1. Be mindful of deadlines. Smaller public companies should be prepared to issue their first report on internal controls by July 2006. Private companies considering going public, or gearing up for a merger or acquisition, should create a timetable for implementing the new rules.
  2. Beware of one-size-fits-all auditors. If your accountant wants to use a check-the-box approach, find another accountant. Regulators have made it clear that small public companies need not be treated like large ones. Don't let anyone tell you otherwise.
  3. Comply with the law's inexpensive provisions as soon as possible. Not all of the Sarbanes-Oxley requirements are costly. Private companies may be able to gain a competitive advantage by complying with pieces of them--such as adding an independent board member or requiring chief executives to certify financial statements. If you later choose to sell the business, these moves may allow you to command a higher price.
  4. New software may help--but shop around. Sarbanes- Oxley applications abound from all the major software players and a host of smaller ones. For big companies, they're pretty much required to keep tabs on multiple operations in scores of locations. For smaller businesses, an Excel spreadsheet may still do the trick at lesser cost--at least until the prices on compliance software drop.
  5. Watch out for follow-on regulations. Whether you run a public or a private company, know what your state's requirements are and whether they apply to you. And when you go for a bank loan or apply for insurance, check the small print for Sarbanes-Oxley-inspired provisions.