NYSE internal-audit transition period — comment letter tracker

The IIA requests that the Commission extend the comment period by at least thirty days, to October 8, 2026.

the Proposal itself contains no supporting data or analysis: it identifies no population

investors whose protection Section 6(b)(5) of the Exchange Act makes the touchstone of the

No urgency attends this filing: the current one-year requirement has been in place for more than a decade, and the Exchange identifies no extenuating circumstance requiring resolution on a compressed schedule.

I respectfully urge the Commission to reject the proposed rule change or, at a minimum, conduct additional review before approving a reduction in protections that have served investors and public companies well for more than twenty years.

organizations need independent assurance most during periods of significant change and growth. The first years after an IPO are exactly that.

Internal audit provides boards and audit committees with an independent perspective that neither management nor external auditors are designed to provide.

many newly public companies are already exempt from SOX auditor attestation requirements for several years after their IPO.

companies have successfully implemented appropriately scaled internal audit functions through in-house, co-sourced, or outsourced models.

I am also not persuaded that the proposal presents sufficient evidence to justify such a significant change.

That is not a strengthening of investor protection; it is a reduction of it.

Effective governance should begin when a company enters the public markets, not five years later.

a reduction in protections that have served investors and public companies well for more than twenty years

For these reasons, I respectfully urge the Commission to reconsider the proposed extension and maintain a shorter transition period that ensures internal audit is implemented early in a company’s public journey.

it needs it most at the formative stage when systems, controls, and governance practices are still being built

A tiered transition period based on company size and complexity (e.g., one year for large accelerated filers, two years for smaller issuers).

this comparison should not be used to justify weaker standards

a significant step backward for investor protection and market integrity

Embedding internal audit into the governance framework from the outset of public life is essential to upholding the principles of accountability, transparency, and investor protection

This is why it is important that the rule of the 1 year requirement should remain unchanged.

Organizations during their first years of public offering are usually going through rapid changes which require independent assurance that internal controls are in place and effective.

By delaying for even a few years, the value that internal auditors can have at the onset would be greatly reduced.

we respectfully request that the Securities and Exchange Commission extend the public comment period for the proposed rule change to December 31, 2026.

runs counter to the SEC’s own emphasis on early, effective governance in high-risk environments

The current one-year requirement has been functioning

the Proposal is flying blind. It contains no supporting data

Commission is obligated to protect under Section 6(b)(5) of the Exchange Act

not delaying the standing up of the function, or making them smaller.

where technology accelerates risk at an unprecedented pace

like Enron, which severely hurt investors and the public at large

The current one-year requirement has been functioning for over a decade, and there is absolutely no emergency demanding a compressed resolution.

For these reasons, I respectfully urge the Commission not to approve the proposed extension from one year to five years.

The first several years following a public listing can involve rapid organizational change, increased financial and regulatory scrutiny, new reporting obligations

Internal audit also serves a fundamentally different purpose from external audit

Companies can adopt risk based approaches, use appropriately scaled internal resources, or supplement their capabilities through qualified third party providers.

preserving an important safeguard for investors and the integrity of the public markets

five years is not a temporary accommodation in any meaningful sense

I recognize that newly listed companies face substantial costs and competing demands as they transition into the public markets.

I respectfully encourage the Commission to disapprove of the proposed amendment and retain the existing one-year transition period.

support of the proposal—rapid growth, changing systems and controls, additional personnel, and competing regulatory demands—increase execution, reporting, compliance, and control risk.

are not effective substitutes for internal audit. Internal audit complements these

be exempt from the external-auditor attestation requirement under Section 404(b) for up

risk-based internal audit function within months, allowing the function to mature and

implementation challenges, it presents no empirical evidence that the existing one-year

The fact that Nasdaq does not impose a comparable internal audit requirement does not establish that weakening

protect investors or advance the public interest under Section 6(b)(5) of the Exchange

It also does not explain why a five-year period—as opposed to a more limited or targeted accommodation—is necessary.

Although the filing cites issuer concerns regarding competing obligations and implementation challenges,

With regard to this proposed change, I am in favor of the change.

new companies should be extended time to have to take on that cost

I respectfully urge the SEC to disapprove NYSE’s proposed rule change in File No. SR-NYSE-2026-37, which would extend the deadline for newly listed companies to establish an internal audit function from one year to five years.

I respectfully ask the Commission to disapprove it, or at minimum institute proceedings to examine the proposal more fully.

The earliest years of a newly public company are precisely when independent assurance is most important.

This work complements, rather than replaces, the work of external auditors and management.

A function can also be scaled to a company’s size and risk profile, including through co-sourcing or outsourcing arrangements, rather than postponed for five years.

I believe the proposal is not consistent with investor protection and the public interest.

For these reasons, I respectfully request that the Commission not approve SR-NYSE-2026-37 as proposed.

Significant organizational and technology changes create new risks

but they are not substitutes for an internal audit function

the internal audit function may be outsourced to a qualified third party, reducing the need for a newly listed company to immediately build a complete department internally

Public-company governance requirements should be strongest where they meaningfully protect investors, not simply where they are easiest for issuers to implement.

identifying weaknesses after processes and systems have been in place for several years is generally more difficult and costly than identifying them as they are being designed and implemented

I recognize that establishing an effective internal audit function requires planning and resources.

For these reasons, I respectfully encourage the Commission to reject the proposed five-year transition period and retain a substantially shorter timeframe for newly listed companies to establish an effective internal audit function.

Newly listed companies may experience rapid expansion, significant increases in transaction volume, new systems and processes, changes in leadership and staffing

nor does it replace the role of the independent external auditor

an organization may initially use a lean internal audit team, co-source specialized expertise, or outsource portions of the function

From an investor-protection perspective, the potential consequences of a five-year delay deserve particular consideration.

establishing an effective internal audit capability early can help an organization mature its governance and control environment as it grows rather than attempting to remediate deficiencies

I recognize the importance of reducing unnecessary regulatory burdens and allowing newly public companies reasonable flexibility as they transition to the public markets.

I respectfully urge the Commission to disapprove the proposed rule change.

significant change, risks and control gaps can emerge quickly because responsibilities, workflows, data,

be appropriately scaled and supported through co-sourcing or outsourcing.

control environments are developing, rather than waiting until practices and weaknesses have become

For these reasons, I respectfully urge the Commission to reject the proposed rule change and preserve the existing requirement that newly listed companies establish an internal audit function within one year of listing.

The first years following an initial public offering are often characterized by rapid

The internal audit function also provides audit committees with an independent

exempt from auditor attestation requirements under Section 404(b) of the Sarbanes-

change or, at a minimum, require a substantially greater evidentiary basis demonstrating

of Section 6(b)(5) of the Securities Exchange Act of 1934. The proposal would weaken a

Good governance begins when a company enters the public markets, not five years later.

evaluates governance, risk management, cybersecurity, operational resilience, third-party

an internal audit function because they are simultaneously managing growth, governance

The early post-listing period, marked by rapid growth, leadership transitions, and pressure to meet public-market expectations, is also a period when internal control breakdowns

Sarbanes-Oxley compliance is not an adequate substitute for an internal audit function.

