the approved list on a calendar basis
- Contractor Risk Classification, which sets the risk tier this review depends on, rather than judging any single contractor's cover
- Indemnity and Contract Record, which holds the contractual indemnity allocation rather than the insurance limits that stand behind it
Compliance mapping
Which Contract requirements requirements does this satisfy?
Insurance adequacy is driven overwhelmingly by contract, not statute: what the parties agreed to require sits above any general legal minimum, which is why the review's authority is the contract itself, with statutory minimums acting as a floor rather than the standard.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001:2018 cl.8.1.4.2 | Coordinate with contractors to identify hazards and control risks arising from contracted work before it proceeds | Header |
| Employers' Liability (Compulsory Insurance) Act 1969 (UK) | Employer must hold a minimum statutory level of employers' liability cover for its own workforce | Required versus held |
| ISO 45001:2018 cl.8.1.4.2 | Risk arising from contracted activities is assessed and controlled in proportion to the activity itself | Exposure assessment |
| State-mandated minimum liability limits (US, no federal minimum) | Minimum general or public liability cover is set by the jurisdiction in which the work is performed | Required versus held |
| Contract requirements (bespoke to the engagement) | The coverage type and limit specified in the contract must be evidenced against the risk before work proceeds, not assumed from a certificate | Assessment |
| ISO 45001:2018 cl.8.1.4.3 | Outsourced functions and processes are controlled so risk is not transferred to a party without matching capability or cover | Assessment |
| Common law and statutory indemnity principles | A principal that knowingly accepts inadequate contractor cover retains exposure for losses the contractor cannot pay | Exposure assessment |
What it does not cover
- Insurance Certificate Record, which holds the contractor's insurance certificates with coverage amounts and expiry dates as documents on file.
- Workers Compensation Clearance, which confirms a statutory account is current and paid, a separate question from whether commercial limits fit the risk.
- Insurance Expiry Review, which tracks contractor insurance due to expire across the approved list, on a calendar basis rather than an adequacy basis.
- Contractor Risk Classification, which sets the risk tier this review consumes, rather than judging any individual contractor's cover.
- Indemnity and Contract Record, which holds the contractual indemnity allocation between the parties, distinct from the insurance limits standing behind it.
Global
Insurance Adequacy Review requirements by country
Because adequacy is contract-driven, statutory minimums function mainly as a floor beneath the negotiated requirement, and the jurisdictions that matter most are the ones with clear statutory minimums or a litigation environment that pushes contract limits well above them.
Employers' Liability (Compulsory Insurance) Act 1969
Sets a clear statutory minimum for employers' liability cover, giving reviewers a hard floor to check contractor cover against for their own workforce.
Public and product liability limits above that floor remain a matter of contract, so the review still has to judge adequacy for anything beyond the statutory minimum.
State-mandated minimum liability limits, no federal general scheme
Minimums vary by state and by line of cover, and a litigious claims environment means contract-required limits routinely run far above any statutory floor.
The statutory minimum is rarely the relevant number; the contract-required limit, set from the actual exposure, is what a review here should be checking.
ISO 45001 cl.8.1.4 and national contract insurance practice
ISO 45001 requires risk from contracted work to be controlled proportionate to the activity, without prescribing insurance limits, leaving the specific figures to contract and national practice.
Outside the UK and US, adequacy is judged almost entirely against the contract and the exposure assessment, since a comparable statutory floor is often absent or unclear.
How to complete it
How to complete an insurance adequacy review, step by step
The form pairs a required figure with a held figure for each type of cover, which makes the arithmetic easy. The judgement is in what required figure gets entered in the first place, and what happens once a gap is found.
The required limit should come out of the worst credible outcome fields, injury severity, property damage, business interruption, recall, environmental damage, assessed for this scope of work, not out of a standard contract clause applied regardless of the work. A required figure with no exposure reasoning behind it is a guess with a number attached.
Adequacy is a numeric comparison, and marking it without checking the two figures against each other defeats the purpose of recording them separately. Where the held figure is unclear from the certificate, that is itself a finding, not a reason to mark the field on faith.
Public liability does not respond to a claim arising from a design or specification error; that sits with professional indemnity. Any contractor whose scope includes design, engineering judgement or specification should have professional indemnity assessed as required, not left at the default of not needed.
A shortfall does not resolve itself by being recorded. Whether work stops, continues under specific conditions, or continues unconditionally while cover is corrected is a decision this review has to state, and it should default toward caution rather than toward keeping the contractor working.
