What is a PBC list in an audit?

The term is inherited from financial auditing, where client-prepared schedules have carried the “PBC” label for decades; security audit firms brought it along. You’ll meet the list at or just after the kickoff call, typically a few weeks ahead of fieldwork, as a shared spreadsheet or a queue in the firm’s portal. It lands in rounds: first documents and full populations — complete rosters of hires, production changes, and vendors for the period — then a follow-up round targeting the specific samples the auditor picks from them.

Every row names a thing to produce, the period it must cover, and — in a well-run response — an owner and a due date. That last part is where audits are won or lost: rows fan out across HR, engineering, and IT, and an auditor with nothing in hand has nothing to test, so a slow response stretches fieldwork week by week. The full treatment — an example list, the wave pattern, and a response playbook that spares your engineers — is on the auditor PBC list page; the one-paragraph version lives at PBC list in the glossary.