The Institute of Internal Auditors is urging the U.S. Securities and Exchange Commission to follow the example of the New York Stock Exchange and require all publicly-traded companies to have an internal audit function.
The SEC in July issued a 55-page concept release proposing a set of revisions in audit committee disclosure requirements. Both the agency and the Public Company Accounting Oversight Board have been working toward improving the information provided to investors about the audit committee’s responsibilities and activities.
In a letter responding to the SEC’s proposals, IIA president and CEO Richard F. Chambers said the time was ripe to mandate an internal audit function.
“The presence of an effective internal audit function makes an unequivocal statement about the way a company’s leadership views strong and effective risk management, internal control, and governance,” he wrote. “When a publicly traded company does not have an internal audit function, one must ask: Who is providing the board (and specifically, the audit committee) with independent and objective assurance and insight on how well risk and the mitigating controls are being managed?”
“[A]n independent, objective, and competent internal audit function is basic and fundamental to effective corporate governance,” Chambers added.
The SEC’s proposals focus on the relationship between the audit committee and the independent auditor but it also invited comment on “other aspects of audit committee disclosures, such as those related to roles and responsibilities, audit committee qualifications, oversight of financial reporting, or oversight of internal control over financial reporting.”
Chambers noted that more than a decade ago, the NYSE began requiring companies listed on the exchange to have an internal audit function in place, upon or within the first year of listing. NASDAQ, however, has not followed suit.
“[W]e strongly believe the time has come to formally recognize the value of an internal audit function for all publicly-listed companies as a matter of basic good governance,” Chambers said. Failing that, he said, companies that don’t have internal audit should be required to explain their reasoning.