What auditors find
Most common insurance adequacy review findings
Because adequacy depends on a judgement about the exposure, findings against this review are less about missing numbers and more about numbers that were never actually tested against each other.
| Finding | Clause | What fixes it |
|---|---|---|
| Required limit set to a standard contract figure rather than derived from the exposure assessed for this scope. | Contract requirements (bespoke to the engagement) | Derive the required limit from the worst credible outcome fields for this specific work, not a boilerplate contract number. |
| Adequate marked yes while the held figure is numerically below the required figure. | Contract requirements (bespoke to the engagement) | Cross-check the required and held figures before marking adequacy; do not infer adequacy from the certificate existing. |
| Professional indemnity marked not required despite the contractor performing design or specification work. | ISO 45001:2018 cl.8.1.4.2 | Flag professional indemnity as required whenever the scope includes design, specification or engineering judgement. |
| Work permitted to continue unconditionally despite an identified shortfall. | Common law and statutory indemnity principles | Default to holding or conditioning the work whenever a shortfall is identified, until it is corrected or contractually addressed. |
| Contract requirements not updated after a shortfall is found, leaving the same gap at the next renewal. | Contract requirements (bespoke to the engagement) | Link a confirmed shortfall to a contract amendment step, rather than leaving it as a note on this record alone. |
| Risk tier and required limits not reassessed after a scope change. | ISO 45001:2018 cl.8.1.4.3 | Trigger the exposure assessment and required limits again whenever the scope of work changes materially. |
Case in point
Case in point: the certificate that matched the wrong risk
A cleaning contractor was prequalified for routine floor and surface cleaning, and the insurance adequacy review set required public liability at a moderate figure suited to that scope. Several months in, the contract was extended to include periodic drain and pipework treatment near an ammonia refrigeration plant, a change agreed directly between the site manager and the contractor without a new adequacy review.
A treatment chemical reacted with residue in the drain line, causing an environmental release that required regulatory notification and remediation costing several times the contractor's public liability limit. The review on file was accurate for the scope it had assessed and irrelevant to the scope actually being performed, because nothing had linked the contract change to a rerun of the exposure assessment. The lesson taken forward was procedural rather than technical: any scope change now routes automatically to a new adequacy review before the changed work is permitted to start.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
4 sections
- Reference
- CON-022
- Archetype
- Review
- Record ID
- IAR-2026-000
- Scoring
- Adequacy score
- Direction
- High is good
- Singleton
- No
- Basis
- Contract requirements
- Links
- Links Vendor, Risk Classification
- Tags
- Contractor, Insurance
- Sections
- 4
- Fields
- 43
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 3
Header
12 fieldsReview ID*
Auto sequence. Format IAR-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Contractor*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Work Category*
Mechanical, electrical, refrigeration, civil, cleaning, catering, transport, IT or professional services.
Risk Tier*
Set by the work they do, not by how big the company is.
- Low3 pts
- Medium2 pts
- High1 pt
- Very high0 pts
Contract Owner*
Match The Limit To The Exposure
A million in cover sounds like a lot until a contractor causes a fire or a product recall. Set required limits by what could actually go wrong, not by habit.
Exposure assessment
6 fieldsWorst Credible Injury Outcome*
- Minor3 pts
- Serious1 pt
- Fatality0 pts
Worst Credible Property Damage
Business Interruption Exposure
Product Recall Exposure*
A contractor contaminating product creates recall, disposal and customer claim costs simultaneously.
- None3 pts
- Limited1 pt
- Significant0 pts
Environmental Damage Exposure*
- None3 pts
- Limited1 pt
- Significant0 pts
Ammonia Or Major Hazard Exposure*
- None3 pts
- Limited1 pt
- Significant0 pts
Required versus held
11 fieldsPublic Liability Required*
Public Liability Held*
Adequate*
- Yes3 pts
- Marginal1 pt
- No0 pts
Employers Liability Required
Employers Liability Held
Statutory Minimum Met*
- Yes3 pts
- No0 pts
Professional Indemnity Required
Design work by a contractor creates a professional liability that public liability does not cover.
