One of my great regrets from my years as president and CEO of The Institute of Internal Auditors is that we never persuaded either major U.S. stock exchange, or the Securities and Exchange Commission (SEC), to require every publicly traded company to have an internal audit function. I took comfort in knowing the New York Stock Exchange (NYSE) required it. Now, that requirement is weakening.

On July 31, 2026, the NYSE filed a proposed rule change with the SEC that would extend the time certain newly listed companies have to establish an internal audit function. Under the current rule, a company listing through an IPO, a carve-out or a spin-off generally must have the function in place within one year. The proposal would stretch that to five years, and the SEC is accepting public comments through September 8, 2026.

The NYSE proposal is not a minor adjustment. It is a significant retreat from a sound governance principle, and it should concern you whether you are an investor, a board member or an internal auditor.

Nasdaq Once Tried the Opposite

You may recall that Nasdaq once considered moving in the opposite direction. In 2013, Nasdaq proposed requiring its listed companies to establish and maintain an internal audit function. Research by Navigant found that 40 percent of Nasdaq-listed companies with market capitalizations between $75 million and $250 million had no internal audit function. The proposal drew opposition over cost and regulatory burden, and Nasdaq withdrew it. The NYSE was left as the only major U.S. exchange that required an internal audit function.

For more than a decade, I hoped Nasdaq would eventually join the NYSE. Instead, the NYSE is now moving toward Nasdaq’s old position. That is the wrong direction for our profession, and for investors and boards who rely on strong governance.

I understand the NYSE’s stated rationale. A newly public company faces enormous demands: upgrading systems, hiring staff, meeting new reporting obligations and adjusting to public scrutiny. The NYSE argues that more time will let these companies build a more comprehensive internal audit function.

I disagree with the solution. The conditions the NYSE cites as a reason to delay internal audit are the same conditions that make internal audit necessary sooner. A newly public company is often growing fast, and its governance structures are still maturing. That is exactly when independent assurance matters most. A newly public company may need internal audit more than an established company with mature governance and controls.

This Is Also About Listing Exchange Competition

There is a competitive angle to this proposal that deserves attention. Nasdaq still does not require its listed companies to maintain an internal audit function at all, and the NYSE’s one-year deadline is likely a factor in where some companies decide to list. Stretching that deadline to five years narrows the gap with Nasdaq and makes the NYSE more attractive to companies that would rather not deal with the requirement so soon. Competition between exchanges for listings is real, but when exchanges compete by loosening governance requirements, investors incur the risk, not the companies chasing the more convenient listing venue.

New Companies Need Internal Audit Now More than Ever

The NYSE proposal cites other protections: independent audit committees, management’s internal control responsibilities and external auditor requirements under Sarbanes-Oxley. Those protections matter, but they are not substitutes for internal audit, which provides something different: independent assurance and advice that extends across the organization, from cybersecurity and artificial intelligence to third-party risk, compliance, culture, fraud and supply chains.

The NYSE itself says internal audit gives management and the audit committee ongoing assessments of risk and internal control. The word “ongoing” is the point. I made this same argument in 2021: when a public company has no internal audit function, you have to ask who is providing the board with independent, objective insight into how well risk is being managed. If the answer is no one, the board, and you as an investor, are at a disadvantage.

I also find the timing hard to reconcile with today’s risk environment. Companies face risks that move faster and connect in ways that didn’t exist a decade ago. Artificial intelligence, evolving cyber threats and geopolitical shocks can disrupt operations and supply chains overnight. I have long argued that risk should be internal audit’s North Star. If risk is increasing in speed and complexity, the case for timely internal audit coverage gets stronger, not weaker.

The NYSE proposal does not eliminate the internal audit requirement, and companies would still have to establish a function eventually. But five years is a large share of a young public company’s life. Controls can fail in that time, cultures can harden in the wrong direction, and third-party relationships can outgrow the organization’s ability to oversee them. Waiting for maturity before establishing internal audit gets the sequence backward. Internal audit helps a company reach maturity in the first place.

What You Can Do

If you are an internal auditor, an investor or a board member, this proposal is worth your attention. The SEC is accepting public comments through September 8, 2026. The IIA has weighed in, and is encouraging you to do the same.

I signed The IIA’s 2013 comment letter supporting Nasdaq’s original proposal, and the lesson still holds: our profession has to keep making the case for its own value, because too many people still see internal audit as a cost rather than protection for their investment. If five years feels too long to you, tell the SEC directly.

I wrote in 2021 that when a publicly traded company has no internal audit function, investors should run. I still believe that. The NYSE’s proposal will not eliminate internal audit at newly listed companies, but it will let them operate without it for far longer than they should. The question is not how long a board can operate without internal audit. It is how long, given its risks, it can afford to.