The magnitude of the change deserves more justification than the filing provides.

The comparison to Nasdaq's listing standards is not a substantive justification.

This is a competitive-positioning argument, not an investor-protection argument.

If the difficulty is that one year is too short, the Exchange has not explained why five years, rather than two or three, is the appropriate remedy.

to build a capable internal audit function amid the demands of becoming a newly public company

For the reasons outlined above, I respectfully urge the Commission to disapprove SR- NYSE-2026-37.

companies often face rapid growth, increased regulatory scrutiny, heightened operational

distinct and complementary role that cannot be fully replicated by management, external

the current rule already permits companies to satisfy the internal audit

The period immediately following a public listing is critical for establishing a strong culture

options for compliance while managing costs and resource constraints.

I respectfully urge the Commission to disapprove the proposed rule change.

first years as a public company are when its systems and controls are being built, and when objective assurance over that work matters most

The current one-year requirement is met every year by companies of every size, precisely because the Exchange’s own rule allows the function to be outsourced or co-sourced

embedding operational discipline into daily workflows before bad habits or vulnerabilities could solidify

For these reasons, I respectfully urge the Commission to reject the proposed rule change and retain the current requirement that newly listed companies establish an internal audit function within one year of their IPO.

The years immediately following an IPO are often characterized by rapid growth, organizational change, new regulatory requirements, evolving management structures

Audit committees rely on internal audit as an independent source of information and perspective. Without that resource, oversight becomes more dependent on information provided by management

many newly public companies are already exempt from SOX auditor attestation requirements for a period following their IPO

Companies have successfully complied with this requirement for more than two decades through a variety of scalable approaches, including outsourced, co-sourced

The filing itself does not appear to include data demonstrating the magnitude of the alleged burden or the impact on investors.

before considering such a significant reduction in investor protections

independent assurance is most valuable when a company is establishing the foundation upon which its future growth and long-term performance will depend

Internal auditors evaluate operational risks, cybersecurity and technology risks, third-party relationships, supply chain resilience, compliance programs, fraud risks, data privacy practices

the current one-year requirement imposes an undue burden on newly listed companies

I urge the SEC to reject this proposal and maintain the current one-year requirement to safeguard market integrity and protect public investors.

Newly public companies are in a critical phase of building their governance systems and need independent assurance immediately

delaying this function deprives audit committees of their vital, independent channel of information apart from management.

Because most of these companies are already exempt from the Sarbanes-Oxley (SOX) auditor attestation

The NYSE has provided no empirical data or cost-benefit analysis to justify weakening investor protections

in a critical phase of building their governance systems

I respectfully urge the Commission to disapprove the proposed rule change.

first years as a public company are when its systems and controls are being built, and when objective assurance over that work matters most

The current one-year requirement is met every year by companies of every size, precisely because the Exchange’s own rule allows the function to be outsourced or co-sourced

By engaging early, internal audit helped build stronger foundations from the outset, reducing the need for costly remediation later

(2) not approve the proposed five-year transition period

(3) either retain the existing one-year requirement or institute proceedings to develop a fuller record concerning the costs, benefits, investor-protection consequences, and reasonable alternatives.

(1) grant the 30-day extension of the comment period requested by The IIA;

The period immediately before and after an initial public offering is characterized by rapid

SOX, external audit, and audit-committee oversight complement internal audit; they do not

exempt from the Section 404(b) auditor attestation requirement for up to five years

The existing NYSE rule expressly permits the function to be outsourced to a third-party provider

The Exchange also states that no written comments were solicited or received before the proposal

I believe a five-year delay would move in the wrong direction for investor protection

Internal audit may be most valuable while a company is building its governance

including operations, compliance, cybersecurity and information technology, fraud

it directly examines how capital-market participants valued an exchange-level requirement

However, the NYSE filing does not identify the number or characteristics of affected issuers.

address legitimate resource constraints while preserving timely independent assurance.

I respectfully urge the Commission not to approve the proposed five-year implementation period.

For these reasons, I respectfully urge the Commission to disapprove the proposed five-year implementation period or, at minimum, institute proceedings to more fully evaluate whether such a significant extension is justified.

Newly listed companies are adapting to the responsibilities of being public companies while continuing to develop their systems, internal controls, risk-management processes

The two functions are complementary rather than interchangeable.

existing exemptions from auditor attestation requirements under Section 404(b) of the Sarbanes-Oxley Act

Companies also have flexibility in how they establish the function, including through co-sourcing or outsourcing rather than immediately building a large internal department.

it does not provide quantitative evidence regarding the number of affected issuers, the magnitude of the costs imposed by the existing requirement, expected cost savings

such a substantial extension should be supported by evidence demonstrating that the benefits justify the potential reduction in investor protections

internal audit can address a broader range of risks on an ongoing basis, including operational, technology, cybersecurity, compliance, and data-privacy risks

The proposal reportedly cites burdens associated with the current one-year implementation period

I am asking, as a practicing Chief Audit Executive, for a 30-day extension so that more voices can be heard on this extension to five years.

precisely during the period when governance and controls are typically least mature and risk is highest

I believe this proposal is a significant rollback in investor protection

I hope this never materialises.

The proposed changes are a direct affront to the very foundational policy framework of the SEC and a diminition of the role and importance of audit.

I respectfully encourage the Commission to disapprove of the proposed amendment and retain the existing one-year transition period.

rapid growth, changing systems and controls, additional personnel, and competing regulatory demands-increase execution, reporting, compliance, and control risk.

Yet, these measures are not effective substitutes for internal audit.

Further, many newly public companies that qualify as emerging growth companies may be exempt from the external-auditor attestation requirement under Section 404(b) for up to five fiscal years.

audit professionals and third-party providers can assist boards and executive management in establishing an appropriately scaled internal audit function within months, rather than years.

it presents no empirical evidence that the existing one-year period has resulted in ineffective internal audit functions or unreasonable implementation burdens.

The fact that Nasdaq does not impose a comparable internal audit requirement does not establish that weakening the NYSE's existing standard would protect NYSE investors.

protect investors or advance the public interest under Section 6(b)(5) of the Exchange Act.

this is particularly important as a private company transitions to the heightened responsibilities and expectations associated with being publicly traded.

Although the filing cites issuer concerns regarding competing obligations and implementation challenges, it presents no empirical evidence that the existing one-year period has resulted in ineffective internal audit functions

It also does not explain why a five-year period-as opposed to a more limited or targeted accommodation-is necessary.

Although the filing cites issuer concerns regarding competing obligations and implementation challenges,

I don't anticipate that you will move the requirement from one to zero years, but at least don't change it to five years.

Reliance on the audit committee to provide meaningful governance without a functioning internal audit function is borderline laughable.

Companies have to do myriad things to get ready to go public - establishing an internal audit function should be one of them.

The proposal letter states that issuers on the Nasdaq are not required to have an internal audit function.

Investors have the right to know there is someone on the inside of the company who is independent, objective, and looking out for them.

Part of being a public company is having an internal audit function. That should be required before a company is allowed to go public, not five years later.

