CPA ISC Practice Questions

How to use this practice set

Answer each question before viewing its explanation. For multiple-choice items, explain why the best option follows from the facts and why a plausible distractor is wrong. Record the blueprint area, confidence, time and error type. Review guessed answers even when correct.

These questions are original and illustrative, not official AICPA items. Use the official sample test to learn the exam interface and the current blueprint to guide content coverage.

Information Systems and Data Management

Question 1: completeness of an extracted data set

An analyst downloads a sales file for a monthly trend review. The file contains transactions dated through the 28th, but the source system shows posted transactions through the 30th. What is the primary concern before using the analysis?

• A. The analysis uses an accrual basis.
• B. The extracted data may be incomplete.
• C. The file uses a relational database.
• D. The report includes too many fields.

Answer: B. The extracted data may be incomplete.

The source contains posted transactions for the final two days that do not appear in the extract. Completeness of source data should be evaluated before relying on an analysis. The other options do not explain the discrepancy. A correct calculation over incomplete data can still lead to an unreliable conclusion.

Question 2: change management

A developer can move application changes directly into production without an independent approval or documented testing. Which risk is most directly increased?

• A. Unauthorized or defective changes may affect processing.
• B. Customer data will always be encrypted.
• C. The system will retain excess storage capacity.
• D. A user’s password will expire too soon.

Answer: A. Unauthorized or defective changes may affect processing.

The scenario describes a weakness in change management. Independent approval and testing help reduce the risk that unauthorized or defective code affects production processing. The facts do not establish the conditions in the other answers.

Security, Confidentiality and Privacy

Question 3: access control evidence

A company’s policy requires managers to approve new user access. The access system log shows the accounts were created, but no approval record is retained. What is the strongest conclusion?

• A. The policy was followed because the accounts exist.
• B. The evidence is insufficient to show the required approval occurred.
• C. The accounts should be deleted automatically.
• D. The access system has no preventive controls.

Answer: B. The evidence is insufficient to show the required approval occurred.

Account creation proves that access was provisioned, not that required approval preceded it. The missing approval record limits evidence about operation of the control. It does not prove that approval did not occur or that every control is absent. A conclusion should match the available evidence.

Question 4: privacy incident response

An organization discovers that an employee sent a file containing personal information to an unintended recipient. Which action is the most appropriate immediate control response?

• A. Delete the privacy policy.
• B. Activate the incident response process to contain and assess the disclosure.
• C. Assume the file was not opened and close the incident.
• D. Publish the recipient’s information.

Answer: B. Activate the incident response process to contain and assess the disclosure.

The organization should follow its incident response process to contain the event, assess impact and determine required actions. The scenario does not support assuming the file was unopened. The other options do not address containment or assessment.

SOC Engagements

Question 5: intended use of a SOC report

A prospective customer requests a report about controls relevant to user entities’ internal control over financial reporting at a service organization. Which report type most directly addresses that purpose?

• A. SOC 1
• B. SOC 2
• C. SOC 3
• D. SOC for Cybersecurity

Answer: A. SOC 1.

SOC 1 reports address controls at a service organization that may be relevant to user entities’ internal control over financial reporting. SOC 2 focuses on applicable trust services criteria; SOC 3 is a general-use report related to those criteria, and SOC for Cybersecurity has a different purpose. Always consider the case’s stated need and report scope.

Question 6: complementary user-entity control

A SOC report states that customers must approve new user accounts in their own environment. The service organization’s report does not test whether each customer performs that approval. What should a user entity do?

• A. Treat the report as proof that customer approvals occurred.
• B. Evaluate and perform the complementary control assigned to the user entity.
• C. Ignore the complementary control because the service organization has a report.
• D. Replace the control with an annual financial statement audit.

Answer: B. Evaluate and perform the complementary control assigned to the user entity.

A complementary user-entity control is a responsibility that the customer must implement for the described control objectives to be achieved. The service organization report does not demonstrate that each customer performed its own control. The user entity should determine whether the control is relevant and whether it operated.

Short case: evaluate a SOC finding

A service provider’s report covers January through December. One control requires daily review of failed data transfers. The report describes a sample in which two of 25 transfer days had no reviewer sign-off. Management says both days were reviewed verbally but has no retained evidence. The task asks what the evidence supports.

