A lender or OEM audit
Finance partners ask for your written information security program.
Industries / Auto dealers, repair & body shops
For dealerships, repair shops and body shops
Safeguards, Buyers Guides, refrigerant and used oil, checked in one place.
Upload your information security program, sales procedures and shop safety manual. We check them against the FTC, IRS, EPA and OSHA rules for the work you do, quoting your document wherever it addresses a rule.
When owners use it
The moments your paperwork gets asked for.
Adding financing
The FTC Safeguards and Red Flags Rules apply once you arrange credit.
Insurance renewal
Carriers want lockout/tagout, lift and chemical safety programs in writing.
What we check
The rules your documents are checked against.
From the Automotive Dealers, Repair & Body Shops rule pack. Each finding names the rule it's measured against and, where your document addresses it, quotes your words, checked word for word.
- FTC Safeguards Rule information security program16 CFR Part 314 (314.4, 314.6)
- Notify the FTC of customer data breaches16 CFR 314.4(j)
- Identity theft prevention program (Red Flags Rule)16 CFR 681.1
- Adverse action notices on credit decisions12 CFR 1002.9 (ECOA / Regulation B); 15 U.S.C. 1681m (FCRA)
- Holder Rule notice in consumer credit contracts16 CFR Part 433
- Used car Buyers Guide on every used vehicle16 CFR Part 455
- Odometer disclosure and records49 CFR Part 580 (580.5, 580.8)
- Reporting cash payments over $10,000 (IRS Form 8300)26 U.S.C. 6050I; 26 CFR 1.6050I-1
- Vehicle air conditioning refrigerant certification (EPA Section 609)40 CFR 82.34; 40 CFR 82.42
- Used oil and shop waste handling40 CFR 279.22; 40 CFR 262.11
- Auto body spray painting rules (EPA 6H)40 CFR Part 63 Subpart HHHHHH
- Lockout/tagout (control of hazardous energy)29 CFR 1910.147
- Respiratory protection program29 CFR 1910.134
Plus the basics every employer needs (13 rules)
- OSHA "Job Safety and Health – It's the Law" poster29 CFR 1903.2
- OSHA injury and illness records (Forms 300, 300A, 301)29 CFR Part 1904
- Reporting severe injuries and deaths to OSHA29 CFR 1904.39
- Hazard Communication program29 CFR 1910.1200 (construction: 29 CFR 1926.59)
- Form I-9 employment eligibility verification8 U.S.C. 1324a; 8 CFR 274a.2
- Wage and hour records and minimum wage poster29 CFR Part 516 (poster: 29 CFR 516.4)
- Equal employment opportunity: "Know Your Rights" poster42 U.S.C. 2000e; 29 CFR 1601.30
- Written anti-harassment and complaint procedureEEOC Enforcement Guidance on Harassment in the Workplace (2024)
- Family and Medical Leave Act notices29 CFR 825.300
- EEO-1 Component 1 annual report29 CFR 1602.7
- Workers' compensation insuranceState workers' compensation law (varies by state)
- Business licenses and permits kept currentState and local licensing law (varies)
- General liability insurance kept currentContract / licensing requirement (varies)
Rules for work you don't do (financing, used car sales, painting) are left out. Colorado dealer licensing and state environmental permits aren't in the pack yet.
Deep checks
Go point by point on one topic.
A deep check reads all of your documents against one topic the way an inspector would go down a checklist, and marks each point met, partial or missing. Topics for this industry:
Vehicle sales, finance and shop environmental rulesFTC Safeguards RuleLockout/tagoutRespiratory protectionHazard communicationForkliftsLadders
Deep checks come with the One-Time Report and the monthly plans.
What to upload
Start with the documents you already have.
- Information security program (Safeguards Rule)
- Identity theft (Red Flags) program
- Sales and F&I procedures
- Shop safety manual
PDF, Word or plain text. Please don't upload personnel files, patient records or anything with Social Security numbers: the check only needs your policies and programs.
Compliance information and organizing tools, not legal advice. Have your safety or HR person confirm the findings that matter most.
Other industries