On August 13, 2026, the New York Stock Exchange filed a proposed rule change that would let newly listed companies wait five years, instead of one, before they must have an internal audit function. As Goodwin’s analysis explains, the existing requirement in section 303A.07(c) of the exchange’s listed company manual gives a new listing one year. The exchange’s stated reasoning is that newly public companies juggle competing business and regulatory obligations and need room to build a robust function.
On September 8, the Institute of Internal Auditors and a broad coalition urged the SEC to reject it. Whatever the SEC decides, the argument is worth following because it forces a question every board, CFO and audit committee should be able to answer: what independent assurance does a young public company actually need, and what is the cheapest credible way to provide it?
Crest.Digital’s AI-powered risk and vendor intelligence platform gives lean teams continuous visibility of controls and third parties, so coverage starts before the audit department is fully built.
See the PlatformWhat the NYSE Filed and Who Pushed Back
The proposal was published in the Federal Register in August, with a comment deadline in early September and an SEC review period of 45 days that can stretch to 90. The coalition that responded includes the IIA, Better Markets, RIMS, the Association of Certified Fraud Examiners, Public Citizen and several investor and whistleblower groups, and more than 80 individual practitioners, executives and investors filed separate comments. In their words, as reported by Accounting Today, the current rule requires presence, not scale: a new listing does not need a large department, only a function.
Their strongest point is evidentiary. The opponents say the exchange offered no figures on how many companies are affected or how heavy the burden is. For a rule that has stood since the post-Enron reforms and was last tuned in 2013, they argue, a fivefold extension needs a case built on data. We have not seen an SEC decision at the time of writing, so check the SEC’s self-regulatory organisation filings page for the current status.
What the Rule Really Asks For
Much of the debate assumes that an internal audit function means a floor of auditors and a long list of engagements. It does not. The requirement is for a function that provides management and the audit committee with ongoing assessments of the company’s risk management processes and system of internal control. How that function is staffed is left to the company: employees, a co-sourced provider, or a blend.
That flexibility is the part the coalition stresses, and it is also where the most useful practical conversation sits. If the rule asks for presence rather than scale, the real question for a newly listed company is how to establish credible coverage at a cost proportionate to its size. Years ago the answer was a partner firm and a thin annual plan built on sampling. Today it can be a small accountable team supported by continuous controls monitoring, which tests controls across entire populations rather than sample selections. We explore why that shift matters in AI is moving audit from sampling to continuous assurance.
What Tends to Go Wrong in the First Five Years
The first years after listing are when control environments are least settled. Three pressures recur.
Reporting machinery is new. Disclosure controls, quarterly close cycles and investor communications are being built while the business grows. Manual journals, spreadsheet workarounds and thin segregation of duties are common because they are fast. Each one is a place where an independent reviewer would ask, early, whether the control really operates. Our piece on access governance and segregation-of-duties monitoring shows why these conflicts are cheaper to find continuously than at year-end.
Other safeguards arrive later. The coalition argued that other protections, such as independent auditor attestation on internal control, do not apply to many new companies for years, which makes internal audit the main independent look at controls during that window. If that is right, delay concentrates risk rather than spreading it. Frameworks such as the COSO Internal Control framework make the same point from the design side: monitoring is a component of control, not an optional extra.
The estate gets complicated quickly. New vendors, new systems, acquisitions and now AI tools that act on financial data all enter the picture faster than governance catches up. An audit committee that hears about an AI agent or a critical supplier only after something goes wrong has been under-served. This is why our analysis of audit committees ranking ERM first while AI oversight lags treats the committee’s information flow as the real control, and why an AI policy is not an internal control until someone tests it.
A Six-Step Plan for a Lean Internal Audit Function
Whether or not the proposal succeeds, any newly listed company can apply the same sequence. It mirrors the discover, design, connect, deploy, validate and transfer pattern we use when building continuous assurance, scaled to a function of one to five people.
Appoint Accountable Leadership and Write the Charter
Name a head of internal audit, whether employed, co-sourced or interim, with a charter approved by the audit committee and a direct reporting line to it. Independence from management is the feature that makes the function worth having, so settle it before the first engagement.
Build a Risk and Control Inventory
List the processes and systems that matter most after listing: financial close and reporting, revenue, procurement and payments, access to financial systems, cybersecurity, key vendors and any AI that touches financial or customer data. Map each to the controls management relies on.
Set a Narrow, Risk-Based First-Year Plan
Do not try to cover everything. Choose a handful of high-risk areas, agree scope and timing with the audit committee, and say plainly what is out of scope. A small plan that is completed and reported beats a large one that slips.
Connect to Systems and Test Controls Continuously
Link monitoring to ERP, procurement, access and banking data so the highest-risk controls, such as duplicate payments, bank-detail changes, manual journals and segregation-of-duties conflicts, are tested across full populations instead of samples.
Close the Loop on Every Finding
Convert each observation into an action with an owner, a date and closure evidence, and track it to completion. Repeat findings and cosmetic fixes are the signals a committee should see first.