Newly listed companies often receive substantial investment funding for development, making it crucial for internal audit to step in

Compared with already established companies, new corporations are at a critical stage of building their culture.

I respectfully urge the Commission to disapprove the proposed rule change.

A company's first years as a public company are when its systems and controls are being built, and when objective assurance over that work matters most.

The current one-year requirement is met every year by companies of every size, precisely because the Exchange's own rule allows the function to be outsourced or co-sourced

The Internal Audit function is more important now than ever as AI becomes a part of every industry.

Newly listed companies often receive significant investment funding, making it essential for internal audit to ensure these resources are used responsibly

New companies are also in the critical phase of shaping their culture. If the tone at the top lacks ethical direction, correcting course later becomes extremely difficult.

The transition to public ownership brings increased risks, regulatory requirements, and expectations for strong internal controls.

I advise the SEC to reject this proposal and maintain the current one-year requirement to protect public investors and maintain market integrity.

The Internal Audit function provides vital, independent assurance at a critical time when newly public companies are building their governance, risk management, and control processes.

Delaying this requirement could leave investors, audit committees, and other stakeholders without an important source of independent insight during their early formative years.

during their early formative years

I respectfully urge the SEC to reject the proposed rule change and preserve the current requirement for newly listed companies to establish an internal audit function within one year.

The years immediately following an initial public offering are among the most important in a company's lifecycle.

Internal audit serves as an independent source of assurance and insight for boards and audit committees

the proposal appears to weaken investor protections without a corresponding body of evidence demonstrating that the benefits outweigh the risks

I am also concerned that the proposal appears to weaken investor protections

Newly public companies are expected to build and mature governance, risk management, and internal control frameworks

Today's risk environment is also significantly more complex than when many existing governance requirements were established.

Because of this, I urge the SEC to reject this proposal and maintain the current one-year requirement.

investors may not have the full picture they need to trade comfortably

I understand that it may take time to formally establish an internal audit team and their procedures

For these reasons, I respectfully recommend that the Commission disapprove SR-NYSE-2026- 37 as currently proposed or institute proceedings to develop a sufficient evidentiary record and consider a risk-based, phased alternative.

For these reasons, I respectfully recommend that the Commission disapprove SR-NYSE-2026- 37 as currently proposed or institute proceedings to develop a sufficient evidentiary record and consider a risk-based, phased alternative.

systems, controls, risk-management practices, and governance structures are undergoing

The other safeguards identified by NYSE are important, but they are not functional substitutes

large or fully mature internal audit department within its first year

The present filing states that issuers have expressed concerns, but it does not quantify the

demonstrate consistency with the Exchange Act and that a mere assertion of consistency is

governance practices are easier to evaluate and improve while they are being developed than

may reduce information asymmetry through identification and communication of internal-control issues

emphasized that the transition was limited in duration

The present filing does not adequately explain what has changed to justify increasing that transition period fivefold.

I support reasonable efforts to reduce unnecessary compliance burden on newly

For these reasons, I encourage the Commission to reject the proposed extension and retain the existing one-year requirement.

The period immediately following a public listing is often characterized by significant growth, change, and increased risk.

I respectfully request that the Commission disapprove SR-NYSE-2026-37 or require the NYSE to adopt a substantially shorter, phased transition period

The period immediately following a public listing can involve rapid growth, evolving systems, new personnel, increased regulatory obligations

Sarbanes-Oxley requirements, management certifications, external-auditor attestations, and audit-committee oversight do not replace an internal audit function.

A small internal team, a co-sourced arrangement, or another appropriately resourced model could satisfy the requirement

The proposal does not establish that existing audit-committee, management-certification, external-audit, and Sarbanes-Oxley requirements provide an adequate substitute for internal audit

Nor does the fact that another exchange may not require an internal audit function demonstrate that weakening the NYSE requirement is consistent with investor protection.

a phased approach would better protect investors than a categorical five-year exemption

Waiting five years may allow ineffective controls, unclear responsibilities, weak governance practices, and unidentified risks to become embedded in the organization.

The proposal states that newly public companies often are upgrading their accounting systems, internal controls, and staffing.

I urge you to reconsider this proposal.

at the exact moment when risks are greatest and controls are least mature

The SEC should REJECT this request from the NYSE.

If a company cannot implement an internal audit function within one year of going public, that company IS NOT READY to go public.

the NYSE fails to provide any evidence to support this allegation beyond referencing general anecdotes from some issuers.

This proposal is a significant step BACKWARD for good governance.

However, the NYSE fails to provide any evidence to support this allegation beyond referencing general anecdotes from some issuers.

The NYSE alleges that complying with the current one-year implementation timeline creates

I respectfully urge the Commission to disapprove the proposed rule change.

would leave newly public companies without an important mechanism for identifying and addressing risks during one of the most significant transitions

Internal audit helps leadership and boards make informed decisions by providing objective assessments of risk management and control activities.

The current one-year requirement is met every year by companies of every size

Five years without it is not a transition; it is an absence, during the years investors can least afford one.

first years as a public company are when its systems and controls are being built, and when objective assurance over that work matters most

The SEC should reject the proposal on File number SR-NYSE-2026-37, as it is detrimental to investors.

precisely during the period when governance and controls are typically least mature, the risk is high

The SEC should reject the proposal on File number SR-NYSE-2026-37, as it is detrimental to investors.

the incentives for management to sweep information under the rug (and away from investors) are the highest

only really benefits registrants with potential lower costs of not having the function

For those reasons, I encourage the Commission to reject the proposed rule change and retain the current standard.

Delaying that oversight for five years creates a significant gap during a period when organizations are often experiencing rapid growth and change.

Internal audit is also one of the few functions that provides independent feedback to both management and the audit committee.

I am also concerned that many newly public companies are already exempt from certain SOX attestation requirements for a period after going public.

For more than twenty years, companies have found practical ways to comply, whether through a small internal team, co-sourcing arrangements, or outsourced internal audit services.

The proposal also does not appear to provide meaningful evidence that the current one-year requirement is creating a widespread burden for issuers.

maintaining the existing one-year requirement better supports strong governance, effective board oversight, and investor confidence

The first few years after an IPO are when companies are building and refining the processes, controls, and governance structures they will rely on going forward.

the current one-year requirement is creating a widespread burden for issuers

I respectfully urge the Commission to disapprove the proposed rule change.

A company’s first years as a public company are when its systems and controls are being built, and when objective assurance over that work matters most.

The current one-year requirement is met every year by companies of every size

This outside perspective helped organizations build stronger control environments from the outset

For these reasons, I respectfully urge the Commission not to approve the proposed five-year extension and to retain the existing requirement that newly listed companies establish an internal audit function within one year.

The years immediately following a public listing are precisely when independent internal audit oversight can be most valuable.

That role cannot simply be replaced by management’s responsibility for internal controls or by the work of the external auditor.

The existing one-year transition period already provides companies time to establish that capability.

Strong governance should develop alongside a company’s access to the public capital markets, not years afterward.

I recognize that newly public companies face significant demands and that establishing an effective internal audit function requires resources.

