Prepare for the American Institute of Certified Public Accountants (AICPA) Certified Public Accountant Information Systems and Controls (CPA ISC) section with 24 free sample questions, an 82-question multiple-choice question (MCQ) diagnostic, topic drills, timed practice, and detailed explanations aligned to the 2026 blueprint.
Use this page when you are preparing for the Certified Public Accountant Information Systems and Controls section and want a direct practice route. The public preview gives you sample questions and a full-length MCQ diagnostic; the web app adds mixed sets, topic drills, timed mocks, progress tracking, and full practice.
Mastery Exam Prep is independent exam-prep software. These are original practice questions, not official CPA Exam questions from AICPA, NASBA, or any state board.
| Item | Detail |
|---|---|
| Provider | American Institute of Certified Public Accountants (AICPA) |
| Exam section | Certified Public Accountant Information Systems and Controls (CPA ISC) |
| CPA Exam role | Discipline section |
| Current blueprint focus | 2026 AICPA ISC blueprint |
| Practice reference on this site | 82-question multiple-choice question (MCQ) diagnostic plus topic drills and mixed practice |
| Time reference | 4 hours |
| Passing score reference | 75 |
| Important format note | The CPA ISC section also involves task-based simulations and exhibit-heavy work. Use the free page as a multiple-choice diagnostic, then use the full practice route for broader repetition and review. |
| Abbreviation | Meaning | Why it matters for practice |
|---|---|---|
| CPA | Certified Public Accountant | This is the professional credential path. The page supports exam practice, not licensure advice. |
| ISC | Information Systems and Controls | This section focuses on information systems, data management, security, confidentiality, privacy, and system and organization controls engagements. |
| MCQ | Multiple-choice question | The public full-length page is an MCQ diagnostic. Use it for concept and pacing review, not as a promise that every live item type is represented. |
| AICPA | American Institute of Certified Public Accountants | Use the sponsor’s current materials and your state-board requirements as the final authority before exam day. |
| ISC blueprint area | Official weighting range |
|---|---|
| Information Systems and Data Management | 35-45% |
| Security, Confidentiality and Privacy | 35-45% |
| Considerations for System and Organization Controls Engagements | 15-25% |
CPA ISC rewards candidates who can connect system facts to risks, controls, data reliability, security objectives, privacy obligations, and SOC reporting implications. Strong answers identify the process boundary and the control objective before choosing a response.
| If the stem is mainly about… | It usually belongs here because… |
|---|---|
| information systems, data management, security, confidentiality, privacy, and system and organization controls engagements | CPA ISC is the section built around this judgment area. |
| audit evidence, engagement risk, independence, or reporting | compare with CPA AUD before drilling more CPA ISC questions. |
| recognition, measurement, presentation, or disclosure | compare with CPA FAR before drilling more CPA ISC questions. |
| business analysis, performance management, reporting analysis, or governmental accounting | compare with CPA BAR before drilling more CPA ISC questions. |
Use multiple-choice practice to build control vocabulary, then pair it with exhibit-style systems review. For CPA ISC, that means tracing process narratives, access matrices, data-flow descriptions, control descriptions, privacy facts, and SOC report excerpts before choosing the risk or control response. When you miss an MCQ, identify whether the weakness was process boundary, control objective, data reliability, user-control responsibility, or report-scope judgment.
| If your misses look like… | Drill next |
|---|---|
| You miss system-flow questions | drill information systems and data management questions with process-boundary notes |
| You confuse control objectives | drill security, confidentiality, and privacy questions |
| You miss SOC language | drill system and organization controls engagement questions separately |
Need concept review before timed practice? Read the CPA ISC guide on CPAExamsMastery.com, then return here for sample questions, topic drills, timed mocks, and the full practice route.
Use these child pages when you want focused Mastery Exam Prep practice before returning to mixed sets and timed mocks.
These are original Mastery Exam Prep practice questions aligned to the live CPA ISC route and the main blueprint areas shown above. Use them to test readiness here, then continue in Mastery Exam Prep with mixed sets, topic drills, and timed mocks.
Topic: Information Systems and Data Management
A CPA is performing a SOC 2 readiness review for a service organization that processes customer refund batches. The processing integrity service commitment states that authorized refund files received by 8:00 p.m. will be processed completely, accurately, and only once by midnight.
During a walkthrough, the CPA learns:
The CPA’s main unresolved concern is whether accepted files are processed completely and only once as they move between systems. To evaluate whether a deficiency exists in the suitability of design of controls, what should the CPA do next?
Best answer: A
Explanation: The unresolved risk is at the handoffs between file acceptance, queuing, and posting. The next step is to inspect whether controls such as reconciliations, record counts, and duplicate checks are designed to ensure transactions are processed completely and only once. Testing calculations or access first would skip the design issue. Suitability of design focuses on whether the controls, if they operate as intended, would meet the processing integrity commitment. Here, malformed-file validation addresses input format, and a next-day job-status dashboard may indicate whether a batch ran, but neither control addresses whether all accepted records moved completely from the gateway to the queue to the settlement application or whether duplicates were prevented. The CPA should next understand the end-to-end data flow and inspect whether record-count reconciliations, hash totals, duplicate detection, and exception handling are built into the interfaces. If those controls are missing, the issue is a design deficiency because the current control set would not reasonably achieve complete, accurate, and one-time processing even if performed consistently.
