Discipline section study guide

ISC CPA Exam Study Guide: Format, Topics, and Study Plan

Build your understanding of systems, security, controls, and SOC engagements as you prepare for exam day.

Quick answer

Information Systems and Controls is one of the three Discipline choices. It covers information systems and data management, security, confidentiality and privacy, and SOC engagements. ISC differs from the other five sections because MCQs carry 60 percent of the score and TBSs carry 40 percent. Use this guide to understand the exam, plan what to learn, and find explanations for each ISC topic.

Need the full testing and score calendar? See ISC CPA Exam dates and score releases.

Free CPAPass account

Learn ISC and prepare for exam day

Create a free account to learn and prepare. Explore videos, lectures, flashcards, and practice questions in one learning platform.

Create free account Try public questions

ISC format and score weight

ISC is a 4-hour Discipline section. Its two MCQ testlets contain 41 and 41 questions. Its three TBS testlets contain 1, 3, 2 tasks. The testlets total 82 MCQs and 6 TBSs.

Section type

Discipline

Testing time

4 hours

Multiple-choice

82 MCQs · 60%

Simulations

6 TBSs · 40%

Current ISC content areas

Use these ranges to allocate coverage, then adjust for your own practice results. The ranges do not predict the exact number of questions or tasks on an individual exam.

Area	Official content area	Score allocation
I	Information Systems and Data Management	35-45%
II	Security, Confidentiality and Privacy	35-45%
III	Considerations for System and Organization Controls (SOC) Engagements	15-25%

Official exam sources

Blueprint tasks are representative, not exhaustive. The number of listed tasks does not establish content weight or predict the exact questions a candidate will receive.

Open the official Blueprint Learn how to use the Blueprint Review all CPA Exam sections

Free ISC PDF pack

Keep a section-specific sample offline

Request the ISC MCQ and TBS PDFs when you want a portable sample. The PDF request is separate from creating a CPAPass account.

Get the free ISC PDFs

Your ISC study sequence

This is CPAPass study guidance, not an official timetable. Adjust the time you spend at each stage to your starting knowledge, schedule, and understanding of the material.

Stage 1 of 5

Systems and information

Use videos and lectures to connect business processes, applications, infrastructure, and data. Reinforce the vocabulary with flashcards tied to concrete examples.

What to produce: A systems map showing how information moves and who is responsible at each step.
Move on when: You can explain the purpose of a system component in a business process.

.section-study-interactive { display: none !important; }

1. Systems and information

Use videos and lectures to connect business processes, applications, infrastructure, and data. Reinforce the vocabulary with flashcards tied to concrete examples.

What to produce: A systems map showing how information moves and who is responsible at each step.

Move on when: You can explain the purpose of a system component in a business process.

2. Controls and risks

Learn general and application controls and the differences between preventive, detective, and corrective controls. Connect each control to a risk and supporting evidence.

What to produce: A control matrix linking the risk, objective, control, responsible party, and evidence.

Move on when: You can explain what a control is intended to achieve and how its operation could be checked.

3. Security and resilience

Study access, change management, privacy, incident response, continuity, and recovery. Compare examples that change the risk or the information being protected.

What to produce: A comparison of safeguards and response steps for the security and recovery scenarios you study.

Move on when: You can distinguish similar terms and select a response that fits the stated objective.

4. SOC engagements

Learn the purpose, scope, and coverage of SOC reports. Follow worked examples involving service organizations, complementary controls, and report users.

What to produce: A comparison table linking the report to its purpose, coverage, controls, and intended users.

Move on when: You can explain what a report does and does not tell its reader.

5. Integrated preparation

Connect the topics in timed MCQs and simulations. Use lessons and flashcards to revisit close distinctions, then explain the control or reporting conclusion.

What to produce: Review notes connecting each misunderstood term or control to a practical example.

Move on when: You can read a scenario, identify the objective, and explain the evidence supporting your conclusion.

Choose your next ISC step

Start learning with CPAPass, download a sample, or explore public questions.

Learn and prepare for ISC

Build your knowledge with videos, lectures, and flashcards, then apply it with practice questions. No credit card required.

Create free account

Request the ISC PDFs

Get MCQ and TBS samples for offline review. Email required.

Get free PDFs

Answer ISC questions

Try public questions with explanations. No account required.

Start free practice

Explore ISC topic guides

Find the explanation you need for your next study session.

Systems and data

Understand information flows, applications, and data management.

Accounting information systems Database controls

View 2 more guides

Cloud computing Data lifecycle management

Controls and access

Connect control objectives to access and system changes.

IT general controls Application controls

View 3 more guides

Logical access controls Change management controls Authentication vs. authorization

Security and resilience

Protect information and plan for incidents and disruption.

Incident response Business continuity and disaster recovery

View 2 more guides

Encryption vs. hashing Data privacy controls

SOC engagements

Understand reports, criteria, and user responsibilities.

SOC 1 vs. SOC 2 Trust Services Criteria

View 1 more guide

Complementary user entity controls

ISC study FAQs

Can I learn ISC without a technology background?

Start by mapping familiar business processes to the systems, data, and controls that support them. Use lectures and concrete examples before reinforcing terms with flashcards. Build toward security and SOC reporting once you can explain the underlying system and control objectives.

How much time should I give each study stage?

Adjust the stages to your starting knowledge, available study time, and understanding of the material. Use each stage's output and move-on check to decide what to revisit. A fixed number of weeks is not a guarantee of readiness.

Can I try ISC practice before creating an account?

Yes. The public ISC practice questions and explanations are available without registration. The MCQ and TBS PDF samples are requested separately by email. Create a free CPAPass account to learn and prepare with videos, lectures, flashcards, and practice questions in one platform.

Start learning for ISC

Create a free account to learn and prepare. No credit card required.

Create free account