I respectfully urge the Commission to reject the proposed extension and maintain the current requirement that newly listed companies establish an internal audit function within one year of listing.

heightened risks associated with growth, governance development, regulatory compliance, and control maturity

the benefits of independent assurance and investor protection

While newly listed organizations may face competing priorities and resource constraints

I respectfully urge the Commission not to approve the proposed five-year implementation period.

For these reasons, I respectfully urge the Commission to disapprove the proposed five-year implementation period or, at minimum, institute proceedings to more fully evaluate whether such a significant extension is justified.

Newly listed companies are adapting to the responsibilities of being public companies while continuing to develop their systems, internal controls, risk-management processes

I also do not believe that external audit should be viewed as an adequate substitute for internal audit.

I am particularly concerned by the interaction between this proposal and existing exemptions from auditor attestation requirements under Section 404(b) of the Sarbanes-Oxley Act.

Companies also have flexibility in how they establish the function, including through co-sourcing or outsourcing rather than immediately building a large internal department.

does not provide quantitative evidence regarding the number of affected issuers, the magnitude of the costs imposed by the existing requirement, expected cost savings

such a substantial extension should be supported by evidence demonstrating that the benefits justify the potential reduction in investor protections

internal audit can address a broader range of risks on an ongoing basis, including operational, technology, cybersecurity, compliance, and data-privacy risks

The proposal reportedly cites burdens associated with the current one-year implementation period

For these reasons, I respectfully ask the Commission to disapprove the Proposal, or to require the Exchange to refile it with the evidentiary support

precisely the period in which its control environment is least mature and most likely to have gaps

it is not a redundant layer sitting alongside SOX compliance, it is frequently the mechanism that makes SOX compliance possible in substance rather than on paper

many newly public companies qualify for extended exemptions from the auditor attestation requirement

An issuer that intends to build a capable function can do so within a year

It identifies no population of affected issuers, quantifies no burden associated with the current one-year requirement

offers no analysis of the investor-protection consequences of a five-year transition

the inconvenience of building the oversight functions that public status is supposed to require

Absent a real evidentiary basis, the Commission should not treat a bare assertion of unnamed issuer discomfort as sufficient grounds to weaken a governance requirement

alongside the accounting-system upgrades and staffing the Exchange cites as competing priorities

I respectfully urge the Commission to carefully evaluate the investor protection, governance, and oversight implications of this proposal and to consider disapproving the rule change or undertaking additional review

during the period when independent assurance is arguably needed most

audit committees would lose access to an independent source of information and insight for an extended period, increasing their reliance on management reporting alone

Most newly listed companies are already exempt from the Sarbanes-Oxley auditor attestation requirements over internal control for up to five years following their initial public offering.

The filing does not include data regarding the number of companies affected, the magnitude of the alleged compliance burden, expected cost savings, or the potential impact on investors.

carefully evaluate the investor protection, governance, and oversight implications of this proposal

Newly public companies are establishing the systems, controls, and governance processes that will support them for years to come.

Before reducing a longstanding governance protection that has been in place for more than two decades

the magnitude of the alleged compliance burden

I’m writing to respectfully request an extension for the public comment period for the proposed rule change for SR-NYSE-2026-37.

as AI continues to reshape how organizations operate, the need for trust will only grow

I respectfully urge the Commission to extend the comment period and disapprove the Proposal.

I therefore request that the September 8 deadline be extended by at least one month so affected groups have a meaningful opportunity to review and comment.

A company’s first years in the public markets are precisely when its systems and controls are being built and independent assurance and advice matter most.

Companies of every size can meet the current one-year requirement because the rule permits the internal audit function to be outsourced, co-sourced, and scaled appropriately.

the Exchange acknowledges that it did not solicit stakeholder feedback before filing

The Commission should disapprove this proposed rule change.

I ask the Commission to institute proceedings under Section 19(b)(2)(B) for the purpose of disapproving the filing under Section 19(b)(2)(C)(ii).

The Exchange treats the control immaturity of a newly listed company as the reason to defer assurance.

does not leave a supplement absent. It leaves the position unfilled.

Emerging growth companies are exempt from the Section 404(b) auditor attestation for up to five

Section 303A.07(c) already permits a listed company to source the internal audit function from a third

The Exchange further reports that no written comments were solicited or received

The filing relies substantially on the observation that Nasdaq imposes no internal audit requirement

Section 6(b)(5) without analyzing the effect of the change on investors.

Organizations do not develop assurance discipline on a schedule. They develop it under pressure,

cybersecurity, third-party and vendor risk, data privacy, regulatory compliance, supply chain

They raise the discount investors apply to comparable issuers.

In 2013 the Exchange asked the Commission to extend the existing one-year transition period to

It does not identify what has changed in the intervening thirteen years.

A rationale that supported twelve months in 2013 cannot, without more, support sixty months in 2026.

I strongly support maintaining the requirement for listed companies to establish an Internal Audit function within their first year of listing.

significantly increasing governance, compliance, and internal control risks during a critical period of growth and change

The proposal provides little evidence that extending the timeline to five years would meaningfully reduce burden

CII therefore respectfully requests that the SEC disapprove the Proposed Amendments.

the Section 404(b) Requirement, they may have concluded that there would not be sufficient

Exchange Commission (SEC) has a current proposal that would effectively provide initial public

language of Section 6(b)(5) of the Securities

accounting failures of the early 2000s, including Enron and WorldCom

I respectfully urge the Commission to disapprove the proposed rule change.

when its systems and controls are being built, and when objective assurance over that work matters most

The current one-year requirement is met every year by companies of every size

Striking the right balance between agility and appropriate oversight requires a strong tone at the top.

For these reasons, I respectfully urge the Commission to disapprove the proposal, or to institute proceedings to fully examine its consequences for investors before any such change is approved.

For these reasons, I respectfully urge the Commission to disapprove the proposal, or to institute proceedings to fully examine its consequences for investors before any such change is approved.

That is exactly the window in which governance is least mature and risk is highest

with no one on the other side of the table for five years, deepening their dependence on the very management they are charged with overseeing

Most newly public companies are already exempt from the SOX Section 404(b) auditor attestation over internal control for up to five years post-IPO

by appointing a chief audit executive with a co-sourced or outsourced provider, or by building a small team scaled to their risks

The filing offers no evidence to justify the rollback. It identifies no population of affected issuers, quantifies no burden or cost savings

Section 6(b)(5) of the Exchange Act requires that exchange rules protect investors and the public interest

A newly public company spends its first years building the systems, controls, and governance practices it will rely on for decades.

internal audit looks forward and continuously across cyber, technology, operations, supply chain, data privacy, and compliance risk

weakening it now reverses more than two decades of hard-won investor protection

You have the opportunity to shut down this ability to hide questionable behavior for this extended time.

I would be interested to know why this rule is even being proposed - what lobbyists are pushing for this change?

I was very disheartened to hear about NYSE Proposed Rule Filing SR-NYSE-2026-37.

For these reasons, I respectfully urge the Commission to disapprove the proposed rule change.

These pressures can increase risk to investors and the company's broader stakeholder community, strengthening the need for early, objective assurance.

An independent audit committee provides oversight, but it does not itself generate independent information.

