The Crew Showed Up, The Paper Didn't: Condo Board Got Sued.

The building manager never checked the vendor's license or checked the insurance certificate and forgot to make sure the association was named on their policy. This week, we look at the three papers that decide whether one accident costs the vendor or costs every owner in the building. Welcome to the HOA Case Files, a fun but serious look at running a self-managed board.

Each week, we cover one real problem with two opinions and ways to tame the craziness.

Things like dues, repairs, reserves, vendors, software, meetings, and the neighbor who will not stop emailing you at 1 a.m.

We argue the cost, debate the risk, and which fights are worth the trouble.

For volunteer boards who have to decide something quickly and need advice on real-world association concerns.

Let's get right into it.

You're just sitting in your living room, right? Having your morning coffee.

Yeah, just a totally normal morning.

Exactly, a normal Tuesday. And outside, there's a crew fixing the roof on your community's clubhouse.

Routine maintenance.

Right. But suddenly you hear a shout, then a really loud crash, and then just total silence. One of the roofers has fallen.

Oh man.

Which is just an absolute tragedy.

It's awful. But you know, as the ambulance is arriving, there is this hidden financial time bomb just ticking in the background.

Because of the paperwork? Yes. Or the lack of it, really.

Yes. Because what if, due to literally a single missing piece of paper in some filing cabinet somewhere, you and your neighbors are suddenly considered that injured worker's legal employer.

It happens.

It really does.

It really does.

And what if you're now entirely, like personally liable for hundreds of thousands of dollars in medical bills?

It is a terrifying scenario, honestly. I mean, people just assume the contractor handles their own risk, right? That a vendor's problems belong solely to the vendor.

Right. They're a separate business.

Exactly. But the legal system doesn't always see it that way. And that blind spot, it destroys community finances every single year.

Whether you're a brand new board member or maybe a community association manager, a CAM for short, or you know, just a curious homeowner who wants to know how your monthly dues are being protected, we have a really vital mission today.

We do. We are exploring the sort of hidden world of vendor compliance.

Yeah. And to figure out how communities are fighting back against these risks, we're pulling insights today from a really illuminating research brief. It's called HOA Vendor Paperwork.

Really good stuff in there.

Yeah. And we're pairing that with the system architecture of a cloud-based HOA software platform.

Which I know on the surface sounds like we're about to spend our time talking about uh dry administrative bureaucracy.

Right, like the most boring board meeting of the year.

Yeah. Vendor compliance doesn't exactly get the heart raising.

It really doesn't. But okay, let's unpack this because what we are actually talking about is a high-stakes, literal life and death shield. It is. This paperwork is the armor that protects property owners from just catastrophic lawsuits. And the way most communities are handling it right now, it's a total recipe for disaster.

Yeah, we call this the one and done trap.

The one and done trap. Let's get into that.

So let's look at the core problem. Most volunteer boards or property managers, they have incredibly good intentions. They're just busy people.

Very busy.

Right? So they hire a vendor, say a landscaping company or a plumber. And before the vendor starts, the board asks for a COI, a certificate of insurance.

Standard operating procedure.

Exactly. The vendor hands it over, the board checks it off their mental list, they throw it in an inbox, and they literally never look at it again.

Yeah, I mean I can see how that happens. It's like uh it's like checking someone's driver's license the day you buy a car and just assuming they are legally allowed to drive flawlessly for the next 10 years.

Right. You just assume adults have their act together.

You do. You want to trust people.

But that false sense of security is exactly what gets communities in trouble. I mean, a year later, that vendor is still doing work on the property.

Right.

But maybe they hit a rough financial patch. They missed a premium payment, so their policy just lapsed.

Oh wow. Or maybe nothing.

Nothing. Or maybe their coverage expired and they went with a cheaper, you know, less comprehensive plan that actually doesn't cover commercial properties anymore.

So a contractor with fantastic, like multimillion dollar coverage on signing day might have absolutely zero coverage six months later.

