PBC list
Also known as: Document Request List (DRL), Evidence Request List, Information Request List
A PBC (Provided by Client) list is a comprehensive checklist of documents, data, and evidence that an auditor or compliance assessor requires from the organization being audited. It serves as a formal request for the specific artifacts needed to verify that controls are implemented and operating effectively.
In practice
At the start of an engagement, such as a SOC 2 or ISO 27001 audit, the practitioner sends this list via a secure portal or spreadsheet; the client then uploads requested items like policy documents, user access reviews, or system logs for testing.