Section 404(b) does not apply to every newly public company during this period

a company can establish a small, risk-based function scaled to its circumstances, including through outsourcing

The proposal provides no meaningful data showing that the current deadline is unworkable

Nasdaq's lack of a comparable requirement establishes only that the exchanges have different listing standards.

Early attention to these areas can prevent weaknesses from becoming embedded

Internal Audit has been critical beyond financial reporting in areas such as non-financial reporting, data integrity, privacy, cybersecurity

The proposal provides no meaningful data showing that the current deadline is unworkable, that five years is necessary, or that the asserted burden outweighs the resulting assurance gap.

The one-year requirement need not impose an excessive burden.

For these reasons, I respectfully urge the SEC to reject the proposed rule change or require further analysis and stakeholder input before taking action.

Newly public companies often face significant operational, compliance, technology, and financial reporting risks while their governance structures and control environments are still maturing.

Extending the implementation period to five years could leave investors and boards with less visibility into emerging risks and control weaknesses

Risks should be identified early and often to prevent major reputational and shareholder loss.

For these reasons, I respectfully request that the Commission retain the existing one-year requirement and disapprove the proposed rule change.

At a minimum, the Commission should institute formal proceedings to evaluate the proposal and obtain additional evidence before taking action.

The years immediately following a public listing can present heightened risk.

External audit, management certifications, and audit committee oversight are important protections, but they do not replace internal audit.

This concern is compounded by the external auditor attestation exemptions available to many newly public companies.

Newly listed companies can meet the requirement through a risk-appropriate internal team, a co-sourced arrangement, or an outsourced provider

The NYSE filing does not provide quantitative evidence regarding the number of companies affected

risk professionals are able to recommend building controls into the processes as they are created

Internal audit provides broader and ongoing assurance over risks such as cybersecurity, technology, operations, supply chain, data privacy, fraud, regulatory compliance, and governance.

The challenges of building an internal audit function do not justify a five-year delay.

Newly listed companies typically experience rapid growth, immature processes, and evolving governance structures.

This creates an environment where issues may be concealed, minimized, or unaddressed, impairing the quality of information available to boards, audit committees, and investors.

This gap is inconsistent with the SEC's mandate to safeguard investors.

Requiring internal audit within one year ensures companies build foundational controls early.

exposes investors to heightened risk of misstatement, fraud, cybersecurity vulnerabilities, and operational failures

We should not lose sight of market history or the well-documented failures of companies that did not establish, maintain, or evolve their internal control and audit capabilities.

I therefore respectfully urge the Commission to disapprove the proposed rule change

at minimum, institute proceedings to examine more fully its effects on corporate governance, audit committee effectiveness, investor protection, and the overall assurance environment of newly listed companies.

The first years after a company becomes publicly listed are typically a period of significant institutional development.

Other assurance mechanisms therefore should not be considered substitutes for internal audit.

many newly public companies may already operate for several years without auditor attestation over internal control pursuant to existing exemptions

An effective internal audit function also does not necessarily require a large department.

I am also concerned by the limited evidence presented for such a significant change.

I see little justification for concluding that such a component should only become necessary five years after a company enters the public markets.

Its scope can extend well beyond financial reporting to areas such as cybersecurity, technology, regulatory compliance, operations, third-party risk, data governance

I see little justification for concluding that such a component should only become necessary five years after a company enters the public markets.

A general assertion that establishing internal audit can be difficult or costly does not, by itself, justify such a substantial reduction in assurance.

I am writing to respectfully express my strong opposition to extending the current one-year requirement for newly listed public companies to establish an internal audit function to five years.

The first few years as a public company are often when organizations are building new processes, strengthening controls, and adapting to increased regulatory and investor expectations.

For these reasons, I urge the Commission to disapprove the proposed rule change.

Newly public companies are establishing governance frameworks, internal controls, and risk management processes while facing heightened regulatory, operational, and reporting risks.

For these reasons, I respectfully urge the SEC to reject the proposed rule change and maintain the existing one-year requirement for newly listed companies to establish an internal audit function.

The years immediately following an IPO are often characterized by rapid growth, organizational change, evolving processes, and developing control environments.

without both internal audit oversight and other forms of independent assurance would significantly reduce transparency and oversight available to investors and audit committees

many newly public companies already benefit from exemptions related to auditor attestation of internal controls

companies have successfully implemented appropriately scaled internal audit functions through in-house, co-sourced, or outsourced models

the proposal does not appear to provide sufficient evidence demonstrating that the current one-year requirement imposes an unreasonable burden

as these foundational governance structures mature

I respectfully urge the Commission to reject the proposed extension and preserve the current one-year requirement.

The early years following a public listing are precisely when governance, reporting processes, technology, and internal controls are evolving, while business and regulatory demands are increasing.

The existing requirements cited by the NYSE do not replace internal audit.

Internal audit does not need to begin as a large or heavily resourced function. A proportionate, risk-based capability can be established and scaled as the company matures.

Strong governance should be part of a public company’s foundation, not introduced after risks and control weaknesses have had years to develop.

As an auditor for more than 20 years I strongly oppose the proposal to extend - from one year to five years - the deadline for newly listed companies to stand up their required internal audit function.

I also ask the SEC for a 30-day extension so more voices can be heard on this important matter.

precisely during the period when governance and controls are typically least mature and risk is highest

I believe that it is a significant rollback in investor protection

Periods of significant organizational transition often carry increased risk. Processes are changing, responsibilities may be shifting, new systems and controls may be implemented

Management oversight and external audit provide important safeguards, but they do not necessarily provide the same ongoing, enterprise-wide independent assessment of risk, governance, and controls

An internal audit function does not need to be fully mature on day one to begin providing this value.

as the company grows into its responsibilities as a public entity

This value is not limited to accounting or financial reporting.

I respectfully urge the SEC to reconsider the proposed five-year delay and maintain a shorter timeframe for the internal audit requirement.

I also support extending the public comment period so that investors, audit professionals, public companies, and other stakeholders have adequate opportunity to evaluate and comment on the proposal.

The first several years following a public listing are a critical period in which companies establish and strengthen their governance, risk management, internal controls

Delaying this requirement for five years could leave investors without an important governance safeguard during a company's formative years as a public company.

when risk is often heightened and governance practices have not yet fully matured.

Internal audit provides boards and audit committees with an independent source of

For more than two decades, companies have successfully complied with the requirement

We are also concerned that the proposal does not provide supporting evidence

independent assurance is particularly valuable during the early years of a company's life

For these reasons, I respectfully urge the Commission to disapprove the proposal or institute proceedings to examine it more fully.

For these reasons, I respectfully urge the Commission to disapprove the proposal or institute proceedings to examine it more fully.

precisely when its systems, controls, and governance are least mature and risk is highest

For five years, no one would sit on the other side of that table, leaving directors dependent on the management they are charged with overseeing.

most newly listed companies are Emerging Growth Companies, already exempt from 404(b) attestation for up to five years after IPO

For more than two decades, issuers have met this requirement through a chief audit executive with a co-sourced or outsourced provider, or a small team scaled to their risks.

