PBC list management: a practical guide for UK audit teams

A PBC (Provided-by-Client) list is the auditor's formal schedule of evidence requests that the client must supply before and during fieldwork. When one lands in your inbox, do three things immediately: accept it formally, assign a named owner to every request, and load the full list into a tracker with agreed due dates. Those three steps alone prevent the majority of audit delays.

The Financial Reporting Council (FRC) sets the auditing standards that govern UK statutory audits through ISA(UK), and those standards demand that auditors obtain sufficient, appropriate evidence for every material assertion. That requirement flows directly into the PBC list. Every item on it exists because an auditor needs to satisfy a specific audit objective. Treat the list accordingly, not as an administrative inbox task but as a controlled project. Platforms such as Intelligentassessments are built precisely for this: structured evidence management, real-time tracking and audit-ready exports, all from a single source.

• Accept the list and confirm receipt with your audit contact
• Assign a named owner to each request on the day you receive it
• Load every item into a tracker with a request ID, due date and status field

Table of Contents

• What is a PBC list and when does it arrive?
• Why good PBC management matters for both sides
• What documents do UK auditors typically request?
• Best practices for creating and managing PBC lists
• Common challenges and how to fix them
• A suggested timeline for the UK audit cycle
• UK regulatory context: what the FRC and ISA(UK) mean for your evidence
• A sample PBC checklist structure you can adapt
• How technology changes PBC handling
• Key takeaways
• Why PBC management deserves a seat at the strategy table
• Intelligentassessments puts these practices into a single platform
• Useful sources and further reading

What is a PBC list and when does it arrive?

A PBC list is the auditor's itemised schedule of documents, data and confirmations the client must supply to support the audit. Each row typically carries a description of the request, the format required, the due date and the name of the person responsible for delivering it. The list is the primary communication channel between audit team and client during evidence collection.

Timing follows the audit cycle. An initial list usually arrives four to six weeks before fieldwork begins, covering the items auditors need to start analytical procedures: trial balance, prior-year comparatives, management accounts. A second wave follows once fieldwork is under way, as auditors identify gaps or follow-up items. A third, smaller wave often appears near sign-off as final confirmations are needed. Clients should expect the list to grow throughout the engagement and keep records accessible until the audit is fully closed.

The roles are distinct. The audit lead designs the list and maps each item to an audit objective. The engagement manager monitors progress and chases overdue items. On the client side, the finance lead or financial controller owns the overall response, while individual control owners (payroll manager, IT lead, company secretary) are responsible for their specific items. Clarity on who owns what, on both sides, is what separates a smooth audit from a stressful one.

Form factors vary. Some firms issue a spreadsheet; others invite clients into an interactive portal where documents can be uploaded, comments added and responsibilities reassigned. A growing number use continuous-assurance platforms that automate reminders and validate submissions before the auditor even opens them.

Why good PBC management matters for both sides

Poor PBC handling costs time and money on both sides of the engagement. Late or incomplete evidence forces auditors to pause fieldwork, reschedule procedures and return to the client repeatedly. That rework drives up audit fees and delays sign-off, which can affect statutory filing deadlines under the Companies Act 2006.

The benefits of getting it right are concrete:

• Faster fieldwork. Auditors who receive complete, correctly formatted evidence on time can begin substantive testing immediately rather than waiting for missing items.
• Reduced rework. Clear request descriptions and agreed formats cut the back-and-forth over whether a document meets the auditor's needs.
• Audit trail. A well-maintained tracker provides a documented record of what was requested, when it was delivered and who approved it, which matters if the audit is ever reviewed by the FRC.
• Better client experience. Clients who manage the process well build a reputation for operational maturity, which auditors notice and which can influence how much reliance they place on management representations.

The main failure modes are predictable. Unowned requests drift. Ambiguous items generate email chains that resolve nothing. Evidence submitted in the wrong format (a scanned image instead of a searchable PDF, for example) gets rejected and has to be resubmitted. Centralising communication and removing fragmented email threads turns PBC management into a trust-building function. Three metrics are worth tracking: average turnaround time per item, the overdue rate at each checkpoint, and the acceptance rate (the proportion of submitted items accepted without a resubmission request).

What documents do UK auditors typically request?

The exact contents depend on the organisation's size, sector and audit history, but most UK statutory audit PBC lists draw from the same core categories. The list below covers the most common, with examples of the specific items auditors ask for under each.

