NYSE Internal Audit Requirement: Scope, Structure, and Compliance

Every domestic company listed on the New York Stock Exchange must maintain an internal audit function. The NYSE internal audit requirement lives in Section 303A.07(c) of the Listed Company Manual, applies with no revenue threshold or size exemption for domestic issuers, and exists so the audit committee and board get independent, ongoing assessments of risk management and internal controls.¹ Failing to establish or maintain it puts a company on a path that can end in delisting.

Who the Rule Covers

The rule reads plainly: “Each listed company must have an internal audit function.”¹ It reaches every domestic company with common equity on the exchange. A few categories get modified treatment:

Foreign private issuers are not required to maintain an internal audit function under NYSE rules. They still must comply with SEC Rule 10A-3 on audit committees, the significant-differences disclosure under Section 303A.11, and the noncompliance and written affirmation requirements under Section 303A.12.²
Controlled companies (more than 50% of voting power held by an individual, group, or another company) are exempt from majority-independent board, independent nominating committee, and independent compensation committee rules. They are not exempt from the audit committee or internal audit requirements.³
Companies listing through an IPO, carve-out, or spin-off get a one-year transition from the listing date to establish a compliant internal audit function. During that same window, the audit committee needs at least one member by the listing date, two within 90 days, and three within one year.¹⁴

How the Function Must Be Structured

Independence drives the design. The internal audit leader reports functionally to the audit committee, which is the audience for audit findings and risk assessments. Administrative reporting to a senior executive such as the CFO or general counsel is common for day-to-day logistics, but it cannot compromise the committee’s direct access to the team’s work.

Scope must cover ongoing assessments of the company’s risk management processes and internal control system.¹ That includes controls over financial reporting, operational processes, and compliance with applicable laws. The audit plan should be risk-based and updated as the risk profile changes.

Staffing is flexible. You can build an in-house team, outsource the entire function to a qualified third-party provider, or use a co-sourcing model. One hard restriction: you cannot outsource internal audit to the same firm that serves as your independent external auditor.¹ Letting one firm audit its own work would destroy the independence the whole structure depends on.

The Audit Committee’s Role Over Internal Audit

The audit committee is the governance body that oversees internal audit, and its composition rules are strict. Every audit committee must have at least three members, and all of them must satisfy the independence standards set by both the NYSE and SEC Rule 10A-3. All members must be financially literate; at least one must have accounting or related financial management expertise, as the board interprets that standard.¹

The committee’s written charter must be available on or through the company’s website.⁵ Core duties tied to internal audit include:

Reviewing and approving the internal audit charter and annual audit plan, and deciding whether the plan is appropriately risk-based.
Assessing whether the function has enough qualified people to execute its plan.
Holding periodic separate meetings with internal auditors without management present, so issues surface that might not come up otherwise.¹

One point companies sometimes blur: the “sole authority to hire and fire” language in Section 303A.07 applies to the independent external auditor, not the internal audit leader. The committee’s relationship with the internal audit function is one of functional oversight, including approval of the plan and direct reporting access.

How It Ties Into Sarbanes-Oxley

The NYSE requirement does not sit alone. Section 404(a) of Sarbanes-Oxley requires management of every SEC-reporting company to include in its annual report a statement accepting responsibility for maintaining adequate internal controls and an assessment of whether those controls are effective. Section 404(b) requires the external auditor to independently attest to that assessment for accelerated filers (public float between $75 million and $700 million) and large accelerated filers (public float above $700 million). Non-accelerated filers under $75 million, along with emerging growth companies, are exempt from the auditor attestation but still owe management’s own 404(a) assessment.⁶

In practice, the internal audit function does much of the testing that supports management’s 404(a) assessment: whether key controls are designed properly and operating effectively across the year. A weak internal audit function does more than violate NYSE listing standards. It undermines the company’s ability to stand behind its SOX certifications, and control deficiencies tend to surface when the external auditor arrives.

Annual Certification and Disclosure

The CEO must submit an annual written affirmation to the NYSE certifying awareness of no violations of the corporate governance listing standards. It is due no later than 30 days after the annual shareholders’ meeting. For entities that do not hold annual meetings, such as limited partnerships, the deadline is 30 days after filing the annual Form 10-K.⁷

Between annual cycles, the CEO must promptly notify the NYSE after any executive officer becomes aware of material non-compliance with any part of Section 303A.⁷ Waiting for the next annual affirmation is not an option.

Separately, SEC Regulation S-K requires the proxy statement to disclose whether the board has designated at least one audit committee member as an “audit committee financial expert,” and to explain the absence if none qualifies.⁸ This is a distinct standard from the NYSE’s financial literacy requirement, and a company needs to meet both.

What Happens When a Company Falls Out of Compliance

The NYSE does not delist immediately for governance shortfalls. When the exchange identifies non-compliance, it notifies the company and gives it 45 days (90 days for non-U.S. companies) to submit a plan showing how it will return to compliance within 18 months. The plan must include specific milestones, and the NYSE reviews progress quarterly. Meet the milestones and the matter closes. Miss them, or let 18 months pass without compliance, and the exchange begins suspension and delisting procedures.

Companies in a cure period also have to keep listing fees current. Outstanding unpaid fees can trigger delisting proceedings on their own, regardless of where the company stands on its compliance plan.

What Standards Internal Auditors Actually Follow

The NYSE mandates that the function exist but does not prescribe a specific set of professional standards. In practice, most internal audit departments at NYSE-listed companies align their work with the Global Internal Audit Standards issued by the Institute of Internal Auditors, which the IIA describes as mandatory for all internal audit functions. The standards address independence, objectivity, proficiency, quality assurance, and the conduct of individual engagements.

That silence gives companies flexibility, and it also puts weight on the audit committee to ensure the function meets a credible professional bar. A function that exists on paper but does not follow recognized practices will struggle to satisfy the committee’s duty to assess resource adequacy and audit quality. The IIA standards are the most widely recognized benchmark, and external auditors and regulators generally expect conformance with them even where the rules do not explicitly require it.

1
U.S. Securities and Exchange Commission. NYSE Listed Company Manual Section 303A – Section 303A.07 Audit Committee Additional Requirements
2
NYSE. NYSE Listed Company Manual Section 303A FAQ
3
U.S. Securities and Exchange Commission. NYSE Corporate Governance Rules
4
Federal Register. Self-Regulatory Organizations; New York Stock Exchange LLC; Order Approving Proposed Rule Change
5
NYSE. NYSE Listed Company Manual Section 303A FAQ
6
Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls
7
U.S. Securities and Exchange Commission. NYSE Rulemaking Rel 34-47672 – Corporate Governance
8
eCFR. 17 CFR 229.407 – Item 407 Corporate Governance