Nasdaq internal audit deadline looms ahead
06.07.2013 - On March 4, 2013, Nasdaq issued a proposed new rule that will require listed companies to establish and maintain an internal audit function. During the public comment period, the SEC received 42 responses. The comments can be reviewed in full at the SEC’s website.
As expected, the input was both in favor and in opposition of the proposed ruling. The primary concerns, mostly from smaller organizations, are related to additional costs and distraction associated with establishing and maintaining an internal audit function. Supporters, on the other hand, recognize the tangible and intangible benefits that an effective internal audit function can bring in assisting organizations with meeting their objectives and maintaining credibility. Nasdaq has decided to withdraw the proposed rule in order to carefully consider the feedback received. Nasdaq stated that it “remains committed to the highest standards of corporate governance, and believes it is important that listed companies have appropriate mechanisms and processes in place to review risks and the system of internal controls. It is our intent to revise the proposed rule, taking into account the comments, and resubmit it.”
The proposed rule is very similar to the NYSE Internal Audit Requirement. It states:
Each Company must 1) establish and maintain an internal audit function to provide management and the audit committee with ongoing assessments of the Company’s risk management processes and system of internal control. The Company may choose to outsource this function to a third party service provider other than its independent auditor. 2) The audit committee must meet periodically with the internal auditors (or other personnel responsible for this function) and assist the Board in its oversight of the performance of this function. 3) The audit committee should also discuss with the outside auditor the responsibilities, budget and staffing of the internal audit function.
The proposed rule states that companies that were listed on Nasdaq on or before June 30, 2013, would be required to establish an audit function no later than Dec. 31, 2013. Companies listed after June 30, 2013 would be required to establish an internal audit function before listing. Several of the comment letters submitted in opposition of the proposed rule have suggested lengthening the implementation period and/or extending the deadline for compliance.
What you need to do
Nasdaq listed companies need to ensure that the company's management and Audit Committee receive ongoing assessments of the company's risk management processes and system of internal control. The company can outsource the internal audit function to any third party other than its independent auditor, but the Audit Committee must maintain sole responsibility for oversight, and it may not allocate or delegate that responsibility to another board committee.
The Audit Committee will be expected to arrange periodic meetings with the personnel engaged in the internal audit function (whether internal or outsourced) as well as the company's independent auditors.
Where do you start?
If you have an existing internal audit function you should have an independent review of your processes and procedures to make you are firmly in compliance with the new requirement. For example, does your internal audit function have clearly designated job descriptions and roles? Do you have formal, written internal audit procedures? If you adhere to the International Standards for the Professional Practice of Internal Auditing, have you completed a Quality Assurance Review within the past five years as required by those professional standards?
If you have no internal audit function, you first need to determine whether an internal or outsourced solution is best. The internal audit provider cannot be your audit firm, but you need to assess the firm’s capabilities to ensure they offer robust audit and compliance qualifications.
For most companies the first step is to have an assessment of options that will ensure compliance in time for the deadline.
If you have questions
With the deadline potentially just over six months away, now is the time to have a high level assessment of your readiness and/or procedures. If you have specific questions regarding the Nasdaq Audit Function rule, please send us an email today or call Sabrina Serafin, Practice Leader for Process, Risk & Governance at 404.253.7500. Our professionals have extensive experience creating internal audit functions, providing internal audit services as an outsourced solution, and consulting with existing internal audit departments to maximize their effectiveness in meeting stakeholder expectations.