Financial statements and ledgers Trial balance, general ledger extract, management accounts for the period, prior-year comparatives, and a schedule of adjusting journal entries.

Bank and cash Bank statements for all accounts showing the year-end balance, bank reconciliations, and confirmation letters from the bank (bank letters are still standard practice in UK audits).

Payroll and HR Payroll summary by month, a headcount reconciliation, P60s or payroll reports for a sample of employees, and evidence of PAYE/NIC payments to HMRC.

Tax and VAT Corporation tax computations and returns, VAT returns for the period, evidence of any tax payments made, and correspondence with HMRC where relevant.

Contracts and legal Signed copies of material contracts, lease agreements (critical under IFRS 16 or FRS 102 Section 20), loan agreements, and any legal correspondence relating to disputes or contingent liabilities.

Governance and board minutes Minutes of board meetings and any audit or risk committee meetings held during the period, signed by the chair.

IT and access controls User access review exports, system change logs, and evidence of privileged access reviews. These are increasingly prominent as auditors test IT general controls under ISA(UK) 315.

Inventories and fixed assets Fixed asset register, depreciation schedules, inventory count sheets and any impairment assessments. For physical inventory, auditors will often attend the count, but they still need the client's own records.

Format preferences matter. Auditors generally prefer searchable PDFs for narrative documents and Excel or CSV for data files, particularly where they need to run their own analysis. For IT access reviews, a data export for audits in a structured format is far more useful than a screenshot.

Best practices for creating and managing PBC lists

A repeatable, auditable PBC process comes down to structure and discipline. The following numbered workflow gives both audit teams and clients a practical starting point.

1. Use a single template with one row per request. Each row should carry: Request ID, full description, related control or audit criterion, owner (client side), requested date, due date, status and a link to the uploaded evidence. Never merge two requests into one row, even if they seem related.

2. Apply consistent naming conventions. File names should follow a pattern such as YYYY-MM-DD_RequestID_DocumentName_v1. This prevents version confusion and makes it immediately clear which submission relates to which request.

3. Assign priority tags and stagger due dates. Not all items are equally urgent. Tag requests as Critical, Standard or Supplementary and set due dates accordingly. Delivering critical items such as the trial balance and initial schedules early allows auditors to begin analytical procedures without waiting for the full package.

4. Agree deadlines collaboratively. Deadlines imposed without client input are routinely missed. A short planning call to agree realistic dates for each priority tier takes thirty minutes and saves days of chasing.

5. Assign ownership on both sides. The client assigns an internal owner; the audit team assigns a reviewer. Both names sit in the tracker. When an item is overdue, it is immediately clear who to contact.

6. Keep the tracker lightweight. Store evidence files in a secure repository and put a link in the tracker rather than embedding large files. A tracker bloated with attachments becomes slow and unwieldy.

7. Review status at fixed checkpoints. A weekly status review during fieldwork, even a fifteen-minute call, catches overdue items before they become critical-path blockers.

Pro Tip: Never summarise or merge auditor request items. Auditors validate evidence against specific controls using the original request ID. If you consolidate two requests into one row, the auditor cannot map the evidence back to the correct control, and the item will be returned.

Common challenges and how to fix them

Even well-organised teams run into the same recurring problems. Here are the most common, with practical fixes.

Ambiguous requests. When a request is unclear, the instinct is often to guess and submit something. That almost always results in a rejection and a delay. Seek clarification immediately when a request is unclear; treat the PBC as a live communications channel, not a static document to be worked through in silence.

Missing files. Some evidence simply does not exist yet (a bank letter that has not arrived, a board minute that has not been signed). Flag these early with an expected delivery date rather than leaving the item blank. Auditors can plan around a known gap; they cannot plan around silence.

Ownership gaps. In organisations with decentralised functions, evidence for a single request may sit across three departments. Appoint a single co-ordinator on the client side whose job is to chase internal owners, not to rely on the auditor to do it. The central tracker with named owners on every row makes this visible.

Format mismatches. A payroll summary submitted as a scanned PDF when the auditor needs a manipulable spreadsheet wastes everyone's time. Agree format requirements at the outset and document them in the tracker.

