Welcome to Part 4 of our Insurance Mastery Series — let’s talk Vendor Risk Management!
Your insurance strategy shouldn’t stop at your own front door. Every time you hire a vendor, supplier, or contractor, you’re also bringing some of their risk into your business. Whether it’s a janitorial service, IT provider, or general contractor, their mistakes or negligence can result in claims that affect your company—legally, financially, and reputationally.
That’s why vendor risk management is essential. The key? Proactively managing third-party risk through insurance requirements and strong contractual language.
What Is Vendor Risk Management?
Vendor risk management refers to identifying, assessing, and controlling risks that come from outsourcing work to third parties. One of the most effective tools for this is contractual risk transfer—a strategy that ensures vendors carry their own insurance and assume responsibility for liabilities they create.
Think of it as insurance in reverse:
Instead of buying protection for yourself, you’re requiring protection from others—through contract terms and insurance policies—so that their coverage pays when things go wrong.
Setting Insurance Requirements as Part of Vendor Risk Management
Tailor Coverage to the Vendor’s Activities
Never assume a vendor carries the right insurance. Your contract should spell out minimum insurance requirements based on what they do and the risks involved. Here are common policies to require:
- Commercial General Liability (CGL)
Covers third-party bodily injury or property damage.
Standard: $1M per occurrence / $2M aggregate - Workers’ Compensation
Required by law. Covers injuries to their employees.
Ask for statutory limits and $500K–$1M in Employers’ Liability - Commercial Auto Liability
Applies when vendors use vehicles for your business.
Typical Limit: $1M - Umbrella or Excess Liability
Provides additional coverage above GL, Auto, and Employers’ Liability.
Range: $1M–$5M or more, depending on exposure - Professional Liability / Tech E&O / Cyber
Crucial if the vendor provides services, tech, or handles sensitive data.
Minimum: $1M per claim, scaled to the scope of work
🔍 Pro Tip: A software vendor and a landscaper don’t pose the same risk. Your vendor risk management strategy should require tailored insurance based on the services provided.
Contractual Risk Transfer: The Legal Backbone of Vendor Risk Management
Strengthen Risk Transfer with Legal Clauses
Good insurance is only half of a strong vendor risk management plan. You also need smart contract language that aligns with your insurance requirements.
Here are essential clauses:
- Indemnification Clause
Requires the vendor to hold your company harmless for losses caused by their work or negligence. - Insurance Requirements Clause
Details the coverages, limits, and policy features they must maintain:- Additional Insured Status
Ensures your company is covered on the vendor’s policy for work they perform on your behalf. - Waiver of Subrogation
Prevents the vendor’s insurer from seeking recovery from you after paying a claim (often mutual). - Primary & Non-Contributory Wording
Requires the vendor’s insurance to respond before yours in the event of a claim.
- Additional Insured Status
- Limitation of Liability Clause
Sometimes used to cap the vendor’s financial responsibility.
Be cautious: This can weaken your indemnity or insurance protections.
Vendor Risk Management Terms Explained: Clearing the Confusion
Additional Insured vs. Additional Named Insured
- Additional Insured: You are protected under their liability policy—but only for claims related to their operations on your behalf.
Standard and recommended for vendor contracts. - Additional Named Insured: You receive broader coverage but also share in obligations under the policy.
Typically reserved for affiliated entities—not third-party vendors.
Additional Insured vs. Loss Payee
- Additional Insured: Applies to liability insurance. Protects you if you’re sued because of the vendor’s work.
- Loss Payee: Applies to property insurance. Ensures you get paid if insured property you have a financial interest in is damaged.
🛡️ Key Insight for Vendor Risk Management:
Always ask to be added as an Additional Insured, not a Named Insured or Loss Payee, when dealing with third-party liability coverage.
Vendor Risk Management in Action: A Real-World Example
A company hired a contractor to perform work near a neighboring property. The contractor caused significant property damage during the job. Because the company required:
- Adequate CGL limits,
- Additional Insured status,
- A solid indemnity clause,
…the contractor’s insurer responded to the claim—not the company’s own policy. This helped avoid a hit to their loss history and future premium increases.
Without those protections, the company may have had to file the claim under their own insurance—paying more in the long run.
Collaboration Is Critical to Vendor Risk Management Success
Align Legal and Insurance Expertise
Your legal team and insurance broker must work together when drafting contracts. Otherwise, clauses could contradict each other—or worse, be unenforceable.
What to check:
- Do the insurance requirements match the indemnity language?
- Are limits sufficient for the vendor’s risk?
- Do the vendor’s actual policies meet your specifications?
🤝 A coordinated approach ensures your vendor risk management strategy holds up under pressure.
Audit Your Vendor Risk Management Process Today
Do your contracts truly protect your business?
✅ Download Our Free Vendor Insurance Requirements Template
Ensure your vendors carry the right protection for your business. This template helps you define crucial insurance requirements, preventing potential coverage gaps and weak clauses in their coverage.
📄 Need more depth? Review the North Dakota OMB’s Guidelines to Managing Contractual Risk for sample indemnification and insurance clauses you can adapt to your contracts.
Coming Up in Part 5…
In the final part of our Insurance Mastery Series, we’ll explore how to tie everything together—focusing on proactive risk control strategies and managing claims effectively when incidents inevitably occur.
