The NASDAQ Stock Market recently submitted a proposed rule change that would require all companies listed on the NASDAQ to maintain an internal audit function. The function would “provide management and the audit committee with ongoing assessments of the Company’s risk management processes and system of internal control.” In addition, the company’s audit committee would be required to meet periodically with the internal auditors and oversee the internal audit function. If implemented, the rule would require companies listed prior to June 30, 2013 to establish the internal audit function by December 31, 2013. Companies listed after June 30, 2013 would have to establish the function prior to listing.

The purpose of the proposed rule is to ensure that listed companies have a mechanism to regularly review and assess their internal controls and ensure management and audit committees receive information about risk management. The NASDAQ also believes the internal audit function will assist companies in complying with Rules 13a-15 and 15d-15, which require management to evaluate a company’s internal controls on a quarterly basis.

Despite the rule’s requirement of an internal audit function, the proposed language permits companies “to outsource this function to a third party service provider other than its independent auditor.” So, while the rule permits the internal audit work to be done by an outside third party, the company cannot engage the same auditing firm as both its internal and external auditor. In other words, the company needs both an independent outside auditor that cannot act as the inside auditor and an inside auditor that can be an outside auditor as long as it’s not the independent outside auditor.

Although most companies listed on the NASDAQ already have an internal audit function, the proposed rule would bring the NASDAQ into alignment with the New York Stock Exchange, which already requires its listed companies to have an internal audit function. See NYSE Listed Company Manual Section 303A.07(c).

The deadline for comments on the proposed rule is March 29, 2013.