Security and confidentiality. PBC submissions routinely contain payroll data, personal information and commercially sensitive contracts. Email attachments are not an appropriate transfer method for this material. Use a secure portal with access controls, single-use upload links where available, and maintain an evidence access log showing who viewed or downloaded each file. Minimise PII exposure by redacting data that is not relevant to the specific request.

Version control. When a document is resubmitted after rejection, the original version must be retained. Use the naming convention described above and never overwrite a previously submitted file.

A suggested timeline for the UK audit cycle

The table below sets out a sample schedule for a UK statutory audit of a December year-end company. Adjust lead times for your organisation's complexity and your firm's specific requirements.

The critical discipline is the pre-fieldwork delivery. Auditors who receive the trial balance and initial schedules in November can begin analytical procedures before fieldwork starts, which compresses the overall timeline. Teams that deliver everything at the start of fieldwork in December create a bottleneck that rarely resolves cleanly before the year-end reporting deadline.

UK regulatory context: what the FRC and ISA(UK) mean for your evidence

The Financial Reporting Council is the UK's independent regulator for auditors, accountants and actuaries. It issues the ISAs (UK), the auditing standards that govern every statutory audit of a UK entity. ISA(UK) 500 sets the standard for audit evidence: auditors must obtain sufficient appropriate evidence to reduce audit risk to an acceptably low level. Every item on a PBC list exists to satisfy that requirement for a specific assertion.

The practical implications are direct. Auditors are not asking for documents out of habit; each request maps to an assertion (existence, completeness, valuation, rights and obligations, presentation) for a specific balance or transaction class. When clients understand that mapping, they can provide better-targeted evidence and avoid submitting documents that do not actually address the auditor's objective.

Under the Companies Act 2006, directors have a statutory duty to provide auditors with the information and explanations they require. Failure to co-operate is not merely an audit inconvenience; it is a legal matter. The FRC's Audit Quality Review team also scrutinises audit files, and the quality of the evidence trail, including how promptly and completely clients responded to PBC requests, is visible in that review.

Documentation retention matters too. UK auditors are required to retain their working papers for at least six years. Clients should retain their own copies of everything submitted, along with the tracker showing what was delivered and when, for the same period.

A sample PBC checklist structure you can adapt

The structure below mirrors the template recommended by practitioners for evidence request tracking. Copy the columns into a spreadsheet or import them into your platform of choice.

Columns: Request ID | Description | Related control/criterion | Owner | Requested date | Due date | Format required | Link to evidence | Status | Auditor comment

Sample rows:

• PBC-001 | Bank reconciliation for all accounts as at 31 December | Completeness and existence of cash balances | Finance Manager | 1 November | 15 November | Excel | [link] | Submitted | Accepted
• PBC-002 | Payroll summary by month for the year, with headcount reconciliation | Completeness and accuracy of payroll expense | HR Director | 1 November | 22 November | Excel | [link] | Overdue |
• PBC-003 | Signed copy of material supply contract (>£500k annual value) | Rights and obligations; completeness of commitments | Legal Counsel | 1 November | 22 November | Searchable PDF | [link] | Submitted | Under review
• PBC-004 | VAT returns for all four quarters of the period | Completeness and accuracy of tax liabilities | Tax Manager | 1 November | 15 November | PDF | [link] | Submitted | Accepted

Store the actual files in a secure evidence repository (a SharePoint folder with restricted access, a dedicated audit portal, or a continuous-assurance platform). The tracker holds the link, not the file. This keeps the tracker fast and makes it easy to grant or revoke access to specific items without restructuring the whole repository.

How technology changes PBC handling

The shift from email-and-spreadsheet to purpose-built platforms is not cosmetic. Automated frameworks replace the panic-driven evidence sprint with ongoing collection and real-time visibility, which is a fundamentally different operating model.

The core capabilities that matter in practice are:

• Secure portals with role-based access, so only the relevant owner can view and upload their specific items
• Automated reminders triggered by due dates, removing the need for manual chasing
• Pre-submission validation that checks whether an uploaded file meets format and completeness requirements before the auditor sees it
• Evidence mapping that links each submission to the specific control or audit criterion it supports
• Real-time dashboards showing overdue rate, acceptance rate and overall completion percentage at a glance
• Audit-ready data export so the full evidence package can be extracted in a structured format at any point

AI-enabled platforms can generate tailored PBC lists from templates, validate submitted documents for completeness and run automated reminders, reducing the manual overhead significantly.

