The proposed rule would permit a listed company to outsource this function to a third-party service provider other than its independent auditor. However, the release states that the audit committee must have sole responsibility to oversee the internal audit function and would not be permitted to allocate or delegate this responsibility to another board committee. The proposed rule would also require the audit committee to:

  • meet periodically with the internal auditors (or other personnel responsible for this function); and
  • discuss with the outside auditors the responsibilities, budget and staffing of the internal audit function.  

The proposed rule is intended to:

  • ensure that each Nasdaq-listed company has an established mechanism to review and assess its internal controls on a regular basis and, in turn, to identify weaknesses and develop appropriate remedial measures; and
  • provide management and the audit committee with ongoing information about risk management processes and the system of internal control.  

If the proposed rule is approved by the SEC, companies listed on the exchange before June 30, 2013 would have until the end of 2013 to establish the required internal audit function, and companies listed after June 30 would be required to establish the internal audit function prior to listing. Comments on the proposal are due by March 29, 2013.