Every product on your shelves arrives with someone else's risk attached. A supplier's defective product can put your store in a lawsuit, a recall can leave you pulling stock and answering customers, a key vendor's fire or bankruptcy can empty your shelves for a season, and a fraudulent "new bank details" email can send a payment to a criminal. Vendor and supplier risk management is the discipline of choosing suppliers carefully, putting the right terms in writing and knowing which insurance responds when a supplier lets you down.
This guide is written for retailers and wholesalers of any size. Insurance forms and endorsements vary by carrier, so treat it as a framework for reviewing your own contracts and policies with a broker.
Where supplier risk shows up
| Risk | What it looks like | What helps |
|---|---|---|
| Product liability | A customer is hurt by a product you sold and sues everyone in the chain of distribution, including you | Supplier insurance, a vendors endorsement naming you, written indemnity |
| Product safety and recalls | A supplier's product is found to be hazardous and must be pulled from shelves | Recall clauses, lot tracking, a reporting procedure |
| Supply interruption | A key supplier's plant, warehouse or carrier is shut down and you cannot get stock | Backup suppliers, safety stock, dependent property coverage |
| Supplier financial failure | A vendor goes out of business owing you credits, warranty support or undelivered orders | Financial checks, deposit limits, diversification |
| Payment fraud | A fake or compromised vendor email asks you to change bank details before a large invoice | Call-back verification, dual approval, crime coverage |
| Vendors on your premises | A merchandiser, delivery driver or installer is hurt or damages property at your store | Certificates of insurance, additional insured status, site rules |
| System access | A point-of-sale, inventory or IT vendor has remote access to your network | Security review, least-privilege access, contract terms |
Vet suppliers before you buy
The best time to manage supplier risk is before the first purchase order. Scale the review to the size of the relationship and the hazard of the product: a supplier of children's products, electrical goods, food or private-label merchandise deserves more scrutiny than a supplier of paper bags.
- Confirm who they are. Verify the legal business name, address, tax ID and banking details independently, not only from the documents the supplier sends.
- Ask about product safety. Request test reports or certificates for products that are subject to safety standards, and ask how the supplier tracks lots and handles complaints.
- Check their insurance. Ask for a certificate showing products-completed operations coverage with adequate limits, and confirm the insurer and policy dates. See our guide to certificates of insurance.
- Look at financial stability. For important suppliers, review trade references, credit reports or financial statements, and watch for late shipments or sudden changes in terms.
- Know where products come from. If the supplier is an importer or a foreign manufacturer, find out who in the United States stands behind the product, because a claimant may have trouble reaching a foreign company and turn to the retailer instead.
- Map single points of failure. Identify any product line that depends on one supplier, one plant or one shipping route.
Put it in the contract
A supplier agreement or vendor terms document is where you allocate risk. Purchase orders alone often say little about insurance or indemnity. Have an attorney review the terms, and send the insurance sections to your broker before you sign. Common provisions include:
- Indemnity. The supplier agrees to defend and indemnify you for claims arising from its products, except to the extent caused by your own conduct.
- Insurance requirements. Minimum general liability limits including products-completed operations, often with an umbrella, plus the duty to keep coverage in force and give notice of cancellation.
- Additional insured status. The supplier names you as an additional insured on its liability policy, usually through a vendors endorsement.
- Primary and noncontributory, waiver of subrogation. The supplier's policy responds before yours, and its insurer agrees not to pursue you after paying a claim.
- Recall cooperation. Who decides on a recall, who pays to remove and dispose of product, who reimburses refunds, and how quickly you will be told.
- Quality and compliance warranties. The supplier warrants that products meet applicable laws and safety standards.
Watch for the reverse as well. Some large suppliers and distributors send terms that ask you to indemnify them. Contractual liability is excluded under a standard general liability policy except for liability you assume in an "insured contract," so whether a promise you make is insured depends on how it is written and on your policy's definitions. Our article on additional insured endorsements explains how these pieces fit together.
What a vendors endorsement does and does not do
The standard ISO Additional Insured – Vendors endorsement (CG 20 15) is added to a manufacturer's or supplier's general liability policy. It makes a named vendor an additional insured, but only for bodily injury or property damage arising out of the supplier's products that the vendor distributes or sells in the regular course of its business. It is valuable protection for a retailer, and it has limits that matter in practice. The standard form excludes coverage for the vendor in situations such as:
Changing the product
Physical or chemical changes the vendor makes on purpose, and repackaging, except unpacking for inspection, demonstration or testing and repacking in the original container.
Relabeling
Products labeled or relabeled by or for the vendor, or used as a part or ingredient of another product. This is a key issue for private-label programs.
Your own promises
Express warranties the supplier did not authorize, and liability the vendor assumes by contract beyond what it would have anyway.
