ISC: Information Systems and Controls is one of the three Discipline sections of the CPA Exam. To pass the exam, candidates must pass AUD, FAR and REG, plus one Discipline section of their choice: BAR, ISC or TCP. Sections can be taken in any order.
What ISC covers
- Information systems and data management
- Security, confidentiality and privacy
- System and Organization Controls (SOC) engagements
Candidates interested in IT audit, risk and controls often lean toward ISC. Your Discipline choice does not limit the areas you can practice in as a CPA, so pick the one that fits your interests and strengths.
Exam basics
- Four hours of testing time
- Multiple-choice questions and task-based simulations
- Scores range from 0 to 99, and 75 or higher passes. Scores are not percentages correct.
For the official topic list, see the AICPA’s 2026 CPA Exam Blueprints (effective January 1, 2026). See how all six sections fit together on the Exam Outlines page.
Want help with this section?
I work with candidates one on one. Book a tutoring session, or explore Copernicus CPA Review, where I’m the Lead Instructor.