Compliance Coffee Talk · July 2025
Setting the right insurance requirements
Contract review specialist Noelle McCall and CIRA risk manager Thor Benzing on when to update your requirements, how to set limits, which endorsements to require, and how to keep verifying coverage after the work is done.
Guest experts

Noelle McCall
National Practice Leader for Contract Review, Howden

Thor Benzing
Risk Manager, California Intergovernmental Risk Authority
The session
A contract review specialist and a pool risk manager on insurance requirements
Noelle McCall has spent decades in insurance and contract review consulting. At the time of this session she was Director of Contract Risk Management at Peoples First Insurance and co-founder of Contract Risk Academy, where she teaches risk managers, brokers and lawyers to review contracts from an insurance perspective. She is now National Practice Leader for Contract Review at Howden.
Thor Benzing is Risk Manager for the California Intergovernmental Risk Authority (CIRA), a risk pool for small and medium-sized California municipalities. He has worked in risk and safety for more than 18 years, and works in the field with members on risk transfer, contracts and insurance requirements.
In July 2025 they joined us to answer one of the questions we hear most: how should we set our insurance requirements? Watch the session, or read the takeaways below.
Key takeaways
16 takeaways from the session
Noelle and Thor's advice in four themes, from building requirements that fit the work to keeping coverage verified after the job ends.
01–05
Build requirements that fit the work
Start from templates and limits you can defend, then adjust for the job in front of you.
- 01
Update requirements every three to five years
Noelle's minimum is a review every three to five years, and sooner if someone other than an insurance expert wrote them. Requirements copied from old agreements often give themselves away with outdated terms like "comprehensive general liability."
The takeaway: Put a requirements review on the calendar at least every five years.
- 02
Start with a handful of templates
Thor recommends three to five template buckets, such as construction, professional services and leases, that cover about 80% of your contracts. Tailor the riskier outliers individually, and refine the templates from the feedback you get each time you use them.
The takeaway: Build a few core templates and modify them only for high-risk jobs.
- 03
Look past the contract value
Project value is one factor, but Noelle puts scope of work first, because some of the smallest projects have the biggest losses. She also weighs your history with the vendor, whether they're the only one available, and how urgently you need the work done.
The takeaway: Set limits from the scope of work and its exposures, not the price.
- 04
Start high, because lowering is easier
Thor's pool started from limits its broker recommended and adapted them for members. When in doubt between $1 million and the next level, he goes higher and comes down as he learns more about the work. The right number also depends on your risk appetite and what you can defend to your board or council.
The takeaway: When unsure, set the higher limit and lower it once you know the job.
- 05
Ask for what's commercially reasonable
Large brokers can often share benchmarks on what types of vendors typically carry. Noelle says requirements should be commercially reasonable and available, and in line with project value. No limit will cover every possible loss, especially for cyber.
The takeaway: Ask your broker what similar organizations require of each vendor type.
“It's always good to start high because you can always come down. Trying to reverse and go up is so hard.”
Thor BenzingRisk Manager, California Intergovernmental Risk Authority06–10
Handle pushback and changing risks
Explain the reason behind a requirement, help vendors who can't meet it, and watch the exposures that are moving.
- 06
Point to your insurance carrier
When a long-standing vendor resists new requirements, Noelle suggests explaining that your carrier expects them. It's often true: carriers commonly set minimum limits and require endorsements such as additional insured, primary and noncontributory, and waiver of subrogation.
The takeaway: Use your carrier's standards to explain why requirements changed.
- 07
Help small vendors carry the risk
A local women's club running a July 4 booth with alcohol couldn't afford the required limits. The member city had the club carry a first layer, acted as excess above it, and added an indemnification agreement, special event coverage through a broker, and help with setup and training.
The takeaway: When a small vendor can't meet a requirement, layer coverage and add controls instead of waiving it.
- 08
Watch the exposures that are growing
In California, Thor sees wildfire, public safety and now public works claims, like tree management and dangerous road conditions, drawing very large verdicts. Some jobs that once required half a million in coverage now call for $1 million, $2 million or even $5 million.
