Guide to Sarbanes-Oxley Act Compliance

Obtain a summary of SOX requirements

If you're a corporation, you need to know the details of Sarbanes-Oxley and you must bring yourself into compliance. Several Web sites, including the federal government's Securities and Exchange Commission, list the requirements

I recommend: Check out these sites for a summary of what you must do to comply: SWLearning, SoxLaw.com, the SEC SoxAct page

Get help from your audit firm

The company that audits your business can advise you on how to comply and how to keep proper records that comply with Sarbanes-Oxley regulations.

I recommend: The American Institute of Certified Public Accountants lists ways your CPA firm can help you get on the right side of the regulations.

Set up a whistle-blower policy

Sarbanes-Oxley requires you to establish a whistleblower policy that protects the whistleblower from retaliation. Common policies include sections on confidentiality and handling of reported violations, usually to a member of the audit committee.

I recommend: Find a sample whistler-blower policy that you can tailor to your company from the National Council of Nonprofit Associations.

Follow document retention requirements

One of the key components of SOX is retention of records for a certain period of time. The best way to do this is set up a record retention policy that complies with the act and generally accepted accounting principles.

I recommend: Download a sample record retention policy from the American Bar Association, make sure you're in compliance with SOX and other state and federal regulations on record retention by checking a table from this QuickBooks site, and find a list of questions to ask when setting up a retention policy from the Web site of law firm Holme Roberts & Owen.

Use special software programs

From helping you set up internal controls to testing and managing databases, software can help you comply with the Sarbanes-Oxley Act.

I recommend: You can get SOX software from Expensewatch.com and Quask.

Set up an audit committee

You must set up an audit committee and designate responsibilities to certain members. SOX mandates that certain committee members have specific financial certifications.

I recommend: This CPA Journal guide tells you how to set up an audit committee that meets requirements, as does this Securities & Exchange Commission guide. The Institute of Internal Auditors provides a sample audit committee charter.

Publicly traded companies have additional SOX responsibilities

If you're a publicly traded company, senior management must certify the integrity of your financial statements. You are also subject to audits of your internal controls and limitations on personal loans to executive officers or directors.

I recommend: For a list of the additional responsibilities of a publicly traded company, click on the University of West Georgia guide and this CPEOnline primer.