- No3 pts
- Yes1 pt
Professional Indemnity Held
Product Liability Required
- No3 pts
- Yes1 pt
Motor Insurance Where Vehicles On Site
- Yes3 pts
- Not applicable3 pts
- No0 pts
Contract Works Where Applicable
- Yes3 pts
- Not applicable3 pts
- No0 pts
Assessment
14 fieldsAll Required Cover In Place*
- Yes3 pts
- Partly1 pt
- No0 pts
Shortfall Identified
Additional Cover Required*
- No3 pts
- Yes0 pts
Contract Requirements Updated*
- Yes3 pts
- Not needed3 pts
- No0 pts
Contractor Informed*
- Yes3 pts
- No0 pts
Work Permitted Meanwhile*
- No3 pts
- With conditions1 pt
- Yes0 pts
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Contract Owner*
Signature*
Risk Or Finance*
Second Signature*
CON-022 · record IDs look like IAR-2026-000 · Links Vendor, Risk Classification
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The review itself is a comparison of numbers. What actually fails is the link between a changed scope and a rerun assessment, and between a found shortfall and a corrected contract.
Holds the adequacy review against the vendor's risk tier and scope, and flags where a scope change has not triggered a fresh review.
Rolls adequacy findings into the wider contractor compliance picture, so a shortfall is visible alongside expiry and clearance status, not isolated on this record.
Watches for scope changes and shortfall findings across the contractor list, and raises the rerun review before work under the new scope proceeds.
This template lives in KnowContractor — contractor management. Prequalification, approval, induction, permits and performance.
Meet KnowContractor→Glossary
Insurance Adequacy Review definitions and key terms
- Adequacy
- Whether the type and limit of cover a contractor holds is sufficient for the specific exposure of the work they are doing, as distinct from whether cover simply exists.
- Exposure assessment
- A structured estimate of the worst credible outcomes, injury, property damage, business interruption, recall, environmental, arising from a given scope of work, used to set required limits.
- Statutory minimum
- The lowest level of cover required by law in a given jurisdiction, which functions as a floor rather than a target for contract-required limits.
- Professional indemnity
- Cover responding to loss caused by an error in design, advice or specification, which sits outside what public or general liability cover will pay.
- Contract works cover
- Insurance covering physical loss or damage to work under construction or installation, relevant wherever a contractor's activity itself could damage the asset being worked on.
FAQ
Frequently asked questions about insurance adequacy review
Isn't a valid certificate enough to prove adequacy?+
No. A certificate proves a policy exists at a stated limit. Adequacy asks whether that limit is enough for this specific work's worst credible outcome, which the certificate alone cannot answer without the exposure assessment behind it.
How do we set the required limit for a new contractor?+
From the exposure assessment, not from habit. Estimate the worst credible injury, property damage, business interruption, recall and environmental outcomes for the actual scope, and size the required limit against those, rather than applying the same figure to every contractor regardless of risk.
When does professional indemnity apply to a contractor?+
Whenever their scope includes design, specification or engineering judgement, not only where they are formally titled a designer. Public liability responds to physical injury or damage; it does not respond to a claim that the design itself was wrong, and that gap is exactly what professional indemnity is for.
What should happen if we find a shortfall?+
Decide explicitly whether work continues meanwhile, stops, or continues under stated conditions, and update the contract requirement so the shortfall does not simply recur at the next renewal. Recording the shortfall without a decision is not a completed review.
Does a scope change really require a whole new review?+
Yes, wherever the change is material to the exposure. Limits set for one description of work say nothing about a materially different one, and the review's value depends entirely on the exposure it was tested against still matching the work being done.
Who decides what counts as adequate, procurement or risk management?+
Both, deliberately. Procurement can confirm a certificate matches a contract clause, but judging whether a limit is genuinely sufficient for a loss scenario is a risk management judgement, and the review is weakest when either function does it alone.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Contractor Onboarding and Management
Contractor Prequalification Questionnaire
Collects a contractor's safety, insurance, training and performance information before they are approved
Contractor Safety Statistics Review
Reviews a contractor's injury rates, citations and experience modifier over recent years
Contractor Risk Classification
Classifies a contractor by the risk of the work they do, from low risk services to high risk construction
Contractor Approval Record
Records the decision to approve a contractor to work on site
Contractor Safety Program Review
Reviews the contractor's own written safety programme against your requirements
Subcontractor Declaration
Records any subcontractors a contractor intends to use
More in Insurance
Insurance Certificate Record
Holds the contractor's insurance certificates with coverage amounts and expiry dates
Workers Compensation Clearance
Confirms the contractor is in good standing with the workers compensation authority
Insurance Expiry Review
Reviews contractor insurance due to expire in the coming period
Indemnity and Contract Record
Holds the signed contract and its safety, indemnity and liability terms
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 45001:2018 clause 8.1.4, Procurement
- Employers' Liability (Compulsory Insurance) Act 1969 (UK)
- State-mandated minimum liability limits (US, no federal minimum)
- Contract requirements as the primary basis for required cover
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.