The filing offers no evidence. It identifies no population of affected issuers, quantifies no burden, estimates no cost savings, and analyzes no investor consequences.

That Nasdaq imposes no such requirement is a reason to preserve the NYSE's standard, not to lower it toward a weaker one.

A newly public company is building the control environment it will rely on for decades.

internal audit examines the full risk picture - cyber, technology, operations, data privacy, and compliance - continuously

A change of this magnitude to a post-Enron governance safeguard warrants an evidentiary record, not assertion.

It rests on anecdotes from unnamed issuers, yet proposes a 400% extension of the timeline.

For these reasons, I strongly encourage the Commission to preserve the existing requirement and continue recognizing the vital role internal audit plays in protecting investors and supporting healthy, well-governed public companies.

Organizations transitioning to the public markets face heightened risks stemming from rapid growth, increased regulatory obligations, evolving business processes, expanding operations

An effective internal audit function is a foundational component of strong corporate governance.

I therefore encourage the SEC and NYSE to reconsider the proposed five-year transition period.

Newly public companies are adapting to the demands of public-company reporting, governance, internal controls, and increased investor scrutiny.

Internal audit provides a perspective that is fundamentally different from management, the audit committee, and the external auditor.

Internal audit functions do not necessarily need to be large or expensive.

I recognize that establishing an internal audit function can create costs and administrative challenges for newly public companies.

I urge the SEC to reject the proposal and retain the current one-year requirement.

deprive audit committees of a key source of information independent of management

Because most are already exempt from SOX auditor attestation requirements

The NYSE has offered no empirical evidence or cost-benefit analysis to support this reduction in investor protections.

New public companies need independent assurance from the start.

For these reasons, I respectfully urge the Commission to disapprove the proposal or open formal proceedings to evaluate its impact on investors and market integrity.

For these reasons, I respectfully urge the Commission to disapprove the proposal or open formal proceedings to evaluate its impact on investors and market integrity.

during the period when risks are highest and controls are least mature

would leave audit committees without an independent channel

In practice, companies can meet the requirement through a small internal team

The proposal also provides no data showing that the current one-year timeline is burdensome.

The first year is when systems, controls, and reporting processes are still forming

The first five years of a company is an extremely risky time period, and adequate controls must be in place.

Companies should work on creating their internal audit function during the time in which they are preparing to take their company public.

Companies should work on creating their internal audit function during the time in which they are preparing to take their company public.

I agree with the NYSE's prior comments that having a robust internal audit function is a key component of sound corporate governance and therefore ask that you reconsider this proposal to change the existing requirement.

Waiting five years for newly listed companies to establish an internal audit function is definitely a step backwards for corporate governance.

Accordingly, I respectfully suggest that the Commission consider alternatives rather than adopting the full five-year extension.

The period immediately following an IPO is often when companies experience rapid growth, organizational change, new regulatory obligations, and increased operational complexity.

internal audit provides a unique and important line of assurance that complements management and external audit activities

The NYSE already permits the internal audit function to be outsourced to an independent third-party provider.

I encourage the Commission to carefully evaluate whether a five-year transition period appropriately balances issuer burden with investor protection objectives

extending the transition period to five years would result in a significant portion of a company's early public-company lifecycle operating without a dedicated internal audit function

I appreciate the NYSE's recognition that newly public companies must devote considerable resources to complying with public company reporting obligations

I am writing to implore you to reconsider extending the required time frame from 1 to 5 years for newly listed NYSE companies.

Instead, you should be looking to have Nasdaq have the same 1-year requirement of the NYSE to provide consistency and close this loophole.

Internal Audit matters and having them tied to the organization from the outset of going public is critically important.

Do you really want another Enron or Worldcom corporate failure?

Internal audit functions are not costly overall but provide so much value to their companies and for the investing public.

I respectfully urge the Commission to disapprove the proposed rule change.

A public company's first years are when its systems and controls are being built, and when objective assurance over that work matters most.

The current one-year requirement is met every year by companies of all sizes because the Exchange's rule allows the function to be outsourced, co-sourced, and scaled to the company.

I respectfully urge the Commission not to approve the proposal as submitted.

The years immediately following a public listing are often characterized by rapid growth, evolving systems, significant organizational change, and heightened operational and compliance risk.

external-auditor requirements are important safeguards, but they do not replace an internal audit function's broader and continuous evaluation

during precisely the period when governance and control frameworks may be least mature

broader and continuous evaluation of governance, risk management, operational controls, technology, compliance, and emerging risks

For these reasons, I respectfully urge the Commission to disapprove the proposed rule change

or, at minimum, to institute proceedings under Section 19(b)(2)(B) of the Securities Exchange

still building the control environment they will operate under for years to come

because audit committees need a source of information that does not run through management.

the SOX internal control auditor attestation for up to five years, and a separate pending SEC

company's risk profile starting with a chief audit executive and a co-sourced or outsourced

the NYSE's filing does not include any supporting data: no count of how many issuers this would

it just means the company operates through its most formative period without anyone

no quantification of the burden the current one-year requirement imposes

I strongly urge the Commission to reject this proposal and maintain the current one-year transition period to ensure newly public companies remain accountable, secure, and transparent from the outset.

leaves organizations highly exposed during their most vulnerable, high-growth phase

While external auditors focus primarily on historical financial metrics, an internal audit function is uniquely equipped to continuously evaluate these real-time operational risks

Relaxing these safeguards to compete with exchanges that lack robust internal audit mandates creates a harmful

to ensure newly public companies remain accountable, secure, and transparent from the outset

the operational landscape today is vastly more complex and volatile than it was two decades ago

The devastating financial statement fraud scandals of the early 2000s-most notably Enron and WorldCom-wiped out billions of dollars in investor wealth

While I understand the desire to reduce regulatory burdens for newly public entities

I urge the SEC to maintain the current one‑year requirement.

when controls and governance are least mature

For these reasons, I respectfully urge the Commission to disapprove the proposed amendment and retain the existing one-year transition period.

I also support The Institute of Internal Auditors' request for additional time for public comment.

Periods of rapid organizational change are precisely when risks can evolve faster than governance structures and controls.

Internal audit is not redundant with an independent audit committee, Sarbanes-Oxley compliance, external audit, or CEO and CFO certifications.

Section 303A.07 permits a company's internal audit function to be outsourced to a third-party service provider other than its independent auditor.

the filing does not quantify the cost or burden imposed by the existing requirement

The fact that Nasdaq does not require an internal audit function does not demonstrate that the NYSE requirement lacks value

evaluate the investor-protection consequences of permitting companies to operate for five years without the function

help prevent immature practices from becoming institutionalized

Internal audit can assess risks involving operations, regulatory compliance, technology, cybersecurity, third parties, governance, fraud risk, data, business continuity, conduct

The filing instead refers generally to concerns raised by issuers, while also stating that no written comments were solicited or received with respect to the proposed rule change.

Before weakening a longstanding corporate governance requirement to this extent, there should be compelling evidence that the existing rule creates a material problem and that a five-year exemption is appropriately tailored to address it.

the operational difficulty of building a mature internal audit department does not, by itself, justify

Keep 1 year as the requirement.

