Question :
The Role of Internal Audit in the Organization
On March 4, 2013 the SEC announced that the NASDAQ Stock Market LLC has filed a proposed rule change that would need listed companies to maintain and establish an internal audit function no later than 31st December, 2013. Specifically:
Each Company must maintain and establish an internal audit function to give management and the audit committee with ongoing assessments of the Company's risk management processes and system of internal control. The Company may select to outsource this function to a third party service provider other than its independent auditor. The audit committee has to meet periodically with the internal auditors (or other personnel responsible for this function) and help the Board in its oversight of the performance of this function. The audit committee could also show with the outside auditor the responsibilities, staffing and budget of the internal audit function.
The SEC comment period closed at the end of March at which time they had received over 35 comments. Some of these comments supported the rule change but important number, mainly from smaller companies, argued against the change. A common theme of those against the change is reflected in the subsequent from the CFO of Perceptron, Inc.:
There already exists a need for public companies to review report and maintain on internal controls under Federal securities law. Rules 13a-15 and 15d-15 purposely require a certification by the Chief Executive Officer and the Chief Financial Officer. This proposed rule by NASDAQ adds a second layer of regulation that is not required and would not provide value. Perception maintains internal controls with management oversight and previously engages outside, independent firms to perform SOX 404 testing of its internal controls. Management gives a report of the results of its independent firms' testing every quarter to the Audit Committee. Further, the Company's independent auditor meets with the Audit Committee frequently, including in private sessions without management's presence.
Do you agree with the CFO? If so describe how SOX 404 and CEO/CFO certification removes the need for an internal audit function. If you don't agree, describe what an internal audit function adds beyond SOX 404 and CEO/CFO certification.