Companies that wish to avoid the SEC’s crosshairs would do well to mind established rules and internal controls.