Exactly. And nobody on the board knows because nobody ever asked again. They did the one and done.

Well, what makes that even worse, though, is the reality of forged documents.

Oh, yeah. Forgery is rampant.

Because the research brief points to warnings from insurance analysts, specifically Ann Hickman at IRMI, who explicitly tells boards never ever to accept a COI handed over directly by the contractor.

Yeah, to understand why, you kind of have to think about the mechanics of a fake COI. We aren't necessarily talking about criminal masterminds here. Right.

It's not some high-tech heist.

No. Just picture a local contractor sitting in his truck. He's struggling, inflation is hitting his business hard, and he just needs this one neighborhood landscaping contract to make payroll.

Just to keep his guys employed.

Exactly. But his insurance expired two months ago.

Uh-oh.

So he opens the old PDF certificate on his iPad, clicks edit, and just changes the expiration year from 2025 to 2026.

Wow. And it probably takes 30 seconds.

Literally 30 seconds. He emails it to the property manager and to the manager, it looks entirely official.

So the board thinks they are protected by a million-dollar policy, but they're actually protected by 30 seconds of basic PDF editing.

Yeah. And even if the paper is real, the COI often hides exclusions.

Exclusions. Like what?

Well, you look at the certificate, the dates are valid, the limits look high. But buried like 40 pages deep in the actual policy contract, there might be a clause that explicitly excludes work done for condominium or community associations.

Wait, really? They just write HOAs out of the policy entirely.

They do. Insurers know HOAs are highly litigious environments, so they carve them out to save money. If you don't know that exclusion is there, you are hiring an uninsured contractor.

Okay, let's dig into the consequences of that. Because my first thought, as just a regular person, is well, the injured guy works for the vendor, so if he gets hurt, he sues his boss. He sues the vendor.

And they will certainly try that first. But if the vendor is uninsured or underinsured, they just don't have the assets to pay out a massive medical claim.

All right, they can't afford it.

And the hospital still needs to be paid. The injured worker still needs care, you know. So the law steps in to find the deep pockets.

Ah, and there it is.

Yep. In many jurisdictions, an association can actually be treated as the statutory employer of an uninsured vendor's crew.

The statutory employer, meaning the association, like the homeowners themselves, just step into the shoes of the boss.

Basically, yeah. The underlying logic of the law here is that the work was being done for the ultimate benefit of the property owners.

Right. It's your roof being fixed.

Exactly. So the injured worker doesn't even have to prove the association was negligent or that they built a faulty roof. They often only have to prove that they were hurt while on your site, doing work for you.

That is wild.

Once they prove that, the association is on the hook for the worker's compensation claims. And uh as a side note, if a contractor is unlicensed, that almost universally means they are uninsured as well.

Because insurers won't underwrite an unlicensed business, right?

Spot on. They won't touch them.

So we have this gaping hole in the armor. We check a piece of paper once, maybe it's fake, maybe it's expired, maybe it has hidden exclusions. Yep. And if anything goes wrong, the homeowners pay the price through massive special assessments or drained reserves. So how do communities actually fix the one and done trap?

Well, the research outlines a pretty rigorous logical system to replace it. It's called the three-check rule.

The three-check rule? Okay, lay it out for us.

So before a vendor does a single day of work on the property, three specific things must happen. First, you look up their state license.

Okay. Sounds simple enough.

But crucially, you don't look at the paper they hand you. You go to the official state licensing website, type in their name, and verify the license is active, hasn't been suspended, and actually matches their trade.

Trust but verify. I mean a guy might have a valid license for painting, but that doesn't mean he's legally allowed to rewire the clubhouse.

Exactly. You'd be surprised how often that happens. Now, second, you must get a current COI covering both general liability and workers' comp.

Right, the standard coverage.

And the golden rule here, like we mentioned earlier, this must come directly from the vendor's insurance agent.

You don't take it from the vendor at all.