The sample includes two deviations from the documented evidence requirement. Verbal review may have occurred, but the file does not support that conclusion. The evaluator should not dismiss the exceptions solely on management’s unsupported statement. The next step is to assess the nature and significance of the deviations under the engagement criteria and consider additional evidence or impact.

A weak answer would say the control failed every day or that the report proves all transfers were secure. The evidence supports a limited conclusion about the sampled documentation and the missing sign-offs. It does not establish facts outside the sample or prove that no review happened.

Review answers for transfer

After checking a response, explain the underlying principle without looking at the answer. Then attempt a new example with different facts. If you missed a question, identify whether the issue was content, evidence interpretation, control reasoning or report purpose. Repeating the identical item can create recognition without demonstrating transfer.

Balance practice across the three Areas. A strong MCQ result does not replace TBS preparation, and a set focused on security does not show broad blueprint readiness. Keep original examples and official sample materials in their proper roles: authored content helps study concepts; the official sample familiarizes you with the interface.

Official sample test

AICPA’s sample test helps candidates explore exam navigation and response tools. It is not a prediction of live ISC questions and does not replace the blueprint or a complete study plan. Use it alongside independent content practice and your own error log.

A method for reviewing each answer

For every question, state the tested concept in a sentence and identify the fact that makes one answer strongest. Then explain why each plausible alternative is not supported. This guards against learning only the letter or memorizing wording. If the item was a guess, record it as uncertain even when correct.

When you miss an item, classify the cause before choosing what to study next. A missing definition needs a different response from an overlooked period or a conclusion unsupported by evidence. For a TBS, compare your exhibit map and control logic with the solution. Use a new case later to check that the correction transfers.

Balance practice across system and data topics, security/privacy and SOC. A large number of MCQs in one familiar area cannot demonstrate readiness across the blueprint. Include simulation practice regularly because TBSs contribute 40 percent of ISC’s score.

Build a balanced practice routine

Use short practice sets to retrieve concepts, then use longer scenarios to apply them. A session can start with a few mixed MCQs, continue with a focused study task and end with a TBS. The balance should reflect your gaps, but every Area deserves recurring attention.

When reviewing distractors, identify the misconception each one represents. An answer may confuse SOC report types, treat a control’s design as proof of operation or assume data is complete because the output looks reasonable. Naming the misconception helps you recognize it when the facts change.

For the worked SOC case, the scope of the evidence is limited to the sampled transfer days. A careful conclusion does not generalize those two exceptions to every day, but also does not ignore them because management described an undocumented verbal review. This distinction between evidence and assertion is central to assurance reasoning.

Use the official AICPA sample test to explore navigation and response tools. Use authored questions and course material for content practice. Neither a sample interface nor a short practice set predicts the exact mix of live items or the official scaled score.

Try a short self-scoring rubric

For the short SOC case, score your reasoning on four points: did you identify the two exceptions, limit the conclusion to the sample, distinguish management assertion from retained evidence and identify what further evaluation is needed? This rubric rewards a defensible method rather than a memorized phrase.

For the multiple-choice items, mark confidence before checking the key. A correct low-confidence answer deserves review because it may reflect guessing. A wrong answer with high confidence can reveal a misconception that should be prioritized. This extra signal makes a small practice set more useful.

Extend the case with a second decision

Suppose the transfer-control reviewer wants to conclude that daily review operated effectively. The sample shows two days without sign-off and management offers only an oral explanation. The appropriate conclusion is that retained evidence does not support operation on those sampled days. The evaluator should assess significance and seek corroborating evidence, not assume that the entire process failed for the whole year.

This extension tests the boundary of evidence. The exception is real in the sample, but the evidence does not establish what happened on every other day. A proportional answer states both what is known and what remains unresolved.

For a security question, apply the same discipline. A log can show an attempted access, but not necessarily whether data was viewed or disclosed. Identify what the log proves and what additional evidence would be needed for the broader conclusion.

Avoid memorizing the answer key

After each review, rewrite the scenario with one changed fact and predict how the conclusion changes. If approval records are later produced, evidence may differ; if the system log covers only a different period, the conclusion may not apply. This deliberate variation tests whether you understand why the answer was correct.

Keep a log of recurring misconceptions, such as confusing a policy with evidence of operation or treating a report as assurance over every control. Revisit the log weekly and attempt new items. A short targeted review can be more useful than another large set of unrelated questions.

The score weight makes TBS practice relevant, but the MCQ component remains the majority. Preserve a mix of questions and cases so that a practice session reflects the full range of response demands.