A practical workflow on a continuous-assurance platform runs: issue the PBC list from a structured template, collect evidence through a secure portal, validate submissions automatically, route accepted items to the auditor's review queue, and close each item with a documented sign-off. The full cycle is visible in a dashboard rather than buried in an email thread.

Intelligentassessments supports exactly this workflow. The platform's evidence management capabilities include structured assessment frameworks, weighted RAG scoring, real-time dashboards and CSV data exports, giving both audit teams and clients a single source of truth for the entire PBC process. For organisations in regulated UK utilities and infrastructure, where audit trails and governance documentation carry particular weight, that kind of structured, auditable approach is worth considerably more than a well-formatted spreadsheet.

Key takeaways

Effective PBC list management treats evidence collection as a controlled project, not an inbox task, and the difference shows up directly in audit timelines and fees.

Why PBC management deserves a seat at the strategy table

The conventional view of a PBC list is that it is an administrative burden, something to be endured at year-end and forgotten about until the next audit. That framing is wrong, and the cost of holding it is measurable in audit fees, filing delays and auditor relationships that never quite recover from a difficult engagement.

What the evidence actually shows is that organisations which treat PBC management as a repeatable, measured function, with named owners, agreed templates, tracked KPIs and a secure evidence repository, consistently have shorter fieldwork periods and fewer auditor queries at completion. The overdue rate and acceptance rate are not vanity metrics; they are leading indicators of how much the audit will cost and how much management time it will consume.

The shift to continuous assurance makes this argument even stronger. When evidence is collected on an ongoing basis rather than in a single pre-audit sprint, the PBC list becomes less of a shock and more of a confirmation. Auditors arrive to find evidence already organised, mapped to controls and ready for testing. That is not a marginal improvement; it changes the character of the audit relationship entirely.

My recommendation: embed a standard tracker from day one of each engagement, measure three KPIs (overdue rate, acceptance rate, average turnaround time), and review them after every audit to identify where the process broke down. The investment is small. The return, in time saved and relationships preserved, is not.

Intelligentassessments puts these practices into a single platform

Audit teams and finance functions that have read this far know what good PBC management looks like. The gap is usually not knowledge; it is the tooling to make it repeatable without manual overhead.

Intelligentassessments gives regulated UK organisations a purpose-built continuous-assurance platform that replaces the spreadsheet-and-email cycle with structured evidence management, automated tracking and real-time dashboards. Every PBC item sits in a single register with named owners, due dates and a direct link to the uploaded evidence. Submissions are validated before the auditor reviews them. Overdue items surface automatically. The full evidence package is available as a structured data export at any point in the cycle, audit-ready and mapped to the relevant controls.

For organisations in regulated UK utilities and infrastructure, where governance documentation and audit trail quality are scrutinised closely, that level of structure is the difference between a smooth audit and a drawn-out one. Book a demo to see the evidence management and PBC workflow in action.

Useful sources and further reading

• Financial Reporting Council (FRC) — the UK's independent regulator for auditors; publishes ISAs (UK) and audit quality guidance. Start here for the authoritative standards that drive PBC evidence requirements.
• ISA(UK) 500 — Audit Evidence — the standard that defines what constitutes sufficient, appropriate evidence; every PBC item maps back to it.
• What is a PBC list? — Altruic Advisors — a clear practitioner explanation of the PBC list lifecycle, including why the list grows during fieldwork and how to handle ambiguous requests.
• SOC 2 Evidence Request Tracker Template — Security Scientist — a practical Excel template with the column structure recommended in this guide; adaptable for UK statutory audits.
• What is a PBC List? Complete Guide for Auditors — Blast Audit — covers request specificity, staggered delivery and the operational discipline that keeps engagements on schedule.
• Intelligentassessments — continuous assurance platform — platform overview for regulated UK organisations seeking to digitise evidence management, PBC tracking and audit reporting.

When consulting any template or standard, map each PBC item to the specific control or audit criterion it supports before you submit. That mapping is what turns a document collection exercise into genuine audit evidence.

Recommended

• Intelligent Assessments — Assessment Management Platform for Regulated Organisations
• Intelligent Assessments — Assessment Management Platform for Regulated Organisations
• Plans — Intelligent Assessments | Assessment Platform for Regulated Organisations
• Book a Demo | Intelligent Assessments