In India, every listed company must appoint an internal auditor under Section 138 of the Companies Act, 2013, with no size threshold. In the United States, the New York Stock Exchange proposed in August 2026 to let newly listed companies take five years, instead of one, to set up an internal audit function, and The Institute of Internal Auditors has asked the regulator to reject the change.
This short piece sets out what was proposed and what was said about it, using only sources we read, and then turns to what an Indian company heading for an IPO should have ready.
| Need | Use this |
|---|---|
| Check whether your company is already covered before listing | Internal Audit Applicability Checker |
| How to appoint the internal auditor, with the resolution | Appointment of internal auditor for FY 2026-27 |
| What the audit committee should be asking | Audit committee questions to ask internal audit |
What the NYSE proposed
According to a note by the law firm Goodwin published on JD Supra on 18 August 2026, the NYSE filed a rule proposal on 13 August 2026. Under the current rule, a newly public company must establish an internal audit function within one year after listing. The proposal would extend that to five years from the listing date.
Goodwin reports the exchange's reasoning: newly public companies face "competing business and regulatory obligations" and find it hard to build an audit function during early growth. The requirement itself would stay; only the timeline would change. Goodwin also notes that the NYSE continues to describe an internal audit function as "a key component of sound corporate governance".
A note by Cooley, published on JD Supra on 27 August 2026, adds context. It says the extra time would let newly public companies develop a meaningful programme at a point when they are also upgrading accounting systems. It also points out that Nasdaq does not require listed companies to maintain an internal audit function at all, so the NYSE rule would remain the stricter of the two even with a five-year period.
The proposal needs the approval of the US Securities and Exchange Commission. The SEC file reference given in the sources is SR-NYSE-2026-37. None of the pages we read reported a decision.
What the IIA and others said
On 8 September 2026, The Institute of Internal Auditors issued a press release saying that it and a coalition of investor, governance and professional organisations had submitted comment letters urging the SEC to reject the proposal. The release names the coalition members as Better Markets, the Interfaith Center on Corporate Responsibility, RIMS, the National Whistleblower Center, the Association of Certified Fraud Examiners, Public Citizen and Americans for Financial Reform Education Fund. It adds that more than 80 individual practitioners, executives and investors submitted comments of their own.
The release makes three arguments:
- The internal audit listing requirement dates from the period after Enron and has protected investors in newly listed companies for more than two decades.
- The exchange's filing would lengthen the transition period fivefold without supporting data on the companies affected, the burden, the savings or the consequences for investors.
- The early years after listing are when a company most needs the assurance.
It quotes The IIA's president and CEO: "Five years is far too long for a public company to operate without the ongoing, objective assurance an internal audit function provides." The release also says The IIA objected when the current one-year transition was adopted in 2013.
Accounting Today covered the release on 9 September 2026. Its report adds that the coalition described a five-year absence as "neither limited nor prompt", and notes that the NYSE had pointed to other safeguards, including auditor attestation requirements under the Sarbanes-Oxley Act.
The Indian position
The Indian rule is simpler, and it comes from company law, not from a stock exchange rulebook.
Listed companies are always covered. Rule 13 of the Companies (Accounts) Rules, 2014, made under Section 138, requires every listed company to appoint an internal auditor. There is no test of capital, turnover, borrowings or deposits for a listed company.
No transition period for a newly listed company is stated in the material we rely on. We do not go further than that. The rule text we read does carry a proviso giving existing companies six months from the commencement of the section, but that was a one-time arrangement when the law began in 2014, and we would not treat it as a grace period after an IPO. A company planning to list should assume the requirement applies from the day it becomes a listed company, and confirm the position with its legal advisers.
Many companies are covered before they list. An unlisted public company must appoint an internal auditor if, in the preceding financial year, it had paid-up share capital of ₹50 crore or more, turnover of ₹200 crore or more, outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point, or outstanding deposits of ₹25 crore or more at any point. A private company is covered on the turnover and borrowings tests only. A company large enough to be planning an IPO has often crossed one of these lines already.
Who can be appointed. A chartered accountant, a cost accountant or such other professional as the Board decides, who may or may not be an employee. The statutory auditor cannot take the role because Section 144 bars it.
