NYSE Internal Audit Requirement: Scope, Certification, and SOX 404

Every domestic company listed on the New York Stock Exchange must maintain an internal audit function that gives the audit committee and the board ongoing, independent assessments of risk management and internal controls. The NYSE internal audit requirement sits in Section 303A.07(c) of the Listed Company Manual, carries no revenue threshold or size exemption for domestic issuers, and is a condition of listing rather than a best-practice recommendation.¹ The rule itself is one sentence: “Each listed company must have an internal audit function.” Everything else is about how you build it, who oversees it, and what you file to prove it exists.

Who the Rule Covers and Who It Doesn’t

The requirement reaches every domestic company with common equity securities on the exchange. There is no small-company carve-out. If you are a domestic issuer and your stock trades on the NYSE, you need the function.

Three categories get different treatment, and it is worth being precise about what “different” means because the exemptions are narrower than companies sometimes assume.

Foreign private issuers are not required to maintain an internal audit function under NYSE rules. They still must comply with the audit committee requirements of SEC Rule 10A-3, the significant-differences disclosure under Section 303A.11, and the noncompliance notification and written affirmation under Section 303A.12.² Where a foreign private issuer has a board of auditors or statutory auditors established under home country law, Rule 10A-3 permits alternative compliance with the audit committee independence requirements.³

Controlled companies, where more than 50% of the voting power is held by an individual, group, or another company, are exempt from the majority-independent board, independent nominating committee, and independent compensation committee requirements. They are not exempt from the audit committee or internal audit requirements.⁴ A controlled company still needs internal audit on day one of listing.

Newly listed companies get a one-year transition from the listing date to establish a compliant internal audit function. During the same transition, the audit committee must have at least one member by the listing date, two members within 90 days, and three members within one year.¹⁵ This covers companies listing through an IPO, carve-out, or spin-off.

How the Function Has To Be Structured

Independence is the organizing principle. The internal audit leader must report functionally to the audit committee, which is the audience for audit findings and risk assessments. Administrative reporting to a senior executive like the CFO or general counsel is common for day-to-day logistics, but it cannot interfere with the audit committee’s direct access to the team’s work.

The scope has to cover ongoing assessments of the company’s risk management processes and internal control system, including controls over financial reporting, operational processes, and compliance with applicable laws.¹ The audit plan should be risk-based and updated as the company’s risk profile changes.

Staffing is flexible. You can build an in-house team, outsource the entire function to a qualified third party, or use a co-sourced model that blends both. The one hard restriction: you cannot outsource internal audit to the firm that serves as your independent external auditor.¹ Letting the same firm audit its own work would destroy the independence the structure depends on.

The Audit Committee’s Role Over Internal Audit

Every audit committee must have at least three members, all independent under both NYSE standards and SEC Rule 10A-3. Every member must be financially literate as determined by the board, and at least one member must have accounting or related financial management expertise.¹ The committee’s charter must be written and posted on or through the company’s website.⁶

With respect to internal audit specifically, the committee’s work is more than approving a plan once a year. It includes:

Reviewing and approving the internal audit charter and the annual, risk-based audit plan.
Assessing whether the function has enough qualified people to execute the plan.
Holding periodic sessions with internal auditors without management present. These separate meetings are required and exist to surface issues that will not come up with executives in the room.¹

One point of confusion worth clearing up. The NYSE gives the audit committee sole authority to appoint, compensate, and terminate the independent external auditor. The committee’s relationship with the internal audit leader is one of functional oversight and direct reporting access. The “sole authority to hire and fire” language in Section 303A.07 addresses the external auditor, and governance documents sometimes blur the two.

Annual Certification and Prompt Notification

Compliance is tested on a schedule. The CEO must submit an annual written affirmation to the NYSE no later than 30 days after the annual shareholders’ meeting, together with a certification affirming that the CEO is not aware of any violation of the corporate governance listing standards. For entities that do not hold annual meetings, such as limited partnerships, the deadline runs 30 days from filing the annual report on Form 10-K.⁷

Outside the annual cycle, the CEO must promptly notify the NYSE after any executive officer becomes aware of material non-compliance with any part of Section 303A.⁷ Holding a known deficiency until the next annual affirmation is not permitted.

What Happens If You Fall Out of Compliance

The NYSE does not immediately delist a company that falls short on governance standards. When the exchange identifies non-compliance, it notifies the company and gives it 45 days (90 days for non-U.S. companies) to submit a plan showing how it will return to compliance within 18 months. The plan must include specific milestones, and the NYSE reviews progress quarterly. If the company meets its milestones, the matter closes. If it falls short, or if 18 months pass without compliance, the exchange begins suspension and delisting procedures.

Companies in a cure period must also keep their listing fees current. Outstanding unpaid fees can trigger delisting proceedings on their own, regardless of where the company stands on its compliance plan. The framework gives companies a reasonable runway to fix problems and real consequences when they do not.

Overlap With Sarbanes-Oxley Section 404

The NYSE requirement does not stand alone. SOX Section 404(a) requires management of every SEC-reporting company to include in its annual report a statement accepting responsibility for internal controls over financial reporting and an assessment of whether those controls are effective. Section 404(b) requires the external auditor to independently attest to that assessment at accelerated filers (public float between $75 million and $700 million) and large accelerated filers (public float above $700 million). Non-accelerated filers under $75 million and emerging growth companies are exempt from the external auditor attestation but still must perform management’s own assessment under 404(a).⁸

In practice, the internal audit function does much of the control testing that supports management’s 404(a) assessment, evaluating whether key controls are designed properly and operating effectively throughout the year. A weak internal audit function does more than violate the listing standard. It undermines the company’s ability to support its SOX certifications, and the problem tends to surface when the external auditor flags control deficiencies.

1
U.S. Securities and Exchange Commission. NYSE Listed Company Manual Section 303A – Section 303A.07 Audit Committee Additional Requirements
2
NYSE. NYSE Listed Company Manual Section 303A FAQ
3
eCFR. 17 CFR 240.10A-3 – Listing Standards Relating to Audit Committees
4
U.S. Securities and Exchange Commission. NYSE Corporate Governance Rules
5
Federal Register. Self-Regulatory Organizations; New York Stock Exchange LLC; Order Approving Proposed Rule Change
6
NYSE. NYSE Listed Company Manual Section 303A FAQ
7
U.S. Securities and Exchange Commission. NYSE Rulemaking Rel 34-47672 – Corporate Governance
8
Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls