NYSE Proposes Extending Internal Audit Function Transition Period From One Year To Five Years

On August 13, 2026, the Securities and Exchange Commission (“SEC”) published notice of a proposed rule change (SR-NYSE-2026-37) by the New York Stock Exchange (“NYSE”) to amend Sections 303A.00 and 303A.07 of the NYSE Listed Company Manual to extend the transition period in which a newly listed company must establish an internal audit function.

Currently, Section 303A.07(c) requires companies listed on the NYSE to establish and maintain an internal audit function. Sections 303A.00 and 303A.07 provide a transition period for newly listed issuers to comply within one year of the listing date. The internal audit function is intended to provide management and the Audit Committee with ongoing assessments of the company’s risk management processes and system of internal controls. The function may be performed internally or outsourced to a third-party service provider other than the company’s independent auditor. The NYSE’s proposal would extend the transition period from one year to five years. It is worth noting that the Nasdaq Stock Market does not require its listed companies to maintain a separate internal audit function.

NYSE Reasoning

In its proposal to the SEC, the NYSE stated that newly listed issuers often express concern over the one-year transition period given competing business and regulatory obligations requiring management’s attention and the challenges of building an internal audit function. The NYSE believes that a robust internal audit function continues to be a key component of sound corporate governance, but agrees with issuers that providing additional time to develop an internal audit function will result in a more effective internal audit function. In this regard, newly public companies are typically in the process of upgrading their accounting systems and internal controls and hiring additional staff to meet the greater demands placed on public companies. Given the oversight role of directors, and especially members of the Audit Committee, with respect to risk management and internal control, the NYSE believes it is appropriate to extend the transition period to provide directors with sufficient time to assess an issuer’s operations and design a valuable internal audit function.

The NYSE believes that five years is an appropriate transition period because other requirements will continue to provide sufficient assurance that issuers listed on the NYSE are appropriately managing risk:

• NYSE Section 303A.06 requires listed issuers to have an Audit Committee composed of at least three independent directors.
• NYSE Section 303A.07 requires that the Audit Committee have a written charter providing that, at least annually, the Audit Committee obtains and reviews a report by the company’s independent auditor describing: the company’s internal quality-control procedures and any material issues raised by the most recent internal quality-control review.
• Section 404(a) of the Sarbanes-Oxley Act of 2002 (“SOX”) obligates management to maintain an adequate internal control structure for financial reporting and to annually assess its effectiveness.
• SOX Section 404(b) requires the company’s independent auditor to provide an attestation on management’s internal control assessment.
• SOX Sections 302 and 906 require the chief executive officer and chief financial officer to certify the accuracy of the company’s periodic reports (Forms 10-K and 10-Q).

In this way, the NYSE noted that its internal audit requirement is a supplementary protection to these other requirements.

Effectiveness and Comment Period

Within 45 days of the publication of the SEC’s notice in the Federal Register (unless the SEC determines to extend to up to 90 days), the SEC will either approve or disapprove the proposed rule change or institute proceedings to review the rule change. Interested parties may submit comments to the SEC regarding the proposal. Comments will be due 21 days after the notice is published in the Federal Register.