NASDAQ Withdraws Proposed Internal Audit Function Rule with Intent to Resubmit It

Guide to Mergers & Acquisitions FAQ
NASDAQ Withdraws Proposed Internal Audit Function Rule with Intent to Resubmit It

May 15, 2013

Three months ago, the National Association of Securities Dealers (NASDAQ) proposed a new rule to require listed companies to have an internal audit function1 In withdrawing the proposed rule for now, the NASDAQ also sent a message. The rule update states that the NASDAQ remains committed to the highest standards of corporate governance and believes it is important that listed companies have appropriate mechanisms and processes in place to review risks and the system of internal controls. Therefore, it stated its intent to revise the proposed rule, taking into account the comments received, and resubmit it. No time frame was provided for a resubmission. For those interested in reading it, the NASDAQ rule update may be found at In light of the breadth and nature of the comments from its issuer community and other stakeholders, the NASDAQ has determined to withdraw its proposal so that it may adequately consider these comments. http://nasdaq.cchwallstreet.com/nasdaq/pdf/nasdaqissalerts/ 2013/2013-003.pdf.

What does this latest action mean? As we reported in a prior Flash Report, the Securities and Exchange Commission (SEC) had previously extended the 45-day time period for it to act on the proposed rule change2 Many commenters reported that overall compliance costs were significant in relation to their revenue base, and that this proposal added further burden that was unnecessary. Other commenters expressed concern with the requirement to provide management and the audit committee with an ongoing assessment of the company's risk management process and system of internal controls, viewing it as an inflexible one-size-fits-all approach that must be applied regardless of the complexities of the business. Still others asserted that an internal audit function was not even needed if the business was not particularly complex, e.g., low volume of transactions, and management could apply entity-level controls to ascertain that risks were being managed and internal controls were functioning effectively. Given the resistance to the rule in many of the comment letters, the SEC concluded a longer period of time was necessary to take action on the proposed rule change so that it had sufficient time to consider the NASDAQ’s proposal as well as the comments received. The comment letters on the proposed rule indicated a variety of concerns, with cost being the predominate one.

Many commenters reported that overall compliance costs were significant in relation to their revenue base, and that this proposal added further burden that was unnecessary. Other commenters expressed concern with the requirement to provide management and the audit committee with an ongoing assessment of the company's risk management process and system of internal controls, viewing it as an inflexible one-size-fits-all approach that must be applied regardless of the complexities of the business. Still others asserted that an internal audit function was not even needed if the business was not particularly complex, e.g., low volume of transactions, and management could apply entity-level controls to ascertain that risks were being managed and internal controls were functioning effectively.

1See Protiviti’s SEC Flash Report, “SEC Seeks Comment on NASDAQ Proposed Rule Requiring Listed Companies to Have an Internal Audit Function,” March 11, 2013, available at www.protiviti.com. This Flash Report outlines the specifics of the proposal.

2See Protiviti’s SEC Flash Report, “SEC Extends Comment Period on NASDAQ Proposed Internal Audit Function Rule,” April 25, 2013, available at www.protiviti.com.

In this debate, it is clear that the board of directors has an important voice. The question is, “Does the board have the information it needs from an objective and competent source regarding the organization’s risk management processes and internal controls?” While management’s views are very important, the board has a deciding vote on this question and must weigh in on the matter on an individual company basis.

The above all said, clearly the NASDAQ has stated its intention to resubmit the proposal. If we were to read the tea leaves a bit, it is possible the NASDAQ might consider the following in reshaping a new proposal:

  • Provide a threshold to focus on larger, more established companies. Thus, companies with a small revenue base, companies qualifying as “emerging growth companies” and companies below a so-called “microcap” threshold might be exempted.
  • Make the reporting requirement more flexible. The proposed rule required internal audit to provide management and the audit committee with an ongoing assessment of the company's risk management process and system of internal controls. To address the concerns over this requirement, the NASDAQ might provide guidance and recommend that the nature of reporting be risk-based and reflect the input of the board.
  • Provide a transition period. Many commenters were troubled by the requirement for listed companies to establish an internal audit function by no later than December 31, 2013. A resubmitted proposal might allow a transition period.

While we don’t know what the NASDAQ will do ultimately, we do know it intends to resubmit the rule. We believe NASDAQ-listed companies that do not have a modest revenue base and are accelerated filers should continue to take this development seriously if they do not currently have an internal audit function. By focusing proactively on this matter now with the board’s active involvement, these companies can increase their readiness to act either before or at the time the NASDAQ decides to resubmit the rule.

About Protiviti

Protiviti (www.protiviti.com) is a global consulting firm that helps companies solve problems in finance, technology, operations, governance, risk and internal audit. Through our network of more than 70 offices in over 20 countries, we have served more than 35 percent of FORTUNE 1000® and FORTUNE Global 500® companies. We also work with smaller, growing companies, including those looking to go public, as well as with government agencies. Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.

Ready to work with us?