SEC FLASH REPORT
NASDAQ Withdraws Proposed Internal Audit Function Rule with
Intent to Resubmit It
May 15, 2013
Three months ago, the National Association of Securities Dealers (NASDAQ) proposed a new
rule to require listed companies to have an internal audit function. 1 In light of the breadth and
nature of the comments from its issuer community and other stakeholders, the NASDAQ has
determined to withdraw its proposal so that it may adequately consider these comments.
In withdrawing the proposed rule for now, the NASDAQ also sent a message. The rule update
states that the NASDAQ remains committed to the highest standards of corporate governance
and believes it is important that listed companies have appropriate mechanisms and
processes in place to review risks and the system of internal controls. Therefore, it stated its
intent to revise the proposed rule, taking into account the comments received, and resubmit it.
No time frame was provided for a resubmission. For those interested in reading it, the
NASDAQ rule update may be found at http://nasdaq.cchwallstreet.com/nasdaq/pdf/nasdaqissalerts/2013/2013-003.pdf.
What does this latest action mean? As we reported in a prior Flash Report, the Securities and
Exchange Commission (SEC) had previously extended the 45-day time period for it to act on
the proposed rule change. 2 Given the resistance to the rule in many of the comment letters,
the SEC concluded a longer period of time was necessary to take action on the proposed rule
change so that it had sufficient time to consider the NASDAQ’s proposal as well as the
comments received. The comment letters on the proposed rule indicated a variety of
concerns, with cost being the predominate one.
Many commenters reported that overall compliance costs were significant in relation to their
revenue base, and that this proposal added further burden that was unnecessary. Other
commenters expressed concern with the requirement to provide management and the audit
committee with an ongoing assessment of the company's risk management process and
system of internal controls, viewing it as an inflexible one-size-fits-all approach that must be
applied regardless of the complexities of the business. Still others asserted that an internal
audit function was not even needed if the business was not particularly complex, e.g., low
volume of transactions, and management could apply entity-level controls to ascertain that
risks were being managed and internal controls were functioning effectively.
1
See Protiviti’s SEC Flash Report, “SEC Seeks Comment on NASDAQ Proposed Rule Requiring Listed Companies
to Have an Internal Audit Function,” March 11, 2013, available at www.protiviti.com. This Flash Report outlines the
specifics of the proposal.
2
See Protiviti’s SEC Flash Report, “SEC Extends Comment Period on NASDAQ Proposed Internal Audit Function
Rule,” April 25, 2013, available at www.protiviti.com.
In this debate, it is clear that the board of directors has an important voice. The question is,
“Does the board have the information it needs from an objective and competent source
regarding the organization’s risk management processes and internal controls?” While
management’s views are very important, the board has a deciding vote on this question and
must weigh in on the matter on an individual company basis.
The above all said, clearly the NASDAQ has stated its intention to resubmit the proposal. If we
were to read the tea leaves a bit, it is possible the NASDAQ might consider the following in
reshaping a new proposal:
•
Provide a threshold to focus on larger, more established companies. Thus,
companies with a small revenue base, companies qualifying as “emerging growth
companies” and companies below a so-called “microcap” threshold might be exempted.
•
Make the reporting requirement more flexible. The proposed rule required internal
audit to provide management and the audit committee with an ongoing assessment of
the company's risk management process and system of internal controls. To address the
concerns over this requirement, the NASDAQ might provide guidance and recommend
that the nature of reporting be risk-based and reflect the input of the board.
•
Provide a transition period. Many commenters were troubled by the requirement for
listed companies to establish an internal audit function by no later than December 31,
2013. A resubmitted proposal might allow a transition period.
While we don’t know what the NASDAQ will do ultimately, we do know it intends to resubmit the
rule. We believe NASDAQ-listed companies that do not have a modest revenue base and are
accelerated filers should continue to take this development seriously if they do not currently
have an internal audit function. By focusing proactively on this matter now with the board’s
active involvement, these companies can increase their readiness to act either before or at the
time the NASDAQ decides to resubmit the rule.
About Protiviti
Protiviti (www.protiviti.com) is a global consulting firm that helps companies solve problems in
finance, technology, operations, governance, risk and internal audit. Through our network of
more than 70 offices in over 20 countries, we have served more than 35 percent of FORTUNE
1000® and FORTUNE Global 500® companies. We also work with smaller, growing companies,
including those looking to go public, as well as with government agencies.
Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half
is a member of the S&P 500 index.
© 2013 Protiviti Inc. An Equal Opportunity Employer.
Protiviti is not licensed or registered as a public accounting firm and
does not issue opinions on financial statements or offer attestation services.