How to prepare for an auditor evidence request
Auditors issue a request list, usually called a PBC list, covering policies, populations, samples and control evidence. Preparation means having those artefacts organised, dated and owned before fieldwork, so the exchange is retrieval rather than reconstruction.
What is on a typical request list
- Policy set with version history and approval dates
- Complete populations, for example every employee onboarded in the period
- Evidence for sampled items drawn from those populations
- Configuration exports for in-scope systems
- Tickets and records showing controls operating
- Organisation chart and role definitions
- Vendor agreements and third-party reports
Why populations matter more than samples
Auditors select samples from a population you provide. If the population is incomplete, every sample drawn from it is unreliable and the testing has to be redone.
Get populations right first: complete, dated, and reconcilable to a system of record.
Preparing before fieldwork
- Ask for the request list early and map each item to an owner
- Verify every artefact falls inside the audit period
- Reconcile populations against the source system before submitting
- Pre-answer the obvious follow-ups: who approved this, and when
- Run an internal readiness pass against the same list
What slows fieldwork down
Common friction
- Evidence delivered in inconsistent formats with no naming convention
- No single point of contact, so the auditor chases several people
- Populations that do not reconcile to the underlying system
- Gaps discovered mid-fieldwork with no remediation time left
- Key personnel unavailable during the fieldwork window
Managing the relationship
Give the auditor one primary contact, agree a response SLA in both directions, and log every request and response. Auditors are not adversaries; ambiguity and delay are what create findings.
Key takeaways
- Populations must be complete before samples are drawn.
- Everything must fall inside the audit period.
- One point of contact and a naming convention save days.
- Run an internal pass against the request list first.
Frequently asked questions
What is a PBC list?
Prepared By Client: the auditor's list of documents and evidence you must supply for testing.
How early should we ask for it?
As soon as the engagement is signed. Many firms will share a standard list before fieldwork is scheduled.
What if we cannot produce an item?
Say so early. A known gap with a remediation plan is handled far better than a gap discovered mid-fieldwork.
Can we push back on a sample?
You can question whether the population or selection is appropriate, but sample selection is the auditor's to make.
Get audit-ready in 8 to 12 weeks
Certifyi pairs the platform with a named compliance lead, at published pricing from $8,000/year.
Book a 20-min deal readiness call