A quiet rule change is getting a loud reaction, and we think the reaction is right.
Under a rule NYSE just proposed, a company could go public, trade for five years, and never once have an internal auditor examine its risks. Since 2003, newly listed companies have had one year to establish that function. On July 31, the exchange asked the SEC to make it five.
We think that’s a mistake. Here’s why.
The timeline so far
- July 31: NYSE files the proposed rule change (SR-NYSE-2026-37)
- August 13: SEC files notice of the proposal
- August 18: Notice is published in the Federal Register, opening the public comment period
- August 26: The Institute of Internal Auditors formally requests a 30-day extension, to October 8
- September 8: Current comment deadline, unless the SEC grants the extension
Why NYSE says this makes sense
NYSE’s filing argues the current one-year window is difficult for newly public companies to meet. The exchange points to competing demands in that first year: new reporting obligations, systems upgrades, hiring, and adjusting to life as a public company generally. It argues that more time will result in a more capable, better-designed internal audit function once it’s built.
NYSE also points to other protections already in place during that window: a fully independent audit committee, management’s internal control obligations under Sarbanes-Oxley Section 404(a), and external auditor attestation under Section 404(b). In NYSE’s view, internal audit supplements those protections rather than replacing them, so a longer runway to build it doesn’t leave a gap.
One wrinkle: a separate SEC proposal (Release No. 33-11419, proposed May 19, 2026) would narrow that Section 404(b) attestation requirement, creating a five-year exemption for newly public companies regardless of size. That proposal is also still pending.
NYSE’s final argument is a competitive one. Nasdaq has no internal requirements at all. NYSE frames the extended transition as still leaving its rules more stringent than its main competitor’s.
Why the IIA is right to push back
The Institute of Internal Auditors, the profession’s global standard-setting body, has formally opposed this proposal, and we agree with them. Their comment letter and public statements raise several counterpoints:
- The exemptions stack. Most newly public companies are already exempt from SOX auditor attestation on internal controls if they qualify as emerging growth companies or non-accelerated filers. The separate SEC proposal above would go further, exempting every newly public company from that attestation requirement for five years, regardless of size. Layered on top of NYSE’s proposal, a typical new issuer could go the full five years with neither an internal audit function nor SOX attestation in place.
- External audit and internal audit cover different ground. NYSE’s argument leans on the protections of external attestation, but external audit looks backward at last year’s financials and controls over financial reporting. Internal audit looks forward and continuously across the broader risk picture: cyber, technology, operations, supply chain, compliance.
- An empty seat at the table. NYSE’s own listing standards require audit committees to meet periodically and separately with internal auditors. For five years, there would be no internal auditor on the other side of that table.
- The filing includes no supporting data. No count of how many companies this affects, no measurement of the burden companies say they face, no analysis of investor impact. The IIA’s requested 30-day extension is meant to give the SEC exactly that evidentiary record before it decides.
Year one is the riskiest year
The strongest argument against this proposal is practical. In our experience, the first few years after a company goes public are the years when risk is hardest to see and most expensive to miss. Systems are new, controls are unproven, and the people running them are often learning the business at the same time they’re building the infrastructure to govern it. That is exactly when a company needs an independent, objective set of eyes on where the real exposures sit.
NYSE’s proposal treats a newly public company as if it carries less risk in year one than it will in year five. In our experience, it’s the opposite. A young public company carries different risk, and often more of it, concentrated in exactly the areas internal audit exists to evaluate. Going without that function for up to five years increases risk exposure for shareholders and for the company itself, during the stretch of its existence when independent, objective evaluation of risk matters most.
The Nasdaq comparison doesn’t hold up either. It’s true that Nasdaq has no internal audit requirement at all, but that’s an argument for Nasdaq raising its own standard, not for NYSE lowering its own to match it. Nasdaq proposed a similar requirement of its own back in 2013 and withdrew it after industry pushback over cost. That history is a reason to close the gap between the exchanges, not widen it. Two exchanges without a meaningful requirement is a worse outcome for investors, not a justification for either one.
We support the IIA’s position on this proposal. If you’ve sat on an audit committee, built an internal audit function from the ground up, or lived through a company’s first few years as a public entity, that experience is worth putting in writing before September 8.
What happens next
The SEC will either approve the rule, disapprove it, or open formal proceedings to examine it further, generally within 45 days of the Federal Register notice unless it designates a longer review period. If the comment period extension is granted, the new deadline would move to October 8.
The separate SOX attestation proposal referenced above (Release No. 33-11419) is on its own, unrelated rulemaking timeline and is not part of the NYSE filing or its comment period.
How to submit a comment
- Online: use the SEC’s comment form
- Email: rule-comments@sec.gov with “File No. SR-NYSE-2026-37” in the subject line
- Paper: mail three copies to Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090, referencing File No. SR-NYSE-2026-37
All submissions are posted publicly on the SEC’s website, so don’t include anything you don’t want made public.
And whatever happens with this rule, the question it raises doesn’t go away: if your company is approaching a listing and weighing how to stand up an internal audit function, in-house, co-sourced, or outsourced, that’s a conversation our team has regularly. Connect with us.
