Nasdaq Proposes Rule Requiring Internal Audit Function at All Listed Companies

The NASDAQ Stock Market LLC (“Nasdaq”) has proposed a rule that would require all listed companies to establish and maintain an internal audit function no later than December 31, 2013. Under this proposed Rule 5645, the internal audit function would be required to regularly review and assess the company’s internal controls, identify weaknesses and develop appropriate remedial measures, as well as provide management and the audit committee with ongoing information about the company’s risk management processes. The rule being proposed by Nasdaq is substantially similar to the rule already adopted by the New York Stock Exchange (“NYSE”) in 2003, which requires all NYSE-listed companies to have an internal audit function.

The proposed Nasdaq rule permits companies to choose to outsource the internal audit function to third-party service providers other than their independent auditors. However, the audit committee would retain sole responsibility to oversee the internal audit function and would not be permitted to allocate or delegate its responsibility to another board committee. The company’s audit committee would be required to meet periodically with the internal auditors or other personnel responsible for the internal audit function and must also consult the company’s outside auditors to discuss the responsibilities, budget and staffing of the internal audit function.

Under the proposed rule, companies listed on or before June 30, 2013 will be required to establish an internal audit function by December 31, 2013. However, companies seeking to list on Nasdaq after June 30, 2013, including in connection with an IPO, must have internal audit functions in place prior to such listing. The proposed Nasdaq rule does not make any distinctions between the various Nasdaq markets, such as the NASDAQ Capital Market, which typically includes smaller issuers. The proposed rule also does not provide any exemption or relief from the internal audit requirement for listed companies that are “Emerging Growth Companies” as defined in the Jumpstart Our Business Startups Act of 2012.

We recommend that Nasdaq-listed companies that already have an internal audit function compare their existing policies for compliance with the proposed rule, and those without an internal audit function are encouraged to begin planning to implement one before year-end. In addition, companies contemplating an IPO or other Nasdaq listing in 2013 should pay particular attention to the respective deadlines for implementing an internal audit function given the significant timing differences if the listing occurs before or after June 30, 2013. For example, if a company lists on Nasdaq on or before June 30, 2013, that company would have until December 31, 2013 to establish an internal audit function, however, a company that lists on Nasdaq a day later would be required by the proposed rule to have its internal audit function in place at the time of listing.

Nasdaq filed the proposed rule with the U.S. Securities and Exchange Commission (“SEC”) on February 20, 2013, and the SEC is seeking public comments on the proposed change through March 29, 2013. It remains to be seen what form the rule will take, if and when the final rule is released.