The takeaway: Revisit limits for the services where verdicts are rising.
- 09
Look at what high-risk partners do, not just what they carry
Agencies that work with foster care, residential and behavioral health nonprofits are being asked to lower general liability requirements because sexual abuse and molestation (SAM) coverage is hard to get in California, where AB 218 opened a window for older childhood abuse claims and extended how long survivors can sue. Thor's advice is to look at the partner's prevention programs and whether it has completed a SAM risk assessment, and to ask your broker for help finding coverage. Settlements are large. Thor recalled about $900 million for LA County, though he wasn't certain of the number. For the record, the county agreed to a $4 billion settlement in April 2025 and an $828 million settlement that October.
The takeaway: Before lowering a SAM requirement, review the partner's prevention programs and risk assessment.
- 10
Strong contract management earns better terms
Underwriters often add wildfire exclusions. One of Noelle's clients, a construction company building transmission lines in California, tracked its contractor management and subcontractor requirements closely and shared the data, and got a narrow exclusion limited to that work on its umbrella and excess policies.
The takeaway: Track your contract risk management and share it with underwriters at renewal.
11–13
Get the endorsements, not just the certificate
A certificate says coverage exists. The endorsements show what it actually does.
- 11
Require the three core endorsements on every contract
Noelle requires additional insured, primary and noncontributory, and waiver of subrogation on every contract. Primary and noncontributory means the vendor's insurance pays first and yours doesn't contribute. Waiver of subrogation matters most on workers' comp, where you can't be an additional insured, because it stops the vendor's carrier from suing you to recover what it paid.
The takeaway: Make these three endorsements standard in every template.
- 12
Read the endorsements themselves
Certificates carry disclaimers saying they aren't part of the policy, and a name in the description box isn't coverage. Additional insured coverage comes in different levels, with separate forms for ongoing and completed operations. Thor's pool trains staff outside the risk team so coworkers understand why the endorsements matter.
The takeaway: Get copies of each endorsement and read them, or have your broker review them.
- 13
Keep a library of approved endorsements
CIRA bought Evident so its members can track certificates and the endorsements that come with them (thanks for the plug, Thor!). Members and the pool review and approve endorsements in the tool, especially blanket endorsements, which start to blur together but still need to be read one by one. Once a version is approved, they know it's good going forward.
The takeaway: Record which endorsement versions you've approved so each review gets faster.
“Just because it says it on a certificate doesn't mean you have the coverage.”
Noelle McCallNational Practice Leader for Contract Review, Howden14–16
Keep verifying after the work starts
Coverage can lapse mid-project, and claims often arrive after the work is done.
- 14
Don't rely on notice of cancellation
Most cancellation endorsements only say the carrier will endeavor to notify you, and nonpayment notice is often just ten days. Noelle instead requires current certificates and endorsements before work starts, at any time on request, and within about five business days of expiration or renewal. She skips notice of material change, which is rarely defined.
The takeaway: Write the right to request current certificates at any time into your contracts.
- 15
Keep coverage in force after the project ends
Thor's members specify how long coverage continues after the work, typically two to five years and especially for professional liability. Noelle adds that general liability should run through the construction statute of limitations and repose, because most general liability claims come from completed operations.
The takeaway: Set a post-completion coverage period in every agreement and keep collecting certificates.
- 16
Keep the paperwork on file
Noelle asks for the general liability declarations page and schedule of forms, and the full umbrella or excess policy, which may not follow the underlying coverage. Keep them for the full statute of repose. In one CIRA member case, a vendor's traffic control error led to a $600,000 loss, and because the city's documents and endorsements were in order, it paid $2,000 in legal fees.
The takeaway: File certificates, endorsements and policy copies for every job until the statute of repose runs out.
Join the next session
Bring your questions to the next Coffee Talk
Each month, experienced risk leaders answer questions from public sector and enterprise risk teams in a 30-minute conversation.