Never. You instruct the vendor to have their agent email the document straight to the board.

which completely bypasses the whole iPad PDF forgery problem we just talked about. The guy sitting in his truck can't intercept an email coming straight from state farm or Geico.

Exactly. That direct pipeline is literally the only way to trust the document. Now the third check is where things get really nuanced.

Okay.

For any job that is beyond small, low-risk work, you must require an additional insured endorsement.

Wait, wait, let me push back on this a little bit on behalf of our listeners, because I have seen these standard insurance forms a million times.

I'm sure you have.

And I always see the box for certificate holder checked at the very bottom of the page, and the community's name is typed right in there. Doesn't that mean we are covered?

This is perhaps the greatest and most expensive misunderstanding in all of community management.

Oh boy.

Being a certificate holder gives you absolutely zero coverage. None.

Seriously. Our name is literally printed on the paper and it means nothing.

It is essentially a mailing list. All being a certificate holder means is that you get a copy of the piece of paper. And the insurance company, you know, they might send you a notice if the policy changes or gets canceled. But you have no rights under the policy itself. The vendor bought the policy, the vendor has the coverage.

So if a lawsuit drops, the insurance company looks at the certificate holder and just says, we don't know you, you aren't our client?

They absolutely will, which is why you need the additional insured endorsement. This isn't just a checked box. It is a legal amendment to the policy itself. Okay.

A legal amendment.

Right. It amends the contract after it was issued to explicitly cover the association for liability arising out of the vendor's work.

And the research highlights a magic phrase here that kind of blew my mind. Duty to defend.

Yes. That phrase is the ultimate shield. Think about how a lawsuit actually plays out.

Okay.

Defense attorneys can cost four, five, six hundred dollars an hour.

Easy.

And if a lawsuit names both the vendor and the association, which personal injury lawyers will almost always do to cast a wide net, the vendor's insurance company is legally obligated to hire those expensive lawyers and defend the association in court.

Wait, really? They pay for our lawyers.

They pay for the defense and they cover the claims. But to get that, you have to ask for the actual endorsement page, and it must list the exact legal name of the association.

Okay, so just to recap the three-check rule, verify the license on the state site, get the COI direct from the agent, and secure an additional insured endorsement.

That's the formula.

But as a practical listener, I'm thinking, uh, how do I draw the line? Like, do I really need to demand legal amendments and endorsement pages for a guy coming out to fix a single broken hinge on a pool gate?

No, no. That is a very valid operational concern. If you demand maximum paperwork for every tiny job, nothing will ever get fixed in the community.

Right. The residents would revolt.

The research actually outlines how to scale these rules logically based on the danger of the job. They use a concept called risk tiers.

Risk tiers. Okay, so how do we categorize the danger? Where does my fence guy fall?

We start with low risk. This is your hinge example. Small repairs, maybe a one-time visit.

What defines it as low risk, though?

The key identifiers here are no height, no water systems involved, and no power tools used in common areas where residents are walking around.

Makes sense.

So for low risk, the minimum paperwork is verifying the state license and getting that current COI

directly from the agent. You still need to know they are a real business with basic coverage, but you don't necessarily hold up the job demanding the full additional insured legal amendment.

That is perfectly logical. So what triggers the jump to the next tier? I imagine anything involving the roof or heavy machinery?

Exactly. We call that higher risk. And it's where the potential for catastrophic damage or injury jumps significantly. We are talking about roofing, plumbing, tree work, pressure washing at a height, electrical work, handling pool chemicals.

Pool chemicals kind of stand out there. I mean, it's not a height issue, but if a vendor spills a massive drum of chlorine in the clubhouse, that isn't just property damage, that is a toxic hazard.

It's a potential EPA nightmare.

Right.

And a severe health risk to residents.

Right.

Because the stakes are so high, these jobs require everything from the low tier, plus the additional insured endorsement, and usually much higher policy limits.

Like how high?

A common baseline board's demand is $1 million per occurrence for general liability. Though a community's insurance broker should really evaluate the specific property to set the exact number.