Your own work
Demonstration, installation, servicing or repair away from the vendor's premises, inspections or tests the vendor agreed to do but did not, and injury arising solely from the vendor's own negligence.
Private label and in-store work need extra attention. If you sell products under your own brand, assemble or install what you sell, or let staff demonstrate products, the standard vendors endorsement may not respond to those claims. Your own products liability coverage and how your general liability policy treats products you sell become more important. Some suppliers use broader manuscript vendor endorsements, so read the one you are actually given.
Product safety, recalls and the duty to report
Retailers have their own obligations when a product may be hazardous. Under Section 15 of the Consumer Product Safety Act, the U.S. Consumer Product Safety Commission (CPSC) says manufacturers, importers, distributors and retailers of consumer products must report to the agency within 24 hours of obtaining reportable information. Reportable information includes a defect that could create a substantial risk of injury, an unreasonable risk of serious injury or death, or a failure to comply with an applicable safety rule or standard. An injury does not have to occur first. CPSC states that failure to report fully and immediately can lead to substantial civil or criminal penalties, and its staff advise, "when in doubt, report." A company need not report if it has actual knowledge that CPSC has already been adequately informed, but it should document that.
- Name one person responsible for receiving product complaints and deciding whether to escalate.
- Log customer complaints, returns and injury reports by product and lot so patterns become visible.
- Keep purchase and lot records that let you identify which stores and customers received a product.
- Agree with suppliers, in writing, on how recall notices will reach you and who pays which costs.
Expect most recall costs to fall outside your general liability policy. The standard commercial general liability form excludes the cost of recalling products, work or impaired property. Separate product recall or contamination coverage exists for businesses with that exposure, and food and private-label sellers in particular should ask about it.
Supply interruptions and dependent properties
If a key supplier's warehouse burns down, your store is undamaged but you may still lose sales. Standard business income coverage responds to damage at your own premises. Dependent properties coverage, sometimes called contingent business interruption, is time element property insurance that pays for lost income or added expenses when a covered cause of loss damages a business you rely on, such as a key supplier or customer. It is often written with a modest sublimit, may apply only to listed dependent properties and usually requires the same kind of physical damage your own property coverage would require. Supplier insolvency, labor disputes and shipping delays without physical damage are generally not covered.
Operational steps reduce what insurance has to carry: qualify a second source for your most important lines, hold safety stock of high-margin or seasonal goods, and know how long you could sell without a given supplier.
Payments, data and vendors on site
Payment changes. Vendor payment fraud usually starts with an email that appears to come from a real supplier asking you to update bank details. Verify every change by calling a known number from your vendor file, never the number in the email, and require a second approver for new or changed payment instructions. Our article on business email compromise walks through the controls. Many commercial crime policies cover this kind of loss only through a social engineering fraud endorsement, often with a sublimit and verification conditions, so check yours.
System access. Point-of-sale, e-commerce, inventory and IT providers often have remote access to your systems. Limit their access to what they need, require multi-factor authentication and review their security practices. Our vendor security assessment guide covers questionnaires and contract terms.
On-site vendors. Merchandisers, delivery crews, cleaning and installation contractors should carry their own general liability, auto and workers' compensation coverage and name you as an additional insured where your agreement requires it. Set site rules for ladders, pallets and back-room traffic. See contractor management for a collection checklist.
What insurance typically responds, and where the gaps are
| Situation | Coverage that may respond | Common gap |
|---|---|---|
| Customer injured by a product you sold | Supplier's policy through a vendors endorsement; your general liability (products-completed operations) | Relabeled, altered or private-label products; supplier limits too low or coverage lapsed |
| Recall of a supplier's product | Product recall coverage, if purchased; supplier's contractual obligations | General liability recall exclusion |
| Key supplier shut down by fire | Dependent properties business income | Low sublimits; no coverage without physical damage |
| Payment sent to a fraudster | Crime policy social engineering endorsement; some cyber policies | No endorsement, or a small sublimit |
| Vendor's employee hurt at your store | Vendor's workers' compensation; your general liability if you are sued | Vendor uninsured or no additional insured status for you |
When to call your broker
Call us before you sign a significant supplier or distribution agreement, launch a private-label line, start importing directly, add assembly or installation services, or rely on a single source for an important product line. We can review supplier certificates and endorsements, check how your own retail insurance program treats products and recalls, and look at dependent property and crime limits. As a broker, we compare options across the market and shape coverage around how your business buys and sells.
Sources
- U.S. Consumer Product Safety Commission — Duty to Report to CPSC: Rights and Responsibilities of Businesses
- ISO form CG 20 15 — Additional Insured – Vendors (specimen copy)
- Argo Group — The CG 00 01 Form Decoded
- IRMI — Contractual Liability and the CGL Policy
- IRMI — Dependent properties time element coverage (definition)