Internal Audit can provide valuable advisory work to help set up the right internal control and governance structures from Day 1 of the company.

I respectfully encourage the Commission to disapprove the proposed five-year extension or consider a more proportionate phased implementation approach.

particularly during a period when systems, controls, management structures and regulatory obligations are themselves changing rapidly

Management assessment, external audit, audit committee oversight, all perform different governance roles.

the existing ability to outsource or co-source internal audit provides a proportionate alternative

If the principal concern is the practical difficulty of building a mature in-house function during the first year after listing

For these reasons, I urge the Commission to disapprove the proposal, or open formal proceedings under Section 19(b)(2)(B) of the Securities Exchange Act.

For these reasons, I urge the Commission to disapprove the proposal, or open formal proceedings under Section 19(b)(2)(B) of the Securities Exchange Act.

a newly public company's control environment is most fragile in its first months as a public issuer

NYSE's own listing standards direct audit committees to meet periodically, and separately, with internal auditors.

neither an internal audit function nor an external attestation over internal control

the current one-year timeline is workable

includes no data on the issuers affected, the costs involved, or the expected impact

We therefore urge the Commission to disapprove the proposed rule change or institute proceedings under Section 19(b)(2)(B) of the Securities Exchange Act to determine whether it should be

We therefore urge the Commission to disapprove the proposed rule change or institute proceedings under Section 19(b)(2)(B) of the Securities Exchange Act to determine whether it should be

a time when systems, controls, and governance practices are still being built

a purpose no other safeguard duplicates: it gives the board and audit committee an objective,

Most newly listed companies are exempt from the Sarbanes-Oxley auditor attestation over

permits the function to be outsourced, and newly listed companies routinely comply by appointing

the filing identifies no affected population, quantifies no burden

so that a change of this consequence receives the scrutiny

Independent assurance should begin at the foundation of a

they say nothing about the cybersecurity, emerging technology,

The internal audit listing requirement is a legacy of hard lessons.

audit is a high-value, cost-effective protection

I respectfully request that the SEC extend the public comment period for File No. SR-NYSE-2026-37 by at least 30 days.

internal audit provides critical independent assurance during the formative years of an organization's governance and control environment

the proposal contains limited supporting data regarding the population of affected issuers

It is requested that the required period for independent internal audit should be kept to one year.

precisely during the period when governance and controls are typically least mature and risk is highest

With AI, the timelines should rather reduce when nimble organizations would be growing to list.

Please do not extend the transition period to longer than one year for public companies to stand up their Internal Audit teams for the sake of the overall health of our financial markets.

especially at a time when organizations are in their formative years

I was in school when Enron fell and it ruined the retirement of a friend of mine's mother

Investors need assurance most at the start, not five years later.

It is not that far in the past that SOX was established due to fraudulent behavior that left millions without jobs

I believe that maintaining the current requirement, or considering a more limited alternative extension, would better support the interests of investors and the integrity of the public markets.

During this period of rapid growth and increased stakeholder expectations, independent assurance becomes particularly valuable.

Organizations have flexibility to implement scalable internal audit solutions, including the use of qualified third-party providers where appropriate.

whether extending the implementation period from one year to five years is consistent with the objectives of sound corporate governance and investor protection

Investors benefit when companies establish strong governance structures early and demonstrate a commitment to effective oversight and accountability.

I recognize that newly listed companies face numerous competing priorities and compliance obligations

I believe that maintaining the current requirement, or considering a more limited alternative extension, would better support the interests of investors and the integrity of the public markets.

During this period of rapid growth and increased stakeholder expectations, independent assurance becomes particularly valuable.

Organizations have flexibility to implement scalable internal audit solutions, including the use of qualified third-party providers where appropriate.

whether extending the implementation period from one year to five years is consistent with the objectives of sound corporate governance and investor protection

Investors benefit when companies establish strong governance structures early and demonstrate a commitment to effective oversight and accountability.

While I recognize that newly listed companies face numerous competing priorities and compliance obligations

For these reasons, I urge the Commission to disapprove the proposed rule change or undertake further review of its implications for investors and market confidence.

The years immediately following an IPO are when companies are developing the governance structures, risk management processes, and internal controls that investors rely upon.

Internal audit also serves as an important independent resource for audit committees.

many newly public companies are already exempt from certain Sarbanes-Oxley internal control attestation requirements

the proposal does not provide sufficient evidence demonstrating that the benefits of a five-year delay outweigh the reduction in investor protections

Before weakening a governance safeguard that has been in place for more than two decades, the SEC should require a stronger factual basis supporting the change.

Independent assurance is most valuable during this formative period, not five years later.

I respectfully urge the Commission to reconsider the proposed five-year extension and maintain a timeframe that ensures newly listed companies implement an effective internal audit function much earlier in their transition to public ownership.

I also encourage the SEC to provide additional opportunity for stakeholder feedback by extending the public comment period.

a period when companies are experiencing rapid growth, increasing complexity, and heightened investor scrutiny

discourage organizations from establishing robust governance practices early in their public company lifecycle

I urge the Commission to disapprove this proposed rule change, or at minimum to require NYSE to justify a substantially shorter extension supported by evidence, rather than an open-ended five-year window with no interim milestones or accountability.

Five years is also precisely the period in which newly public companies face the greatest pressure: rapid growth, new reporting obligations, leadership turnover

The filing leans heavily on Sarbanes-Oxley Sections 302, 404, and 906 as sufficient substitutes. They are not.

to require NYSE to justify a substantially shorter extension supported by evidence, rather than an open-ended five-year window with no interim milestones or accountability

The comparison to Nasdaq's lack of an internal audit requirement is not a reason to weaken NYSE's own standard.

what happens when a company's internal control environment is left to mature informally rather than being built and tested early

or at minimum to require NYSE to justify a substantially shorter extension supported by evidence, rather than an open-ended five-year window with no interim milestones or accountability.

A five-year gap does not give a young public company breathing room

For these reasons, I respectfully request that the SEC reject the proposed five-year extension and retain the existing one-year requirement.

Newly public companies are also undergoing significant changes as they adapt to public-company reporting, governance, regulatory, and operational requirements.

These requirements are important, but they do not replace internal audit.

The existing one-year transition period already provides companies with reasonable time to establish an appropriate internal audit function

Investor protection and effective corporate governance should remain the primary considerations.

A newly public company should have appropriate independent oversight of its risk management and internal control environment from the outset

while recognizing the challenges of becoming a public company

I respectfully urge the Commission to disapprove the proposed rule change.

Five years without it is not a transition; it is an absence, during the years investors can least afford one.

The current one-year requirement is met every year by companies of every size

A company's first years as a public company are when its systems and controls are being built, and when objective assurance over that work matters most.

For these reasons, I respectfully urge the SEC to reject the NYSE proposal and maintain the existing requirement that newly listed companies establish an internal audit function within one year of listing.

The SEC should ensure that investors, governance professionals, audit practitioners, academics, and other stakeholders have sufficient opportunity to assess and comment on the potential consequences of this change.

