A PBC list, short for "provided by client", is the auditor's list of documents, exports and walkthroughs they need from you. Treat it as a project plan: give every line an owner, a source system and an internal deadline that falls before the auditor's own date.
What is on it
Expect three kinds of request. Documents, such as policies and org charts. System exports, such as user lists and change logs. And meetings, where someone explains how a process works while the auditor watches.
Lines are often terse. "Evidence of access reviews for the period" can mean a quarterly spreadsheet, a ticket trail or a screenshot series. When a line is vague, ask what a good answer looks like before you spend a day producing the wrong thing.
Turn the list into a tracker
Copy each line into a shared sheet or task board with these columns:
- Request text, word for word
- Control it supports
- Owner
- Source system
- Status
- Date delivered and link to the file
The owner should be the person who runs the control, not whoever has the most free time. They know where the data really lives and what the exceptions were.
Set deadlines you can keep
Give owners a date a few days ahead of the auditor's. That buffer is for the two things that always happen: a missing field in the export, and a question from the auditor that needs a second pass.
Deliver in batches rather than at the end. Early delivery lets the auditor raise questions while people still remember the details.
Answer the question that was asked
Resist the urge to send everything. A huge folder with no index slows the audit and invites extra sampling. Send what the line asks for, name the file so the line number is obvious, and add a short note on how it was produced: which system, which filter, which date range.
If something does not exist, say so plainly and explain what you do instead. A truthful gap with a plan is better than a late scramble to invent a document.
Reuse it next year
After the audit, keep the final list and tracker. Next year's request will likely look similar. Better still, build the folder structure and exports ahead of time so most lines can be answered from a saved location.
Compliance and evidence automation in Safeguard can hold collected evidence against each control, which cuts the number of lines you answer by hand. Check with your auditor which evidence they accept.
One more habit helps a lot: hold a short weekly check in during the audit. Ten minutes, owners and the coordinator, going through open lines. Anything stuck for more than a couple of days gets raised right then, either with the owner's manager or with the auditor if the request itself is unclear. Most late deliveries trace back to a question nobody asked early, so make asking cheap.
Quick check
Is the PBC list the same for every company?
No. Each audit firm has its own template and tailors it to your scope, systems and controls.
What if I cannot produce an item?
Tell the auditor early, explain what exists instead, and ask whether an alternative would satisfy the request.
Last reviewed: 19 October 2026.
