PBC Lists: How to Run Provided-by-Client Requests Through a Data Room

Every audit lives or dies on the PBC list. Provided-by-client, prepared-by-client, client assistance schedule, whatever your firm calls it, it's the same thing: a list of 150 to 400 items the client owes you before your team can test anything.

And at most firms, that list is still managed the same way it was in 2010: an Excel tracker on the engagement drive, a stream of email attachments, and a senior spending four hours a week reconciling the two.

There's a better way. This guide walks through how to run your entire PBC workflow inside a virtual data room, from initial list design to sign-off, with the specific settings and cadences that actually work in practice.

Why Email-Based PBC Collection Fails

Before the how, a quick inventory of what goes wrong with the status quo:

• The tracker is always stale. The client sent the bank rec Tuesday night. The tracker says "outstanding" until someone remembers to update it Thursday.
• Versions multiply. "AR_aging_v2_FINAL_revised.xlsx" arrives, but which version did staff already start testing? Nobody knows.
• Evidence is scattered. When the reviewing partner asks "when did we receive the legal letter?", the answer is buried in someone's inbox.
• Attachments bounce. Payroll registers over 25MB fail silently, and the client assumes you have them.
• It's insecure. Trial balances and payroll files sitting unencrypted in email is exactly the exposure covered in our comparison of email vs client portal vs data room for audit evidence.

Firms that move PBC collection into a structured room consistently report 30-50% less time spent chasing documents. On a 400-hour audit, that's real margin.

Step 1: Design the PBC List as a Folder Index

The core move is simple: your PBC list and your folder structure become the same object. Every request line gets a numbered folder, and the numbering carries through from the request list to the workpapers.

A standard financial statement audit index looks like this:

Section	Contents	Typical Item Count
1. Trial Balance & GL	Final TB, GL export, JE listing	5-10
2. Bank & Cash	Statements, reconciliations, confirmations	15-30
3. Revenue & Receivables	AR aging, invoice samples, cutoff support	20-40
4. Payroll & HR	Registers, benefit recs, new hire/term files	15-25
5. Fixed Assets & Leases	FA register, additions support, lease agreements	10-20
6. Debt & Covenants	Loan agreements, amortization, covenant calcs	5-15
7. Tax	Returns, provision support, correspondence	5-10
8. Governance & Legal	Board minutes, legal letters, related parties	10-15

Number requests to match: item 3.02 is the AR aging, and it lives in folder 3.02. When the client uploads to 3.02, there is zero ambiguity about what they just delivered.

Naming Convention

Enforce one pattern from day one: [Request #] - [Description] - [Period].pdf, so "2.03 - Operating Account Reconciliation - Dec 2025.pdf". Put the convention in the kickoff email and in a README file at the room root. Clients follow it about 70% of the time, which is 70% better than email.

Step 2: Use Native Request Tracking Where You Can

The better audit-focused platforms turn each PBC item into a first-class request object, not just a folder. Each request carries:

• Status: open, submitted, accepted, or rejected (returned to client with a note)
• Owner: the specific client contact responsible (the controller owns bank recs, HR owns the census)
• Due date: with automated reminders as it approaches
• Attachments: the uploaded files, version-chained

Ansarada is the strongest example here: its checklist and workflow tooling was built for exactly this kind of structured collection, and it gives partners a live completion dashboard per engagement. If you're evaluating platforms specifically for recurring audit work, our guide to the best data room for audits and accounting firms breaks down which providers have native request tracking and which make you fake it with folders.

If your platform only has folders, you can still get 80% of the benefit: use empty numbered folders as the open-items list, and run a saved report of "folders with zero files" as your outstanding tracker.

Step 3: Set Up Permissions Before Kickoff

PBC rooms have a small cast, but the separation matters:

• Engagement team (full access): partner, manager, seniors, staff. Everyone sees everything within the engagement.
• Client uploaders (upload and view own sections): the controller doesn't need to see what HR uploaded, and in sensitive situations (executive comp, pending litigation) they shouldn't.
• Client executives (view all, upload all): usually the CFO or controller acting as coordinator.
• Specialists (section-limited): your tax team gets section 7, IT auditors get any systems section, component auditors get their component only.

One rule that prevents most incidents: nobody outside the engagement team gets download rights on other clients' or other departments' folders. Set it once in the room template, not per engagement.

Step 4: Run a Reminder Cadence That Doesn't Annoy Anyone

Automated reminders are the highest-ROI feature in the entire workflow, but the cadence matters:

1. T-14 days before fieldwork: full list issued, kickoff call walks through the top 20 items by effort
2. T-7 days: automated reminder on all open items
3. T-3 days: personal email from the senior on the critical-path items only (TB, bank statements, AR aging), because testing can't start without them
4. During fieldwork: daily automated digest to the client coordinator listing open and rejected items
5. Weekly: partner-level summary showing completion percentage, because a 60% complete PBC list at the fieldwork midpoint is a scope conversation, not a surprise at wrap-up

The digest format matters: one email listing ten open items gets action; ten separate reminder emails get filtered.

Step 5: Handle Versions and Rejections Explicitly

Two workflows separate a clean audit file from a messy one:

Rejections. When the client uploads the wrong thing (a summary instead of the detail, the prior year's file, an unreconciled draft), reject the request with a one-line reason instead of emailing about it. The rejection note lives on the request forever, which matters when the same confusion recurs next year.

Re-uploads. When a corrected reconciliation arrives, the version chain must show both files, with timestamps and uploader identity. Your workpapers reference "version 2, received March 4," and a reviewer or inspector can verify exactly what was tested. This is the evidence chain that a shared drive or inbox can never reconstruct, and it's covered in more depth in our guide to data room retention policies for auditors.

Step 6: Roll Forward, Don't Rebuild

The payoff for doing this right comes in year two. At engagement wrap-up:

1. Export the full room (documents plus activity log) into your audit file for retention
2. Clone the room structure and request list into next year's engagement
3. Update dates, remove one-off requests, add items from this year's review notes
4. Re-invite client contacts, most of whom already know the system

Firms report that year-two PBC setup takes under two hours against a day or more from scratch. Client-side friction drops too: the controller who uploaded to folder 3.02 last March remembers exactly what to do this March.

Choosing a Platform for PBC Work

Quick decision guide:

• Many concurrent engagements, want native request tracking: Ansarada or iDeals
• Mid-size firm, want one flat annual invoice covering all rooms: Firmex or SecureDocs, whose flat-fee pricing suits recurring engagement volume
• Small practice, a few engagements a year: Papermark or Digify at subscription prices under $100/month

Whatever you choose, insist on three things in the demo: request-level status tracking (or a workable folder equivalent), version history with uploader identity, and an exportable activity log. Everything else is nice to have. Those three are the audit trail.

The Bottom Line

The PBC list is a workflow, and email is not a workflow tool. Map your request list to a numbered folder index, assign each item to a named client contact with a due date, let the platform run reminders, and export the whole evidence chain into your file at wrap-up.

Do it once and the structure rolls forward every year after. The firms that made this switch three years ago are not going back to the Excel tracker, and their seniors bill the recovered hours to testing instead of chasing.