Topic: Security, Confidentiality and Privacy
At 9:10 a.m., a company’s security team confirms that a terminated contractor’s VPN credentials were used overnight to access a shared drive containing customer tax documents. Log review shows a 3.8 GB download to an external IP address, and the unauthorized VPN session is still active. The incident response plan includes classification, containment, eradication, recovery, notification, and post-incident review. What should the company do next?
Best answer: C
Explanation: The active unauthorized VPN session makes containment the most relevant incident response component. The company should first stop additional access and preserve evidence before moving to eradication, notification, or lessons learned. When an incident is confirmed and malicious access is still occurring, containment is the next priority. In this scenario, a terminated contractor’s credentials are being used, sensitive customer tax documents were accessed, and the session remains active. Disabling the account and terminating the session reduce ongoing harm, while preserving logs supports investigation, scope assessment, and later decisions about notification. Eradication and recovery come after the threat is contained. Customer notification may eventually be required, but it is premature before the organization confirms the incident’s extent and applicable reporting obligations. Post-incident review happens after response activities are completed.
Topic: Considerations for System and Organization Controls Engagements
A service auditor issued a SOC 2 Type 2 report on April 15 for the period October 1 through December 31, 20X4. On May 10, the auditor learns that service organization management knew before April 15 of a December privileged-access failure that was omitted from the system description and would likely have changed the auditor’s conclusion. Management refuses to revise the description or inform intended users.
What is the most appropriate response by the service auditor?
Best answer: A
Explanation: This is a subsequently discovered fact that existed before the report was issued and is significant enough to affect the system description and likely the conclusion. The service auditor should seek revision, and if management refuses to cooperate, take appropriate steps to prevent intended users from relying on the original report. In a SOC engagement, if the service auditor later becomes aware of facts that existed at the report date and that would likely have affected the system description or the auditor’s conclusion, the issue is not ignored just because the auditor learned of it after issuance. The service auditor should discuss the matter with management, determine whether the description and report need revision, and request that appropriate action be taken. Because the system description is management’s responsibility, the auditor does not simply rewrite it alone. If management refuses to revise the description or notify intended users, the auditor should take steps to prevent further reliance on the report. The deciding facts here are that the condition existed before issuance, management knew of it, and it was significant enough to have likely changed the conclusion.
Topic: Information Systems and Data Management
A distributor uses a single vendor-hosted system with modules for sales order entry, inventory, accounts receivable, and the general ledger. All modules read from and write to the same database. When warehouse staff confirm shipment, the system automatically creates the customer invoice, updates accounts receivable, reduces inventory, records cost of goods sold, and posts the related accounting entries. How should this environment be best characterized?
Best answer: C
Explanation: The system is best characterized as an integrated ERP-based accounting information system. A single operational event, shipment confirmation, automatically updates multiple accounting records through one shared database, which is the key feature of ERP integration. An enterprise resource planning system integrates business processes across functions by using a common application environment and shared data. The accounting information system within an ERP does not operate separately; instead, operational events such as shipping, purchasing, or receiving inventory can automatically trigger accounting effects in subledgers and the general ledger. In this scenario, shipment confirmation causes invoicing, accounts receivable updates, inventory reduction, cost of goods sold recognition, and related postings without separate batch transfers or manual reentry. That means the system is processing transactions, not merely storing reports or managing customer contacts. A stand-alone AIS usually relies on interfaces from other systems, while a data warehouse is mainly for analysis, and a CRM is centered on customer and sales activities rather than full accounting processing.
Topic: Security, Confidentiality and Privacy
During a SOC 2 walkthrough of a payroll SaaS provider, the CPA notes the following:
Which corrective response best addresses this privacy control deficiency?
Best answer: D
Explanation: The issue is excessive retention of personal data beyond the stated 60-day period, including downstream copies. A monitored retention-and-deletion workflow is the best corrective response because it aligns actual processing with the privacy notice and removes data from all repositories unless a valid exception is approved. This is a privacy retention and disposal deficiency, not primarily an access-security problem. The organization promised deletion within 60 days, but personal data remains indefinitely in other repositories after the client relationship ends. The corrective response should therefore establish a retention schedule tied to the termination event, identify every system holding the data, delete or securely dispose of the data from those locations, document approved exceptions, and monitor completion. Encryption, MFA, and access reviews can strengthen confidentiality and security, but they do not satisfy a privacy commitment to delete data when it is no longer needed. Revising the notice to allow indefinite retention would avoid the promise rather than correct the control gap, especially when no legal or contractual exception applies.
