On March 4, 2013, Nasdaq issued a proposed new rule that, if approved by the Securities and Exchange Commission ("SEC"), will require listed companies to establish and maintain an internal audit function. The proposed rule is open for public comment until 21 days after publication in the Federal Register, but it is expected to be approved by the SEC. It would make this Nasdaq listing requirement similar to that of the NYSE, which already has an internal audit function requirement.
By requiring an internal audit function, Nasdaq seeks to ensure that a company's management and audit committee receive ongoing assessments of the company's risk management processes and system of internal control that are provided independently from the company's routine accounting and financial reporting regimes. A company will be allowed to outsource the internal audit function to any third party (other than its independent auditor), but the audit committee must maintain sole responsibility for oversight, and it may not allocate or delegate that responsibility to another board committee.
The proposed rule does not prescribe many other specifics for the implementation of an internal audit function, and it does not indicate how Nasdaq will assess compliance with the requirement, beyond certain matters implicit in Nasdaq's statement of the audit committee's oversight responsibility. That statement makes clear that the audit committee will be expected to arrange periodic meetings with the personnel engaged in the internal audit function (whether they are company employees or personnel of an outsource provider) and with the company's independent auditors, as a way to ensure both (a) receipt of the types of assessments the rule is targeting and (b) more generally, that the assigned responsibilities, budget, staffing and other aspects of the internal audit function are adequate for it to be effective.
The proposed rule seems unlikely to impose substantial additional effort on most issuers, and Nasdaq noted that many of its listed companies already have an internal audit function. However, there are no special...