Introduction to Information Systems and Controls

Learning Objectives

• Understand the purpose and scope of the ISC discipline section
• Identify the major content areas tested in information systems and controls
• Recognize how ISC connects technology concepts to accounting and auditing
• Distinguish between IT infrastructure, security, and SOC engagement topics

What is the ISC Section?

Information Systems and Controls is one of three discipline sections introduced under the 2024 CPA Evolution model. ISC is designed for candidates pursuing careers in IT audit, cybersecurity, systems consulting, or any role where technology intersects with financial reporting and controls.

The ISC section tests your understanding of IT infrastructure, data management, cybersecurity, privacy regulations, and SOC engagements. Unlike other CPA exam sections, ISC requires you to think about how technology systems support — or undermine — the integrity of financial data.

Key Areas of the ISC Section

The ISC section is organized around three content areas:

1. Information Systems and Data Management (35-45%) — IT infrastructure and architecture, enterprise resource planning (ERP) systems, accounting information systems, data management and lifecycle, system availability, and change management processes.

2. Security, Confidentiality, and Privacy (35-45%) — Security frameworks (NIST, COBIT, ISO 27001), threat identification and vulnerability assessment, security controls and monitoring, privacy regulations (GDPR, CCPA), and incident response and recovery procedures.

3. Considerations for System and Organization Controls (15-25%) — SOC engagement types (SOC 1, SOC 2, SOC 3), Type I vs Type II reports, Trust Services Criteria, and the relationship between SOC reports and audit reliance.

Why ISC Matters for CPAs

Technology is embedded in every aspect of modern accounting:

• Financial data flows through IT systems — ERPs, databases, and automated processes generate the numbers that appear on financial statements
• Internal controls are increasingly automated — Understanding IT general controls and application controls is essential for audit work
• Cybersecurity is a board-level concern — CPAs are increasingly called upon to evaluate and report on security and privacy controls
• SOC reports bridge technology and assurance — CPAs issue SOC reports that organizations rely on to evaluate third-party service providers

ISC is the natural choice for candidates interested in IT audit, consulting, or any practice area where technology risk is a primary concern. The demand for CPAs with technology expertise continues to grow.

Key Terms

• IT general controls (ITGCs) — Controls over the IT environment that support the proper functioning of application controls, including access security, change management, and operations
• SOC report — System and Organization Controls report, an assurance engagement where a CPA examines and reports on controls at a service organization
• Trust Services Criteria — The five categories (security, availability, processing integrity, confidentiality, privacy) used as the framework for SOC 2 engagements
• Incident response — The organized approach to detecting, containing, and recovering from security breaches or cyberattacks