PBC list — Modern Auditing

The list of documents an auditor asks the business to produce — an artifact that exists only because auditors historically could not reach the systems themselves.

“Prepared by client” is a phrase inherited from external audit and it describes the central bottleneck of the traditional model: the auditor names what they need, someone in the business finds it, and the engagement waits.

The costs are larger than the delay. Every PBC item is a hand-off where evidence can be filtered, reformatted, or produced from a source nobody independently verified — which is precisely the IPE problem. It also makes audit feel like an imposition on the business, because it is one.

Direct system access removes most of the list. This is not a technology limitation and never has been; it is a permissions conversation, and it is usually blocked by an assumption that auditors should not have read access to production data. That assumption deserves examination, since the same organisation typically grants far broader access to contractors on shorter engagements.

A useful metric for a modernisation programme: count the PBC items on your largest engagement this year and next. If the number has not fallen, nothing structural has changed.