Proposed NASDAQ Rule Requires Internal Audit Function at Listed Companies

Boris Feldman is a member of Wilson Sonsini Goodrich & Rosati, P.C. This post is based on a WSGR alert.

The NASDAQ Stock Market LLC (Nasdaq) recently filed with the Securities and Exchange Commission (SEC) a proposed rule [1] requiring listed companies to establish and maintain an internal audit function. [2] The SEC is soliciting comments on the proposed rule through March 29, 2013. [3]

Under the proposed rule, the internal audit function would be required to provide management and the audit committee with ongoing assessments of the company’s risk management processes and system of internal control. In addition, new Rule 5645 would require the audit committee to:

  • meet periodically with the company’s internal auditors (or other personnel responsible for this function); and
  • discuss with the outside auditors the responsibilities, budget, and staffing of the company’s internal audit function.

Companies would be permitted to outsource their internal audit function to a third-party service provider other than their independent auditor. For companies that choose to outsource this function, Nasdaq has stated that the company’s audit committee maintains sole responsibility to oversee the internal audit function and may not allocate or delegate this responsibility to another board committee.

According to Nasdaq, the proposed rule is designed to:

  • ensure that each listed company has a mechanism in place to review and assess its system of internal control on a regular basis and, in so doing, to identify weaknesses and develop appropriate remedial measures;
  • make sure that the listed company’s management and audit committee are provided with ongoing information about the company’s risk management processes and the system of internal control; and
  • assist companies in complying with their federal securities law obligations, including the certification requirements of Rule 13a-14 and Rule 15d-14 under the Securities Exchange Act of 1934.

If approved by the SEC, companies listed on Nasdaq before June 30, 2013, would have until December 31, 2013, to establish an internal audit function. Companies listed after June 30, 2013, would be required to establish an internal audit function prior to listing.

As a matter of best practices, many larger Nasdaq-listed companies already maintain an internal audit function meeting the requirements of the proposed rule. Companies without an internal audit function should immediately begin planning to implement one before the end of 2013, while those with an internal audit function should review their existing policies and procedures to ensure that they comply with the proposed rule.


[1] The proposed rule is available at
(go back)

[2] Companies listed on the New York Stock Exchange are already subject to a similar rule. See Listed Company Manual Section 303A.07(c), available at
(go back)

[3] See SEC Release No. 34-69030; File No. SR-NASDAQ-2013-32, available at
(go back)

Both comments and trackbacks are currently closed.