The Nasdaq Stock Market LLC (“Nasdaq”) has filed with the Securities and Exchange Commission (“SEC”) a proposed rule change to require that Nasdaq-listed companies establish and maintain an internal audit function. The proposed rule would permit a listed company to outsource its internal audit function to a third-party service provider other than its independent auditor.

The proposed rule would also require the audit committee to:

  • meet periodically with the internal auditors (or other personnel responsible for this function); and
  • discuss the responsibilities, budget and staffing of the internal audit function with the outside auditor.

As proposed, the audit committee would have sole responsibility to oversee the internal audit function and would not be permitted to allocate or delegate this authority.

The proposed rule is intended to:

  • ensure that Nasdaq-listed companies have an established mechanism to regularly review and assess their system of internal control, identify weaknesses therein and develop appropriate remedial measures; and
  • provide management and audit committees of Nasdaq-listed companies with ongoing information about risk management processes and systems of internal control.

While many Nasdaq-listed companies have already established and implemented an internal audit function in order, among other things, to comply with obligations under federal securities law, including obligations to maintain and evaluate effective internal control over financial reporting, the proposed rules would mandate specific obligations for audit committees. Nasdaq-listed companies should take this opportunity to review and consider their internal audit function, the audit committee’s role in overseeing that function and related provisions in the audit committee’s charter.

The New York Stock Exchange already has a similar requirement for listed companies.

If the proposed rule is approved by the SEC, companies listed on Nasdaq before June 30, 2013 that do not currently have an internal audit function would have until December 31, 2013 to establish one, and companies listed after June 30, 2013 will be required to establish the internal audit function prior to listing.