What companies need to do for SOX implementation