Final checklist

Everything the ten lessons asked you to have in place, on one page, grouped by lesson: liability, contracts, consumer law, marketing, your website and data, staff, demand letters, lawsuits and the compliance habit. Work through it once now, and again each time something in the business changes. Each heading links back to the lesson that explains the item.

• Lesson 1: How your business is exposed

  • You know whether your entity separates business debts from personal ones, and where the holes are (guarantees, your own conduct).
  • You have read the exclusions in every insurance policy and asked your broker in writing what is covered.
  • You know to notify the insurer the day any claim arrives.

• Lesson 2: Contracts that hold up

  • Every agreement you rely on is in writing and the signed version is stored with its date.
  • Your contracts have payment, termination, limitation of liability, indemnity and dispute resolution clauses you have actually read.
  • Your standard terms are accepted by customers before purchase and the acceptance record is kept.

• Lesson 3: Customers and consumer law

  • Every factual marketing claim has substantiation on file.
  • Your refund policy is disclosed before sale and followed as written.
  • Auto-renewals are disclosed, affirmatively accepted and cancellable as easily as they were started.
  • Reviews and testimonials are honest, not incentivized for positivity, and connections are disclosed.

• Lesson 4: Marketing calls, texts and email

  • Marketing calls or texts go only to numbers with prior express written consent naming your business, kept per number.
  • Lists are scrubbed against the National Do Not Call Registry with a version under 31 days old before every campaign.
  • STOP and do-not-call requests go onto your internal list the same day.
  • Calls run 8am to 9pm in the called party’s local time, tighter where states require.
  • Email carries a physical address and a working opt-out honored within ten business days.

• Lesson 5: Your website and customer data

  • Your website has been checked for accessibility and a remediation plan exists for anything found.
  • Your privacy policy describes what your site actually collects and shares.
  • No biometric data is collected from anyone in Illinois without written consent and a retention policy.
  • You know which state’s breach law applies to your customers and who to call if a breach happens.

• Lesson 6: Employees and contractors

  • Every worker has been classified using the control and economic reality tests, not by preference.
  • Non-exempt staff, including salaried ones, have accurate time records.
  • Employees have offer letters; contractors have agreements with scope, control and an IP assignment.

• Lesson 7: When a demand letter arrives

  • Staff know that a demand letter triggers preservation: no deletion, no commentary, no calls to the sender.
  • You have a short written response pattern: confirm receipt, request evidence, brief position, extension, reserve rights.

• Lesson 8: The TCPA demand letter

  • You can reconcile any listed call against your logs and consent records within a day.
  • You know the arithmetic: $500 to $1,500 per call, four years back, Florida stacked.

• Lesson 9: Being sued

  • Your registered agent address is current and mail there is read the same day.
  • You know the answer deadline is on the summons and that an entity usually needs a lawyer to appear.

• Lesson 10: Fixing it so it does not happen again

  • One named person owns the compliance calendar.
  • Every vendor contract has a compliance warranty, records access, an audit right and an indemnity.
  • Automatic deletion is off on every system holding consent, call, contract, payroll or policy records.