Right. Every property is different.

But I imagine if you're bringing in cranes or like re-roofing a massive 50-unit condo building, even a million dollar policy isn't going to cut it. Is there a higher tier for those massive undertakings?

There is.

That is the top tier. Capital projects.

Capital projects.

Yeah. Complete roof replacements, structural concrete restoration, repaving miles of private roads. For these, you need all the previous requirements, plus an umbrella policy and a formal written contract with indemnity clauses.

Okay, let's break those two terms down for the listener. What is an umbrella policy and why do we need indemnity?

Sure. Think of an umbrella policy as a financial safety net that sits on top of their regular insurance.

Like extra coverage.

Exactly. If a disaster wipes out their standard million dollar limit, say a structural collapse that injures several people, the umbrella policy kicks in to cover the millions of dollars beyond that.

Got it. And the indemnity clause.

An Indemnity Clause is a legal promise written into the vendor's contract. It basically says if the vendor messes up, violates a code, or causes a lawsuit, the vendor takes the financial hit and reimburses the association.

So it legally shifts the blame and the cost back to the party actually doing the work.

You know what stands out to me here is that this isn't about memorizing arbitrary bureaucratic rules from one specific state. We aren't reciting local municipal codes here.

No, not at all.

This is a universal common sense fiduciary duty. I mean, if you sit on a board or if you are a manager, your core job is to keep your community physically and financially safe.

That is the whole job.

Right. And these risk tiers are just a logical way to execute that duty without paralyzing the neighborhood's day-to-day maintenance.

It is a proportionate response to risk. You protect the homeowner's assets based on the actual threat level of the work being performed.

Okay, so all this paperwork sounds bulletproof in a vacuum.

Sure.

But communities aren't vacuums. They are run by volunteers who have day jobs. A new president comes in, the secretary moves away, people lose track of things.

Happens all the time.

How on earth do you enforce a three-tier risk system across dozens of vendors when the main filing cabinet is just someone's messy Yahoo email account?

And that right there is the breaking point for most communities. They know what they should do, but the administrative burden of tracking 50 different expiration dates is just impossible for a volunteer.

Which brings us to the software side of our research today. Because looking through the system specs for So Shiny, what's fascinating isn't just that it stores documents, but the actual mechanism of how it enforces these rules.

Yes.

It essentially replaces that frantic disorganized email hunt with a single source of truth.

The first feature to really understand is their vendor desk. Instead of keeping a W9 on a local hard drive, a license on a sticky note, and a COI buried in a former board member's inbox, the vendor desk holds one master digital roster.

And a W9, just for clarity for everyone listening, is the standard IRS tax form to prove they are a legitimate business entity, not just a guy getting paid under the table, right?

Correct. Every vendor has a single file containing their W9, their license, and their insurance documents. You upload it once, and the whole board can access it in seconds.

That alone sounds like a lifesaver.

It is. But simply storing a document is only half the battle. The real danger, as we discussed in the one and done trap, is the silent expiration.

Right, because nobody is sitting at their kitchen table manually checking a calendar every single day for 50 different vendor policies.

Human error is completely inevitable there. So Shiny addresses this with the built-in COI tracker.

Oh, nice.

It actively monitors the expiration dates of every single insurance policy on file. It records the date and sends automated warnings to the board 30 days before a policy runs out.

So it shifts the burden from proactive calendar checking to simply responding to an automated alert.

Exactly.

Now this is the part that I found most brilliant in the SoShiny specs. It's not just an alert system, it is an enforcement mechanism.

Yes, the enforcement is key.

In SoShiny, vendor approval is tied directly to the status of their document file. If a vendor has a missing W9 or if their insurance has expired, their status automatically changes to not cleared.

And that status creates a hard stop in the system. It creates a work order hold.

It's like a smart digital turnstile. Yeah. You can't even get on the property, digitally speaking, to start the job or get a check cut if your paperwork light is red.

Right. It physically stops the process.

