NYSE internal audit requirement: Why a five-year delay is too long

Last week, I wrote about a proposed NYSE rule change that would let newly listed companies wait five years before establishing an internal audit function. That proposal is now in front of the SEC, and the public comment period closes Sept. 8. I am writing here because this issue reaches well beyond internal auditors. It touches external auditors, CFOs, audit committee members and anyone who relies on the integrity of a newly public company's financial reporting and controls.

Here is the background: Under current New York Stock Exchange rules, companies subject to the applicable transition provisions generally must have an internal audit function in place within one year of listing. The NYSE is proposing to extend that transition period to five years for qualifying newly listed companies. The exchange filed this proposal with the SEC under File No. SR-NYSE-2026-37.

The NYSE outlines many arguments for extending the deadline, but this is also a competitive issue. Nasdaq does not require internal audit at all, and the NYSE's rule likely puts it at a disadvantage when courting new listings. I understand the business logic. Exchanges compete for listings, and every requirement carries a cost. But solving that competitive problem by weakening a governance safeguard is the wrong trade. It may close the gap with Nasdaq. But it lowers the floor for everyone.

Consider what happens in a company's first five years as a public entity. Growth is often rapid and uneven. Governance structures are still forming. Management teams are learning to operate under public company scrutiny for the first time. Risks tied to artificial intelligence, cybersecurity and third parties are evolving faster than most boards can track. This is exactly the period when a company needs independent assurance the most, not five years from now once bad habits and control gaps have had time to take root.

I know the counterargument. Newly public companies already have audit committees, external auditors and Sarbanes-Oxley Section 404 requirements. Those are real safeguards, and I do not dismiss them. But they do not do what internal audit does. External auditors provide independent assurance on financial statements and, for applicable issuers, internal control over financial reporting. Internal audit provides assurance and advice across the full range of enterprise risk, including fraud, culture, third-party relationships and operational controls that never show up in a financial statement audit. Audit committees depend on internal audit as their eyes and ears inside the organization between meetings. Remove that function for five years, and you remove a resource audit committees need most in a company's most volatile early period.

We have had this debate before. In 2013, Nasdaq proposed requiring listed companies to establish an internal audit function. As the IIA's president and CEO at the time, I publicly applauded the action. However, the proposal drew opposition from companies that argued internal audit would impose additional costs and duplicate existing Sarbanes-Oxley controls. Nasdaq ultimately withdrew the proposal. 

For CFOs and audit committee members, the practical risk is straightforward. Building an internal audit function takes time, whether you hire in-house or co-source with an outside provider. You need to select an internal audit delivery model, define a charter, build a risk-based audit plan and establish reporting lines to the audit committee. None of that happens overnight. If the rule changes to five years, do not assume you have five years to start planning. From my experience, the companies best positioned after an IPO are the ones that treat internal audit as part of their public company readiness plan from day one, not as a deferred obligation they can revisit later.

For external auditors, a weaker internal audit presence at newly public clients means less coordination on risk coverage and testing, and it can widen the assurance gaps your own audit has to fill. You may also face greater expectations to understand risks and controls that a robust internal audit function would otherwise be examining, even though those areas may fall outside the scope of the financial statement audit. For internal auditors already at NYSE-listed companies, this proposal sets a precedent. If governance requirements can be rolled back for competitive reasons once, they can be rolled back in the future if an exchange is feeling competitive heat.

This is why your voice matters right now. The comment period closes Sept. 8, 2026. You can submit a comment electronically through the SEC's internet comment form at sec.gov/rules/sro.shtml, or by emailing rule-comments@sec.gov with "SR-NYSE-2026-37" in the subject line. Paper comments can be mailed in triplicate to the Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090. Reference File No. SR-NYSE-2026-37 in whatever method you choose.

Newly public companies deserve strong governance from the start, not five years from now. If you agree, tell the SEC before Sept. 8.