The Evolving PBC List Audit: Moving Beyond Manual Evidence Collection
Prepared by client lists have long been part of the internal audit process. They define the reports, records, system extracts and supporting documents that auditors need to test controls and complete an engagement.
Yet the real challenge is rarely sending the request. The greater difficulty is translating audit requirements into instructions that control owners can understand and act on correctly.
A vague request can create several rounds of clarification, incomplete evidence and unnecessary delays. When audit teams are already working with limited resources, even a few days lost to unclear evidence requests can affect the entire engagement timeline.
In 2026, this is becoming an important area for audit automation and artificial intelligence. AI agents can help teams prepare requests, route them to appropriate owners, manage reminders and perform initial evidence checks against defined requirements. The auditor still retains responsibility for determining whether the evidence is sufficient, relevant and reliable.
The opportunity is therefore not to replace professional judgment. It is to reduce repetitive administrative work so auditors can apply that judgment where it matters most.
- Why the PBC List Process Needs to Evolve
Traditional PBC list management often relies on spreadsheets, emails and manual follow ups. An auditor prepares a request list and sends it to multiple control owners. Responses arrive at different times and in different formats. Some evidence is complete while other submissions require clarification. The process becomes especially inefficient when the original request does not clearly explain what the auditor actually needs.
For example, a request might simply state:
“Third quarter user access review evidence.”
An auditor may understand exactly what this means. The control owner may not. The request does not explain which system should provide the data, what population is required, which dates apply, what approvals should be included or whether the extract must come from the production environment.
The control owner is forced to interpret the request.
If that interpretation is wrong, the problem may not become apparent until testing begins. A stronger PBC process focuses on clarity at the beginning rather than repeated correction later.
- Better Evidence Requests Start With Better Specifications
One of the most valuable uses of AI in audit evidence collection is improving request specifications. Instead of sending a short description, the request can clearly describe what evidence is required.
A detailed access review request might specify the complete population of active accounts at the end of the quarter, the relevant source system, reviewer information, approval dates and the treatment of accounts identified for removal.
It may also request reconciliation against employee termination records and clarify the reporting period being used. This gives the control owner a much clearer understanding of the auditor’s expectations. AI agents can support this process by taking a concise audit work program step and expanding it into a structured evidence request.
Important attributes may include the source system, reporting period, population, approval requirements, expected file format and reason the evidence is required. The engagement team can then review the request before it is distributed.
This allows automation to improve consistency without removing auditor oversight.
- Automated Follow Ups Can Improve Response Management
Once PBC requests have been issued, tracking responses becomes another major administrative task. Audit teams may be managing dozens or even hundreds of evidence requests across several stakeholders. Manual reminders depend on someone checking the request tracker and deciding who needs to be contacted.
AI supported workflows can make this process more consistent. Requests can be tracked against expected delivery dates. Automated reminders can be issued when deadlines approach and overdue items can be flagged for auditor attention.
This reduces the need for teams to spend time monitoring individual requests manually.
However, formal escalation should remain a human decision.
An automated system can identify an overdue request. The auditor should determine whether the situation requires escalation to management based on the engagement context and importance of the evidence.
- Screen Evidence Before Testing Begins
Receiving a file does not necessarily mean the request has been completed. Evidence can arrive with missing dates, incomplete populations, incorrect reporting periods or absent approvals.
When these problems are discovered during testing, the engagement may already be under time pressure. Initial evidence screening can help identify such issues earlier.
AI agents can compare incoming evidence against predefined request attributes. For example, the system can check whether the requested period is present, whether required fields appear in the file and whether the expected population boundaries have been addressed.
If something is missing, the control owner can be asked for clarification before detailed audit testing begins. This creates an important efficiency gain. Problems that might otherwise appear late in fieldwork can be corrected closer to the time evidence is submitted.
- AI Can Support Evidence Sufficiency but Not Decide It :
Automated screening should not be confused with final evidence evaluation. An AI system may confirm that a document contains the requested dates, fields and approvals. That does not automatically mean the information is reliable enough to support an audit conclusion. Consider an access listing that contains every required column but was generated from a testing environment instead of the live production system
An automated review may determine that the file matches the requested format. An experienced auditor may recognize that it does not represent the environment in which the relevant control operates.