I love the behavioral psychology of this because it takes the awkward personal conflict totally out of the equation.

It really does.

You don't have to be the bad guy telling the friendly local landscaper he can't work. The property manager can just say, hey, sorry, the software physically won't let us issue the work order or the payment until your agent emails the new COI.

That behavioral guardrail is critical. I mean, software doesn't make a vendor inherently honest, but it keeps the board from approving work in the dark. It prevents that well-meaning but incredibly dangerous moment where a board member says, Ah, we know him. Just go ahead and start the tree trimming. We'll get the paperwork next week. The system simply won't allow the workflow to proceed.

Let's project this forward a bit. We've talked about the daily operations, hiring the plumber, fixing the roof. But what happens two or three years down the line?

Okay, long-term stuff.

Yeah. Say a resident slips on a concrete walkway that a contractor improperly poured three years ago. The lawsuit arrives today. The board scrambles. The manager who handled that project retired and moved to Florida.

Right. This is where institutional memory becomes the literal lifeblood of a well-run association.

Institutional memory.

Yeah. When we talked about that crucial difference between being a certificate holder and having an additional insured endorsement, the ultimate challenge is proving you have the right one during the discovery phase of a lawsuit.

Oh, because if you can't find it.

If you can't produce that exact endorsement page, the insurance company will likely deny the claim.

And the research shows So Shiny handles this by storing the vital additional insured endorsement page right next to the COI in the vendor's file, maintaining a complete version history.

Exactly. So if an auditor, a defense lawyer, or you know, a new insurance broker is reviewing the files years later, they can instantly see exactly what coverage the association actually secured back when the job was done.

There is no guessing.

None. The institutional memory survives the turnover of the volunteers.

That level of record keeping also solves a massive issue regarding homeowner trust. I mean, owners get naturally suspicious when they feel like contracts are being awarded in the dark or they don't know who is walking around the property.

Transparency is a statutory requirement in most places, but honestly, it's also just good leadership.

Absolutely.

The software keeps all these records, the active contracts, the W9s, the bids that were submitted, ready to share. If an owner requests to see the contract and insurance for the new roof, the board doesn't have to spend a weekend digging through dusty boxes in a storage unit.

They can just click a button.

They can share it instantly or post it directly to a secure owner portal. It ensures total compliance and it builds enormous trust within the community.

So what does this all mean for you listening right now? We started this deep dive by talking about a worker falling off a roof.

Yeah, really grim scenario.

It's a heavy thought, but it is the reality of managing physical property. Vendor paperwork, these COIs, these licenses, these duty to defend endorsements. It is not a bureaucratic headache. Not at all. It is the literal armor protecting your community from financial ruin. It is the mechanism that ensures the physical safety of your neighbors by guaranteeing that only qualified, insured professionals are operating on your grounds.

It is the ultimate fulfillment of a board's duty to the people who live there. By implementing logical, common sense checks like the risk tiers, and by utilizing software to enforce those rules and remove human error, boards aren't just crossing their fingers and hoping for the best, they are actively managing risk.

Which brings us to a really fascinating and perhaps slightly chilling point to end on today.

Oh yeah.

We've spent this deep dive talking about how rigorous systems and digital turnstiles keep out the bad vendors, the ones with forged PDFs, expired policies, or hidden exclusions.

But think about this. If smart boards and managers are using these systems to constantly reject unlicensed, uninsured contractors, where do those vendors eventually go to find work?

Right. They don't just vanish.

They don't just close up shop and disappear. They go straight to the communities that don't check. Wow. They go to the soft target, still using the one and done method, relying on an old inbox and just hoping nothing goes wrong. So the ultimate question to leave you with today is are you absolutely sure your community isn't their next stop?

Next time we cover the snowbird phenomenon: having to deal with empty units, absentee owner requests, deliveries, and dealing with unit emergencies.

And don't forget, if this podcast helped you or your board, give us a thumbs up wherever you listen to this podcast.