CPA ISC case studies

CPA ISC · Put your knowledge to work in context.

The CPA Information Systems and Controls (ISC) section is one of the discipline sections of the Uniform CPA Examination, administered by the AICPA and CIMA. It is designed for candidates who have completed the core accounting sections and want to demonstrate competence in the technology, data, and control environment that surrounds financial reporting - the areas where auditors, advisory professionals, and finance teams increasingly spend their time. The CPA ISC case studies are 5 cases and about 6,400 words.

Vendor Attestation Gap and Shadow SaaS at Northwind Distribution

Northwind Distribution ($600M revenue) is privately held but must give its lender audited financials under a covenant. The new CIO finds two problems.

1,243 words, about 6 min 2

ERP Cutover at Ridgeline Components: Go/No-Go With $2.9M Unreconciled

Ridgeline Components is ten days from cutting over from a 14-year-old on-premise ERP to a cloud suite. The conversion has been tested three times.

1,229 words, about 6 min 3

Ransomware at a EU Subsidiary: Containment, Notification, and the Demand

Saturday, ransomware detonated across the EU subsidiary of a US manufacturer: 4,000 endpoints and 60 servers encrypted, three plants halted. The EDR console generated alerts at 2:20 a.m., but no one monitors it after 6 p.m.

1,290 words, about 6 min 4

Change Management By-Pass in a High-Velocity CI/CD Pipeline

Meridian Insurance deploys about 60 times a week through a CI/CD pipeline. Twenty-two engineers hold permission to push directly to production, and the change advisory board reviews only changes estimated at more than 40 hours of effort; everything else is classified 'standard.' Internal audit sampled 50 production changes and found 14 with no evidence of testing and 3 that could not be tied to any ticket.

1,261 words, about 6 min 5

Aggregating ITGC Deficiencies Before Year-End at Calder Health

Calder Health is an SEC registrant with six operating locations on one ERP instance. During interim testing the auditor found: for 3 of 40 terminated employees sampled, network access remained active for an average of 22 days after termination; 8 of 60 changes lacked documented approval; one plant shares a single privileged database account among three administrators; and two warehouses use badge access with no retained entry log.

1,377 words, about 7 min