PBC list

A typical SOC 2 PBC list runs dozens to a few hundred line items, each tied to a control the auditor plans to test: the access-review records with approvals, the offboarding tickets for a sample of departed employees, the vulnerability-scan reports, the signed policy acknowledgments. Because most items are the output of year-round evidence collection, the list is less a task than a retrieval exercise — for teams whose evidence exists. For everyone else, it is where the audit window comes due, since many artifacts are timestamped and cannot be recreated after the fact.

Three things surprise teams on their first audit. Volume: the list keeps growing, because auditor follow-ups spawn new items as testing proceeds. Deadlines: items are due in days, not weeks, and late delivery stretches fieldwork. Ambiguity: requests are written in auditor shorthand — “population of changes for the period” — and guessing at the meaning wastes a round trip. The teams that clear lists fastest ask clarifying questions on day one and over-deliver context on the first pass.

Mature teams treat the PBC list as a project: every line item triaged, assigned, and tracked to delivery, with ambiguous requests clarified early instead of guessed at. Slow or partial responses invite deeper sampling; fast, complete ones shorten the engagement. We keep a full breakdown of how the list is structured, who should own each category, and where teams lose the most time in our auditor PBC list guide.