The audit committee. Section 177 requires every listed company to have an Audit Committee. Under Regulation 18 of the SEBI Listing Regulations, the committee has at least three directors, at least two-thirds of them independent, all financially literate, with an independent director in the chair; it meets at least four times a year with no more than 120 days between meetings. Schedule II, Part C of those Regulations gives it specific internal audit duties: reviewing the adequacy of the internal audit function, including its structure, staffing and the seniority of the person heading it; reviewing internal audit reports on control weaknesses; and reviewing the appointment, removal and terms of remuneration of the chief internal auditor. The internal auditor may report directly to the committee.
What a company preparing for an IPO in India should have in place
Treat internal audit as something to have running well before listing, so that the first year as a listed company is not also the first year of internal audit.
| Item | What "ready" looks like |
|---|---|
| Applicability | A written note showing whether Rule 13 already applies on last year's figures |
| Appointment | Board resolution appointing the internal auditor, with a written confirmation that the appointee has no link to the statutory auditor |
| Audit Committee | Constituted with the composition the Listing Regulations require, with terms of reference that cover internal audit |
| Scope and method | Scope, functioning, periodicity and methodology formulated by the Audit Committee or Board in consultation with the internal auditor, as Rule 13(2) requires |
| Charter | An approved internal audit charter stating authority, access and reporting line |
| Reporting line | Internal auditor reports to the Audit Committee on substance, not only to the CFO |
| Annual plan | A risk-based plan approved by the committee, covering the main processes and locations |
| Track record | At least a few reporting cycles of internal audit reports with management responses |
| Follow-up | An action tracker showing what was closed, with evidence, and what is overdue |
| Statutory auditor | Internal audit reports shared; under CARO 2020 the statutory auditor reports on whether the internal audit system suits the company's size and business and whether the reports were considered |
Where transaction volumes are large, some companies add checks that run across every transaction each month alongside the periodic audit; CORAA's internal audit product is built for that.
The appointment guide covers the resolution and the order of steps.
FAQ
Is internal audit mandatory for listed companies in India in 2026?
Yes. Every listed company must appoint an internal auditor under Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014. No size threshold applies to a listed company.
Does a newly listed company in India get time to set up internal audit?
The material we rely on states no transition period for a newly listed company. Plan to have the internal auditor appointed before listing and confirm the position with your advisers.
What did the NYSE propose on internal audit in 2026?
According to law-firm notes published in August 2026, the NYSE filed a proposal on 13 August 2026 to extend the time a newly listed company has to establish an internal audit function from one year to five years after listing. It requires SEC approval.
Why did the IIA oppose the NYSE proposal?
In a press release of 8 September 2026, The IIA said five years is too long for a public company to operate without internal audit, that the requirement is a long-standing investor protection, and that the exchange gave no supporting data for the change.
Related CORAA resources
- Appointment of internal auditor for FY 2026-27: board resolution and rules
- Internal Audit Applicability Checker
- Audit committee questions to ask internal audit
- Internal audit charter and mandate
- Standards on Internal Audit
Sources
Pages read on 1 October 2026.
- The Institute of Internal Auditors, "Broad Coalition Urges SEC To Reject NYSE Proposal Allowing Newly Listed Companies to Go Five Years Without Internal Audit", 8 September 2026 — https://www.theiia.org/en/content/communications/press-releases/2026/september/broad-coalition-urges-sec-to-reject-nyse-proposal-allowing-newly-listed-companies-to-go-five-years-without-internal-audit/
- Accounting Today, "IIA urges SEC to reject NYSE audit proposal", 9 September 2026 — https://www.accountingtoday.com/news/iia-urges-sec-to-reject-nyse-audit-proposal
- Cooley LLP on JD Supra, "NYSE Proposes Extending Internal Audit Transition Period", 27 August 2026 — https://www.jdsupra.com/legalnews/nyse-proposes-extending-internal-audit-7261107/
- Goodwin on JD Supra, "NYSE Seeks to Extend Internal Audit Transition Period to Five Years", 18 August 2026 — https://www.jdsupra.com/legalnews/nyse-seeks-to-extend-internal-audit-3386151/
- Rule 13, Companies (Accounts) Rules, 2014, text read at https://ca2013.com/rule-13-companies-accounts-rules2014/
- Companies Act, 2013 and related rules, Ministry of Corporate Affairs