These risks do not diminish immediately after an IPO; rather, they are often heightened during the first several years as companies scale rapidly

Without this function, boards and audit committees may have diminished visibility into operational risks, control failures, regulatory compliance issues

Establishing an internal audit function within the first year after listing strikes an appropriate balance between implementation challenges and investor protection.

The NYSE has not demonstrated that the existing one-year requirement imposes an unreasonable burden on newly listed companies.

Public companies are expected to maintain governance structures commensurate with their responsibilities to shareholders and the public markets.

The NYSE has not demonstrated that the existing one-year requirement imposes an unreasonable burden on newly listed companies.

imposes an unreasonable burden on newly listed companies

I respectfully urge the Commission to disapprove the proposed rule change.

A company's first years as a public company are when its systems and controls are being built, and when objective assurance over that work matters most.

Internal audit also provides audit committees with an objective view of whether management's control environment is developing at the same pace as the business.

Internal audit can be established quickly, scaled to the size and risk profile of the organization, and supported by outside specialists where needed.

a newly public company is building the infrastructure, discipline, and accountability expected of a public company

If the Commission approves this extended transition period, I would urge a tiered approach based on the current filer status framework.

The NYSE's rationale relies heavily on the argument that Sarbanes-Oxley Section 404 requirements, CEO/CFO certifications, and independent audit committee oversight

Large Accelerated Filer threshold to $2 billion and exempt significantly more public companies from Section 404(b) auditor attestations.

proposal risks embedding the perception within newly public companies that internal audit exists solely to support financial reporting and ICFR.

enterprise risk, including operational risk, cybersecurity, data privacy, fraud, third-party governance, product safety, regulatory compliance, and artificial

small emerging-growth company faces significantly different resource constraints than a large-scale IPO valued at tens or hundreds of billions of dollars.

I respectfully urge the Commission to disapprove the proposed rule change.

the most consequential control weaknesses often arise when systems, processes, and governance structures are still being designed and implemented

Independent assurance provides an objective perspective that helps leadership and boards understand whether risks are being appropriately identified and managed.

the Exchange's own rule allows the function to be outsourced or co-sourced and scaled to the company

The organizations that established internal audit early were better positioned to identify control gaps, strengthen accountability

I urge the Commission to reject this proposed extension and to maintain the current one-year requirement for establishing an internal audit function.

Rapid growth, new regulatory obligations, expanding third-party relationships, and the pressure to scale quickly all increase the likelihood of control gaps

it gives management and the board real-time visibility into where controls are breaking down before those gaps become material weaknesses

An internal audit function established early does not slow a company down

I respectfully urge the SEC to reject the proposed rule change and encourage the SEC to preserve the existing one-year requirement

Newly public companies are navigating increased regulatory requirements, expanding stakeholder expectations, and rapidly evolving operational risks.

investors could face a prolonged period during which newly listed companies operate without either an internal audit function or independent assurance over the effectiveness of key controls

many newly public companies are already exempt from external auditor attestation over internal control for several years after going public

Internal audit can be scaled appropriately based on an organization's size and complexity through in-house, co-sourced, or outsourced models.

the proposal does not appear to provide sufficient empirical evidence demonstrating that the existing one-year requirement imposes an unreasonable burden on issuers

Strong governance practices should begin when a company enters the public markets, not several years later.

Before reducing a governance requirement that has been in place for more than two decades

imposes an unreasonable burden on issuers

For these reasons, I respectfully urge the Commission to disapprove the proposed rule change.

A company's first years as a public company are often characterized by accelerated growth, increased regulatory scrutiny, evolving business processes, and heightened investor expectations.

The current one-year requirement appropriately recognizes this need while allowing companies flexibility to scale their internal audit function through outsourced or co-sourced arrangements.

internal audit provides the greatest value when organizations are building and evolving rather than after systems, processes, and governance structures are already established

When systems are changing, controls are developing, responsibilities are shifting, and organizations are growing rapidly, risk does not wait for the organization to mature.

I am also concerned by the suggestion that an independent audit committee and other existing requirements can adequately substitute for an internal audit function

The existing NYSE rule permits the function to be outsourced to a qualified third party other than the company's independent auditor.

the filing does not quantify the burden of the current one-year period, identify the expected cost savings from a five-year period, or explain why five years represents the appropriate balance.

I also do not believe the fact that Nasdaq does not require its listed companies to maintain an internal audit function, standing alone, resolves the question

Investor protection should be evaluated on its merits, rather than solely by reference to whether another marketplace has adopted a less restrictive requirement.

Strong governance is not something that begins only after an organization has finished growing.

the filing does not quantify the burden of the current one-year period, identify the expected cost savings from a five-year period, or explain why five years represents the appropriate balance.

Establishing an effective internal audit function requires time, resources, and thoughtful planning.

such flexibility should not come at the expense of investor protection, financial reporting reliability, or accountability for board-level oversight.

Please extend the commentary period as 5 years is too long for the new internal audit requirement

Please extend the commentary period as 5 years is too long for the new internal audit requirement

The IIA urges the Commission to disapprove the Proposal and, to that end, to institute proceedings under Section 19(b)(2)(B).

The IIA urges the Commission to disapprove the Proposal and, to that end, to institute proceedings under Section 19(b)(2)(B).

Newly public issuers, including rapidly scaling technology companies, confront risks that

A retrospective annual examination of financial controls cannot substitute for

First, most newly listed companies are not subject to the Section 404(b) auditor attestation

The current rule requires presence, not scale. It does not oblige a newly listed company to

filing contains no data of any kind: it identifies no population of affected issuers, quantifies

Nor is the absence of a comparable requirement at the Nasdaq Stock Market a reason to

II. The Exchange Has Not Carried Its Burden Under the Exchange Act

Internal audit belongs at the foundation of a newly public company

The requirement has been relaxed once already; it should not be relaxed again.

Its entire factual predicate is a statement that unnamed issuers “have expressed concern,” and the Exchange acknowledges that it neither solicited nor received any written comments before filing.

and provides no explanation of why five years—rather than any shorter period—is the appropriate term.

particularly during the critical early years when systems, controls, risk management, and culture are taking shape

Rolling back investor protections has wider economic consequences

Internal audit should be part of the foundation of a public company's governance

The IIA urges the SEC to reject this proposal and instead direct the NYSE to maintain the current one-year phase-in period.

Newly listed companies carry elevated risk by definition. Controls are immature. Organizations are scaling rapidly. Governance infrastructure is still being built.

Co-sourced and outsourced internal audit models are widely available and cost-effective for smaller and newly public organizations.

Burden alone is not sufficient justification for removing a governance safeguard that protects investors.

The proposal conflates the cost of building a full in-house internal audit department with the cost of establishing an internal audit function.

In my experience, effective governance, risk management, and internal controls are most critical during periods of growth and change.

internal audit provides a unique perspective that complements but does not replace external audit and other oversight activities

I am also concerned that many newly public companies may already be exempt from certain external auditor attestation requirements related to internal controls.

organizations have successfully implemented internal audit functions through a variety of scalable approaches, including outsourced and co-sourced models

I am concerned that the proposal does not provide sufficient evidence demonstrating that the current one-year requirement creates an undue burden for newly listed companies