💻 US CPA – Information Systems and Controls (ISC)

Master IT Auditing, Cybersecurity, Data Management and Information Systems Controls

Information Systems and Controls (ISC) is one of the three Discipline sections of the Uniform Certified Public Accountant (US CPA) Examination, developed by the American Institute of Certified Public Accountants (AICPA).

Under the CPA Evolution examination structure, candidates must pass three compulsory Core sections—FAR, AUD and REG—and select one Discipline section from BAR, ISC or TCP.

ISC focuses on the principles and practical applications of information technology, cybersecurity, data management, IT governance, internal controls and System and Organization Controls (SOC) engagements.

The examination evaluates candidates’ ability to understand information systems, assess technology-related risks, evaluate security controls and apply assurance principles to IT environments.

ISC is particularly relevant to aspiring accounting professionals interested in IT auditing, cybersecurity assurance, technology risk management, information systems compliance, internal auditing and IT governance.

📚 US CPA – Information Systems and Controls (ISC): Course Structure & Syllabus

Information Systems and Controls (ISC) is one of the three optional Discipline sections of the Uniform Certified Public Accountant (US CPA) Examination, developed by the American Institute of Certified Public Accountants (AICPA).

The subject focuses on information technology, cybersecurity, IT governance, data management, internal controls and information systems assurance, developing essential competencies in technology risk management and IT auditing.

Key Topics Covered:

1. Information Systems & IT Infrastructure: Computer hardware, software, operating systems, enterprise resource planning (ERP), accounting information systems, cloud computing, networks and IT infrastructure.
2. IT Governance & Risk Management: IT governance frameworks, risk assessment, technology policies, internal control frameworks, IT general controls (ITGCs) and segregation of duties.
3. Cybersecurity & Information Security: Cybersecurity threats, malware, phishing, network security, firewalls, encryption, vulnerability management, incident response and information security controls.
4. Access Controls & Data Protection: User authentication, Multi-Factor Authentication (MFA), Role-Based Access Control (RBAC), privileged access management, data privacy, confidentiality and secure information processing.
5. Data Management & System Controls: Database management, data integrity, data governance, change management, system development, application controls and data processing procedures.
6. Business Continuity & Disaster Recovery: Business Continuity Planning (BCP), Disaster Recovery Planning (DRP), system availability, backup procedures, Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
7. SOC Engagements & IT Assurance: SOC 1, SOC 2 and SOC 3 reporting, Trust Services Criteria, evaluation of control design and operating effectiveness, audit evidence and service organisation assurance.

The ISC examination focuses on understanding information systems, evaluating cybersecurity risks, assessing internal controls and applying IT assurance principles, developing essential skills in technology risk management, information security and professional auditing.

🎓 Eligibility Criteria

The US CPA examination is administered through individual US state boards of accountancy and participating jurisdictions.

Eligibility requirements vary depending on the jurisdiction selected by the candidate.

General Eligibility Considerations:

• Candidates must satisfy the educational requirements prescribed by their selected jurisdiction.
• Requirements may include a recognised bachelor’s degree and specified academic credits.
• Certain jurisdictions require prescribed accounting and business coursework.
• International candidates may need an academic credential evaluation.
• Additional identification, residency or administrative requirements may apply.

Candidates holding qualifications such as B.Com, M.Com, CA, ACCA or other recognised accounting credentials may be eligible, depending on their jurisdiction and evaluation of educational qualifications.

Candidates do not need to pass AUD before attempting ISC. CPA examination sections may generally be attempted in any order, subject to eligibility and scheduling requirements.

Eligibility to sit for the US CPA examination and eligibility to obtain a CPA licence are separate matters.

📝 Examination Pattern

ISC is a computer-based examination conducted at authorised Prometric testing centres during designated Discipline examination windows.

Important Examination Guidelines:

• The examination consists of two MCQ testlets containing 41 questions each.
• Three additional testlets contain six task-based simulations.
• MCQs assess knowledge of information systems, cybersecurity, IT governance and SOC reporting.
• Task-based simulations evaluate practical applications involving information system controls and technology risks.
• Simulations may involve cybersecurity incidents, access controls, system documentation, data management and SOC report analysis.
• The examination evaluates technical knowledge, analytical ability and professional judgement.

✅ Passing Criteria

To successfully clear ISC, candidates must achieve a minimum scaled score of 75 on a scale of 0–99.

Important Information:

• A score of 75 does not represent 75% correct answers.
• Examination scores are calculated using AICPA’s established scoring methodology.
• MCQs contribute 60% and task-based simulations contribute 40% to the overall score.
• Candidates receive a Pass or Fail result.
• Candidates who do not pass may retake ISC in accordance with applicable examination regulations.

Passing ISC satisfies the Discipline examination requirement, subject to the selected jurisdiction’s credit-validity rules.

🎯 Learning Objectives

Studying Information Systems and Controls develops the ability to:

• Understand IT infrastructure and enterprise information systems.
• Evaluate information technology risks and internal controls.
• Understand cybersecurity threats and security management techniques.
• Assess access controls and data protection mechanisms.
• Apply data governance and information management principles.
• Understand business continuity and disaster recovery planning.
• Evaluate system change management procedures.
• Interpret SOC 1, SOC 2 and SOC 3 reports.
• Understand assurance procedures for service organisation controls.
• Apply professional judgement to IT audit and cybersecurity scenarios.

🚀 Develop Expertise in IT Auditing and Information Systems Assurance

ISC builds upon the auditing and internal control concepts covered in AUD and extends into information technology, cybersecurity, data governance and assurance over information systems.

The subject develops the technical knowledge required to evaluate technology-related risks, assess the design and effectiveness of IT controls and understand assurance reporting for service organisations.

As organisations increasingly rely on technology and digital information systems, expertise in cybersecurity, IT governance and information systems assurance becomes increasingly relevant to accounting and auditing professionals.

Mastering ISC develops the technology risk assessment, information systems control and professional assurance knowledge essential for the US CPA qualification.

💻 Technical Requirements – Actuators Educational Institute (AEI)

To ensure a smooth and uninterrupted learning experience, students enrolling in courses offered by Actuators Educational Institute (AEI) are required to use devices that meet the minimum technical specifications supported by the AEI Learning Application.

📱 Minimum Device & Operating System Requirements

📌 Important Information for Students

• Students must ensure that their devices meet the above minimum technical requirements before enrolling in a course.
• A stable internet connection is recommended for accessing online lectures, study materials and other digital learning resources.
• Devices running older or unsupported operating systems may experience compatibility issues or may not support the application.

Note: These are the official minimum technical requirements for accessing courses through the Actuators Educational Institute (AEI) Learning Application. Students are advised to verify device compatibility before completing their course enrolment.