Report to the Audit Committee and Refresh Every Year
Give the committee a concise view of coverage, exceptions, overdue actions and emerging risks, and refresh the risk inventory annually. Arrange an independent quality review as the function matures, in line with the IIA's standards.
The sixth step matters because function quality is itself something to be assured. The IIA’s Global Internal Audit Standards expect an internal audit function to be independent, resourced and periodically reviewed, and an audit committee should ask for that evidence whatever the headcount. For a deeper look at how findings turn into durable fixes, see our guide to audit issue remediation and follow-up agents.
Crest.Digital’s Agentic GRC builds customised agents and continuous controls around your systems, so exceptions, evidence and remediation sit in one audit-ready trail. Relevant across regulated and high-growth industries.
Where Agentic AI Changes the Economics, and Where It Does Not
The honest objection to early internal audit is cost. Experienced auditors are expensive and a young company has many priorities. Agentic AI changes the arithmetic on the repeatable parts of the work. Agents can read policies and prior reports to draft a risk and control matrix, test purchase-to-pay and access controls against full populations, request and check evidence, flag duplicate or recycled documents, draft observations for review and chase overdue actions. We describe the evidence side in agentic internal audit and evidence validation and the capacity argument in scaling risk ownership beyond the audit function.
What it does not change is independence and judgement. An agent can show that 14 payments were released without approval; a person decides whether that is a design flaw, a one-off or a pattern, and tells the audit committee. Every automated step needs a log of the data used, the rule applied and the reviewer, otherwise the work cannot be re-performed or defended. As we put it in continuous evidence, not just continuous monitoring, what stands up to scrutiny is proof that controls kept running. And the agents are part of the estate too: where they touch financial data, they belong in the audit universe.
Your Turn: Where Does Your Internal Audit Coverage Sit Today?
- Absent or informal: No charter, no independent reporting line to the audit committee, and assurance comes only from management or the external auditor.
- Present but thin: A named lead and an annual plan exist, but testing is sample-based and findings are tracked in spreadsheets.
- Present and continuous: Key controls are monitored across full populations, exceptions flow to owners with deadlines and the committee sees coverage and overdue actions regularly.
Where would your audit committee place you? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Internal audit’s relationship with third-party risk has historically been reactive — reviewing incidents after they occur rather than providing assurance that controls are operating effectively in real time. Continuous monitoring creates a new opportunity: internal audit can verify that risk ratings are recalculated when trigger events occur, that escalations are documented, and that the board is receiving accurate information about vendor exposure — all of which are more meaningful assurance activities than an annual programme review.
Frequently Asked Questions
The NYSE filed a proposed rule change in August 2026 that would extend the transition period for newly listed companies to establish an internal audit function from one year after listing to five years. The existing requirement sits in the exchange's listed company manual, in section 303A.07(c) on audit committee responsibilities, and has been part of NYSE governance standards since the post-Enron reforms. The proposal was published in the Federal Register in August, with comments due in early September, and the SEC has a 45-day review window that can be extended to 90 days. Check the SEC's self-regulatory organisation filings page for the current status, because the outcome may already have moved.
A coalition that includes the Institute of Internal Auditors, Better Markets, RIMS, the Association of Certified Fraud Examiners, Public Citizen and other groups argues that five years is far too long for a public company to operate without ongoing, objective assurance. They point out that the requirement has protected investors for more than two decades, that the rule requires presence rather than scale so a new listing need not build a large department, and that the NYSE offered no data on how many companies are affected or how heavy the burden really is. More than 80 individual practitioners, executives and investors also submitted comments.
Legal requirements aside, most newly public companies face rapid change in exactly the areas where independent assurance helps: first-time public reporting, new disclosure controls, a larger investor and regulator audience, acquisitions, new systems, and a fast-growing vendor and access footprint. An internal audit function, whether in-house, co-sourced or technology-enabled, gives the audit committee an objective view of whether controls operate as designed. It does not need to be large. A small team with a clear charter, a risk-based plan and continuous monitoring of key controls can provide meaningful coverage from the first year.
No. Continuous controls monitoring automates testing of defined controls across systems such as ERP, procurement, payroll and access management, so exceptions are found as they happen rather than at the next sample. That extends coverage and frees auditors for judgement work. But internal audit also sets the plan, assesses the design of controls, challenges management, forms opinions and reports to the audit committee with independence. Monitoring supplies evidence; people provide assurance. For a lean team the combination is the practical route to broad coverage.
Use agents for repeatable work: reading policies, mapping controls, collecting and checking evidence, testing populations, tracking remediation and drafting summaries for review. Keep humans in charge of risk assessment, scoping, conclusions and communication with the audit committee. Every agent action should be logged with the data used, the rule applied and the reviewer, so that findings can be re-performed and defended. Where AI agents themselves touch financial processes, add them to the audit universe, because they are now part of the control environment you are assuring.