CPA ISC

It tests whether you can evaluate IT general controls and the systems that produce financial data: governance and risk, data management, security and privacy, and system development and operations. Expect scenario-based questions about access, change management, backups, and incident handling rather than pure definition recall.

Like the other CPA core and discipline sections, it is delivered at a Prometric test center as a timed, computer-based exam combining multiple-choice questions and task-based simulations. The precise item counts, time allocation, and scoring weights are set by the AICPA and change over time, so verify them on the official blueprint before you schedule.

Difficulty is largely a function of your background. Candidates with audit or IT-audit experience often find the control-testing content familiar, while those from pure financial accounting roles need extra time on networks, databases, and cloud concepts. Choose the discipline where your existing knowledge gives you the largest head start.

Start with IT governance and risk management, because the control concepts there - risk assessment, control frameworks, segregation of duties - reappear throughout the security, operations, and data sections. Build vocabulary and frameworks first, then move into technical domains where the terminology is less familiar.

Yes, candidates may retake CPA sections, but the waiting period, attempt limits, and any score-expiration rules are set by the AICPA and your state board and are subject to change. Confirm the current retake policy with your board of accountancy and your jurisdiction's candidate bulletin before assuming a timeline.

The most common failure modes are treating it as a memorization exam instead of a reasoning exam, skipping the technical domains because they feel intimidating, and under-practicing task-based simulations. Many candidates also misread questions that hinge on a single word such as 'preventive' versus 'detective' or 'prevent' versus 'detect.'

Most candidates budget roughly the same study window they used for a core section, adjusted upward if their IT background is weak. Rather than copy someone else's number, take a diagnostic set of questions early, measure your accuracy by blueprint area, and allocate hours to the weakest areas until practice scores stabilize.

Discipline sections count toward the examination requirement for licensure, but score expiration, the order in which sections may be taken, and any credit-transfer rules vary by jurisdiction and are revised periodically. Check your state board's current requirements rather than relying on older guidance.

The AICPA & CIMA website publishes the exam blueprint, sample tests, and candidate guidance, and your state board of accountancy publishes jurisdiction-specific rules on fees, eligibility, and scoring. Always treat those official sources as authoritative over third-party study material, including this page.