ISC CPA Exam Guide (2026): What It Covers, How It Works and How to Study

ISC preparation centers on understanding how information systems process data, how controls address risks, cloud computing, how evidence supports conclusions and SOC reports. i75 ISC will prepare you for not just the vocabulary, but also practice applying it to business scenarios. This guide expands on ISC exam topics, controls, simulation strategy and an adaptable study routine so you can decide whether the Discipline fits your strengths and prepare with a clear purpose.

Information Systems and Controls (ISC) is one of three CPA Exam Disciplines. It focuses on information systems, data management, security, confidentiality, privacy and controls relevant to accounting and assurance. You must pass AUD, FAR and REG plus one Discipline of your choice; ISC is not required for every CPA candidate.

ISC may be a strong match for candidates with exposure to IT audit, SOC engagements, risk advisory, information security or systems controls. It can also appeal to candidates who enjoyed AUD’s internal control and evidence topics. There is no coding so you do not need to be a programmer to consider ISC, but you will learn how information systems operate and how control weaknesses affect the reliability of information.

Use the official AICPA blueprint effective on your testing date. Broad themes include information systems and data management; security, confidentiality and privacy; and considerations for System and Organization Controls (SOC) engagements. Do not prepare by memorizing definitions alone. Questions may require you to identify a risk, select a control or evaluate what evidence supports a conclusion.

See the official AICPA blueprint hub.

Start with a familiar transaction, such as a customer order becoming an invoice and then a payment. Trace where data enters the system, which records change, who has permission to make changes and which reports management uses. This turns information systems and data management into a concrete process rather than a collection of definitions.

Next, ask what could go wrong at each step. An invoice might be duplicated, customer data might be changed without approval, or a report might omit records. Identify a control that addresses each specific risk. A control description is useful only when you can explain the problem it prevents or detects.

Finally, consider how the control would be evaluated. A policy saying access must be removed after termination is different from evidence showing that removal occurred promptly. Scenario practice should connect the objective, the control, the available evidence and the conclusion. This approach also helps you distinguish a well-designed control from one that actually operated as intended.

The ISC section lasts four hours and includes multiple-choice questions and task-based simulations. Unlike the other CPA Exam sections, ISC weights MCQs at 60% and simulations at 40%. The passing reported score is 75; it is not a raw percentage of questions answered correctly. Source: AICPA scoring guide.

ISC’s cumulative pass rate through Q2 2026 was 67.45%, according to the AICPA. That figure is useful context, but it does not establish that ISC is easier for an individual candidate than BAR or TCP. Candidates choose Disciplines based on their own backgrounds. Someone with audit and controls experience may find ISC more intuitive; someone unfamiliar with systems concepts may need more time. See CPA Exam Pass Rates for every section.

Suppose a company maintains one customer record for each customer ID and many invoices may be linked to that customer. The customer-to-invoice relationship is one-to-many. If an invoice can reference a nonexistent customer ID, referential integrity is weak. A sensible preventive control is to enforce a valid foreign-key relationship between invoice records and the customer table. A detective control could identify invoices with unmatched customer IDs. In a real engagement, the auditor also considers access permissions, change management and the reliability of reports produced from that database.

This example illustrates why ISC candidates should connect database design concepts to actual control objectives.

The i75 ISC video below explores database relationships, including one-to-one, one-to-many, many-to-many, and bridge tables.

Authentication asks whether a user is who they claim to be. Authorization asks which actions that authenticated user may perform. Treat them as separate questions. Strong sign-in protection does not solve a problem caused by excessive permissions after the user has logged in.

Consider an employee who can both create a vendor and approve a payment. The risk arises from the combination of responsibilities. Review the permissions, the approval workflow and whether an independent person reviews exceptions. Merely requiring a stronger password leaves that conflict unresolved.

Build your own examples of preventive and detective controls. A restriction on unauthorized changes may prevent an error; a review of unusual changes may detect one. When answering an ISC question, match the proposed control to the risk and timing. A technically impressive control can still be a weak answer if it addresses a different problem.

Start with a vocabulary map: information processing, logical access, authentication, authorization, change management, backup and recovery, confidentiality and SOC reporting. Next, draw a simple system flow showing where data originates, who can change it and which controls prevent or detect errors. Then practice scenarios: identify the risk, choose a control and explain how the auditor could test it. Work simulations that require interpreting policies, system logs or control descriptions. Finish with timed mixed practice and review the explanations for wrong answers.

