A certificate of insurance can be wrong. Moreover, a COI can be right as of the time of issuance, but then the insurance policy can be changed or cancelled. How can a principal really protect its downstreaming rights?
A common move is to require that a subcontractor not just produce a certificate, but also a copy of the subcontractor’s policy declarations page and that policy’s additional insured provisions. The principal can then review those provisions and make sure that the information on the COI is correct. But, this does not protect from future changes to/cancellation of the policy.
I have seen insurers agree to notify loss payees (third-parties to first party insurance policies who get paid in the event of a loss — for example, a bank with a mortgage on a house is likely listed as a loss payee on the homeowner’s policy) regarding policy cancellation. I imagine this could be done for additional insureds with respect to liability coverages. Even so, such a provision does not usually require notice of a policy expiring. Thus, it is important in all cases to note the effective dates in a sub’s policy and request updates materials (COI, dec page, AI provisions) at the end of the policy period.
To be most protected, the principal should have its own insurance, and make sure that the terms of its own policy do not require, as a condition precedent to coverage, that all subcontractors have insurance. Otherwise, if the COI is wrong and the sub doesn’t have insurance naming the principal as an AI, then the principal may be denied both the AI coverage and its own coverage! This way the principal is protected via its own contract with an insurer who owes its duties directly to the principal.