This distinction is critical.
AI can determine whether defined attributes appear to be present. Auditors must evaluate whether the evidence is relevant, reliable and sufficient within the broader business and control environment. Professional skepticism remains essential.
- Where AI Agents Can Add the Most Value
AI agents can assist across several stages of the PBC audit workflow. The greatest opportunity often appears before the first request is sent First, AI can help convert work program requirements into detailed evidence specifications
Second, requests can be routed to confirmed control owners.
Third, response dates and reminders can be managed automatically.
Fourth, submitted evidence can receive an initial review against approved requirements.
Together, these capabilities can reduce the amount of time auditors spend coordinating evidence collection.
More importantly, they can improve the quality of the information entering the testing process.
The objective should not simply be faster evidence collection.
It should be better evidence collection with fewer avoidable clarification cycles.
- The Auditor Still Leads the Engagement
The increasing use of AI does not reduce the importance of the auditor. It changes where auditor effort is most valuable. Administrative activities such as preparing repetitive requests, sending reminders and checking for obvious missing fields can increasingly be supported by automation.
The auditor can then spend more time evaluating risk, understanding context and determining whether evidence genuinely supports the control conclusion. This division of responsibility can make audit work more efficient without weakening assurance quality. The quality of automation also depends heavily on how the workflow is designed.
If the criteria given to the AI system are incomplete, the resulting screening will also be incomplete. Engagement leaders should therefore review evidence requirements and approve key attributes before automated requests are distributed. Strong automation begins with strong audit methodology.
- Governance Should Be Built Into AI Enabled PBC Workflows
Introducing AI into the PBC process creates new governance considerations. Audit teams need confidence that automated activity can be reviewed, explained and reproduced.
A practical governance model should address several areas. Request criteria should be reviewed before automation begins.
Automated reminders, routing decisions and screening results should be recorded within the engagement documentation. Auditors should retain control over management escalations and final evidence decisions.
Teams should also periodically review a sample of evidence that passed automated screening to confirm that the rules remain appropriate. These safeguards help ensure that automation strengthens the audit process rather than introducing new uncertainty.
- Moving From Evidence Administration to Evidence Intelligence
The future of PBC list management is not simply about automating reminders. The larger opportunity is improving the quality of evidence collection from the beginning. Clearer specifications reduce misunderstandings. Automated routing reduces coordination effort. Structured follow ups improve response consistency.
Early screening helps identify incomplete submissions before they affect testing. When these activities work together, the PBC process becomes more proactive. Audit teams can spend less time searching for documents and more time examining what those documents actually mean.
- A More Efficient Audit Process for 2026
Internal audit teams are under growing pressure to deliver broader assurance while managing constrained resources. That makes administrative efficiency increasingly important. Manual PBC list management can consume significant capacity without directly improving the quality of audit conclusions.
AI agents offer an opportunity to reduce that burden while maintaining human oversight. The strongest model is not fully automated audit evidence collection It is a balanced model where technology handles repetitive coordination and preliminary checks while auditors retain control over professional evaluation.
The purpose of modernizing the PBC list is therefore not to remove people from the process.
It is to remove unnecessary friction from the process.
When evidence requests are clear from the beginning and incomplete submissions are identified early, audit teams can reduce delays and concentrate on deeper risk analysis, control effectiveness and meaningful assurance.
For internal audit functions in 2026, that shift can turn the PBC list from an administrative exercise into a more intelligent part of the audit workflow.
About Dess:
Dess Digital Meetings is the world’s easiest-to-use board portal software for paperless board and committee meetings. Leading organizations in over 25 countries prefer Dess as their choice for efficient and effective board management software.
Dess believes in enhancing the value of information globally by harnessing unstructured data to empower the right people at the right time using the right technology. With its group of highly competent and motivated people, it has implemented several first-of-its-kind solutions.
To know, please write to support@dess.digital