TheCorporateCounsel.net

Yesterday, the SEC issued notice of a proposed NYSE rule change that, if approved, will extend the transition period in which a listed company must establish an internal audit function. Currently, companies listing in connection with an IPO, carve-out or spin-off transaction have a one-year transition period to establish an internal audit function. The proposal would change that to 5 years. Here’s some color on why the NYSE is proposing this change:

Section 303A.07(c) of the Manual states that each company listed on the Exchange must have an internal audit function. The purpose of the internal audit function is to provide an issuer’s management and audit committee with ongoing assessments of the issuer’s risk management processes and system of internal controls. The function may be outsourced to a third-party service provider other than an issuer’s independent auditor.

Like other elements of the Exchange’s corporate governance rules, Sections 303A.00 and 303A.07 provide a transition period for certain issuers to become compliant with the internal audit function.3 Pursuant to Section 303A.07 issuers must have an internal audit function in place no later than the first anniversary of their listing date. Over time, issuers have expressed concern that developing a capable internal audit function within the first year of listing presents challenges as issuers adjust to life as a newly public company. Accordingly, the Exchange is proposing to extend the transition period to implement an internal audit function from one year to five years.

In expressing concern over the current one-year compliance period, issuers often cite competing business and regulatory obligations requiring management’s attention and the challenges of building an internal audit function to assess a company’s internal control environment while a company is still in its early stages and continuing to grow. The Exchange continues to believe that having a robust internal audit function is a key component of sound corporate governance, but agrees that providing issuers with additional time to develop such function will result in a more effective function.

In this regard, the Exchange notes that newly public companies are typically in the process of upgrading their accounting systems and internal controls and hiring additional staff to meet the greater demands placed on public companies. Given the oversight role of directors — and members of the Audit Committee, in particular — with respect to risk management and internal controls, the Exchange believes it is appropriate to extend the transition period for compliance in order to provide a new slate of directors with sufficient time to assess an issuer’s operations to help design a valuable internal audit function.

NYSE believes that other listing requirements will provide assurance that companies are sufficiently managing risk during the 5-year transition period. For example, companies must have an Audit Committee that receives an annual report from the company’s independent auditor describing internal quality control procedures, and the Sarbanes-Oxley Act requires assessments and (for some companies) attestations of the effectiveness of internal controls, as well as CEO and CFO certifications. NYSE says that SOX was adopted after the exchange had adopted its internal audit requirement – and because the internal audit requirement can now be viewed as a supplement to the statutory protections, a longer phase-in period shouldn’t raise investor protection concerns. NYSE also contends that its proposal to extend the transition period shouldn’t raise concern because Nasdaq doesn’t require listed companies to maintain an internal audit function at all.

Interested persons are invited to submit comments. To do that electronically, use the Commission’s internet comment form or send an email to rule-comments@sec.gov (include file number SR-NYSE-2026-37 on the subject line).

– Liz Dunshee