CPA ISC study guide
CPA ISC · Work through your exam, one topic at a time.
The CPA Information Systems and Controls (ISC) section is one of the discipline sections of the Uniform CPA Examination, administered by the AICPA and CIMA. It is designed for candidates who have completed the core accounting sections and want to demonstrate competence in the technology, data, and control environment that surrounds financial reporting - the areas where auditors, advisory professionals, and finance teams increasingly spend their time. The section's blueprint is organized around four broad areas: IT governance and risk management; information systems and data management; security, confidentiality, and privacy; and system development, implementation, and operations. Questions test whether a candidate can reason about controls rather than merely recall terminology, so candidates should expect scenarios involving access management, change management, data integrity, and incident response. The CPA ISC study guide has 4 sections and about 1,322 words.
01IT Governance and Risk Management
IT governance is the set of structures and processes that direct and control IT so it supports strategy, delivers value, and keeps risk within appetite. Know which framework answers which question: COBIT for governance and control objectives, ISO/IEC 27001 for an information security management system, ITIL for service management, and the COSO framework (including its ERM version) for internal control and enterprise risk.
351 words, about 2 min02Information Systems and Data Management
Candidates must separate master data (customers, vendors, chart of accounts), transaction data , and reference data , and know that metadata describes structure and lineage. Data governance assigns owners and policies; data quality dimensions include accuracy, completeness, validity, timeliness, and uniqueness.
324 words, about 2 min03Security, Confidentiality, and Privacy
Everything hangs on the CIA triad : confidentiality, integrity, availability. Confidentiality is delivered through data classification , least privilege , need to know , and encryption.
324 words, about 2 min04System Development, Implementation, and Operations
Phases run planning/feasibility, requirements, design, build, test, implement, operate, and retire. Waterfall sequences them with formal signoffs; agile delivers iteratively and increases the risk of weak documentation and informal change control.
323 words, about 2 min