NASDAQ firms are not required to have an internal audit function. We exploit this voluntary setting to provide further insight into internal audit's role as a governance function. We search proxy statements and other sources to identify whether NASDAQ firms have an internal audit function. Firms with a higher risk profile are more likely to have an internal audit function, whereas smaller/resource constrained firms are less likely to invest in internal audit. NASDAQ firms with an internal audit function are more likely to report a material weakness under Sarbanes‐Oxley Section 302 or 404, indicating that internal audit reduces information asymmetry by communicating internal control issues.