Read the requirement first and identify the business process or reporting issue. Review the exhibits with that purpose in mind: an access listing, policy document, incident record or system description may answer different parts of the task. Avoid treating every document as equally important.

For each requirement, write a brief risk-control-evidence chain. What could happen? Which control is intended to address it? What evidence is available? Does the evidence support the conclusion? This organizes your thinking when several answer choices use similar terminology.

During review, distinguish a knowledge gap from a reasoning gap. If you did not understand a term, revisit the explanation and create an example. If you understood the term but selected a control that did not address the stated risk, practice comparing near-miss answers. The goal is to recognize why an alternative is insufficient, not merely memorize which letter was correct.

AUD provides a foundation in risk assessment, evidence and internal control. ISC examines many technology-specific applications of those ideas. The overlap makes AUD → ISC a sensible sequence for some candidates, but it is not required. See Best Order to Take the CPA Exams.

Divide your available sessions between concept learning, scenario practice, simulations and cumulative review. Early in preparation, concept learning may take more time. As your vocabulary becomes familiar, increase the share devoted to unfamiliar scenarios and timed exercises.

For example, use two weekday sessions to learn a topic and explain it in your own words, two sessions for mixed multiple-choice questions, and a weekend block for a simulation plus review. Include older topics in the mixed sets. Otherwise, recent chapter cues can make your accuracy look stronger than your independent recall.

At the end of the week, choose one concept weakness and one application weakness to address. A concept weakness might involve database relationships; an application weakness might involve choosing appropriate evidence. This keeps the next week specific and manageable. Adjust the routine to your actual commitments rather than assuming every candidate needs the same number of weeks.

Do not assume that a strong general familiarity with computers replaces knowledge of audit and control terminology. Do not memorize the names of SOC reports without understanding their purpose and users. Do not ignore simulations because MCQs have a higher weight in ISC; 40% remains significant.

ISC stands for Information Systems and Controls. It is one of the three CPA Exam Disciplines and focuses on systems, data, security-related considerations and controls relevant to accounting and assurance.

Effective preparation connects terminology to business scenarios. For example, distinguish verifying a user’s identity from deciding which records that user may change. The goal is to explain how a risk arises, which control addresses it and what evidence supports a conclusion.

No. ISC is available as a Discipline choice for eligible CPA candidates, including those without an IT-audit job. Relevant experience may help, but it is not a substitute for learning the tested material.

Candidates with an audit or controls background may have useful foundations. Candidates without that background can begin with a system-process map and structured explanations, then practice scenarios. Use your response to the actual material to judge fit, rather than deciding solely from your job title.

It depends on your strengths. Different observed pass rates do not prove that ISC will be easier for you than BAR. ISC centers on systems and controls, while BAR places more emphasis on analysis and reporting.

Compare unfamiliar practice from both sections. Ask which explanations make sense, which tasks require substantial new learning and which subject you are willing to practice consistently. A background in IT controls may support ISC; strong reporting knowledge may support BAR.

No. Choosing ISC does not create a separate type of CPA license or permanently restrict your career to technology work. Passing it fulfills the Discipline exam requirement, alongside the required Core sections.

Your jurisdiction’s other licensing requirements still apply. Think of ISC as a choice about the material you will prepare for now, rather than a lifelong professional label. Future work in other areas requires the relevant knowledge, experience and ongoing professional learning.

ISC is a Discipline section, so check the testing calendar for your intended year rather than assuming it is available whenever a Core section is. Also confirm appointment availability and the validity of your Notice to Schedule.

Before booking, check:

Use the current AICPA and NASBA information for dates; availability and scheduling arrangements can change.

A technology background may help, but familiarity with software at work does not automatically translate into understanding systems controls. Conversely, a candidate without an IT job can learn the tested concepts through structured explanations and scenario practice. Start by assessing the material rather than labeling yourself technical or nontechnical.

If AUD was a strength, use that foundation to connect risks, controls and evidence. Then identify systems topics that require new learning. If you are choosing between ISC and TCP, compare your comfort with control scenarios against your comfort with tax rules and planning calculations. Use the Discipline comparison for that decision.

If you enjoy understanding how accounting information is generated, protected and audited, ISC deserves serious consideration. Review the blueprint, try representative ISC questions and use i75 ISC lectures, MCQs and Practice Simulations to turn terminology into application.