Topic: Considerations for System and Organization Controls Engagements
A CPA is completing a SOC 2 Type 2 examination of a payroll SaaS provider. Management provided the system description and cooperated with control testing throughout the period, but on the report date management refuses to sign a written representation letter, saying the CPA’s procedures already provide enough evidence. What is the most appropriate action for the CPA?
Best answer: B
Explanation: In a SOC examination, written representations from management are required evidence and are obtained as of the report date. If management refuses to provide them, the CPA cannot rely only on testing or oral statements; the refusal typically leads to a disclaimer of opinion or withdrawal. Management written representations are a required part of evidence in a SOC engagement. In a SOC 2 Type 2 examination, management ordinarily represents its responsibility for the system description, the suitability of control design, and the operating effectiveness of controls throughout the specified period. Those representations are obtained in writing as of the practitioner’s report date. If management refuses to provide them, the problem is not cured by oral statements, extra disclosure, or issuing the report first and collecting the letter later. The refusal creates a scope limitation and may also raise concerns about management integrity. Accordingly, the CPA should disclaim an opinion or withdraw from the engagement, if withdrawal is available.
Topic: Information Systems and Data Management
A CPA is evaluating controls over an internally developed billing application. Management states that the purpose of the company’s change management process is to reduce the risk that unauthorized or untested program changes reach production. Which source of evidence would BEST support that conclusion?
Best answer: A
Explanation: The change ticket with documented request, testing, approval, and separate production migration most directly supports the conclusion. Those elements show why change management exists: to keep unauthorized or untested changes out of production and reduce disruption to processing. Change management for internal applications is intended to ensure changes are formally initiated, evaluated, tested, approved, and moved into production in a controlled manner. Strong evidence of that purpose includes a documented change request, testing in a nonproduction environment, approval by appropriate business or IT personnel, and controlled migration to production. A record containing all of those elements best supports the conclusion because it ties the change to both authorization and controlled implementation. By contrast, production access information, separate environments, or an incident report may each be useful for other conclusions, but none of them as directly demonstrates the full purpose of change management practices.
Topic: Security, Confidentiality and Privacy
During a review of privacy source materials, a CPA compares the company’s public privacy notice with observed procedures:
Which is the best corrective response?
Best answer: D
Explanation: The issue is a mismatch between disclosed privacy commitments and actual data-retention procedures. Because the stem says no legal or contractual reason requires retention beyond 30 days, management should bring operations into line with the notice or formally change the disclosed commitment before using a longer period. When privacy source material states a specific retention or deletion commitment, the key question is whether actual processing follows that commitment. Here, the notice promises deletion within 30 days unless law requires longer retention, but the observed process keeps data 180 days for marketing and delays deletion requests until quarter-end. Since the facts say no law, contract, or litigation hold requires the longer period, this is a privacy control exception and a source-material inconsistency. The best correction is to reconcile operations to the published notice or formally revise and disclose a supportable retention period before continuing the longer practice. Adding encryption may strengthen confidentiality, but it does not fix an inaccurate privacy promise, and breach notification is not required absent unauthorized access or disclosure.
Topic: Considerations for System and Organization Controls Engagements
A service organization is issuing a SOC 2 Type 2 report on the security category for the year ended December 31. The service auditor determined that:
Which reporting conclusion is most supported?
Best answer: B
Explanation: The best conclusion is a qualified SOC 2 Type 2 opinion. The service auditor had sufficient evidence, the system description and carve-out disclosure were proper, and the identified problem was a material operating effectiveness exception that was limited to one application rather than pervasive. In a SOC 2 Type 2 engagement, the opinion addresses whether the system description is fairly presented, controls are suitably designed, and controls operated effectively throughout the period. A qualified opinion is appropriate when there is a material issue that is not pervasive. Here, the missed quarterly access reviews created an operating effectiveness problem, but the facts state it was limited to one in-scope application and not pervasive to the system as a whole. An adverse opinion would fit a material and pervasive problem. A disclaimer would fit a scope limitation or inability to obtain sufficient evidence. Properly disclosing a carved-out subservice organization and related CUECs does not, by itself, require modification.
Topic: Information Systems and Data Management
A service organization is being examined under SOC 2 for the availability category. Management’s documented availability service commitments and system requirements include:
Which finding is the clearest design deficiency, rather than an operating deviation?
Best answer: B
Explanation: The correct choice is the absence of any control to assess whether the secondary region can handle production workload within the stated 2-hour recovery objective. That is a design deficiency because the control framework itself lacks a necessary procedure to support the availability commitment, even if existing controls operate as planned. In a SOC 2 context, a design deficiency exists when controls are not suitably designed to achieve the stated service commitments and system requirements. An operating deviation exists when a suitably designed control is not performed, is performed late, or is not documented as required. Here, management promises restoration within 2 hours after a regional outage. Continuous replication supports the recovery point objective, but replication alone does not prove the secondary region can process full production demand within the recovery time objective. If no control evaluates failover capacity against that requirement, the availability control set is incomplete by design. By contrast, a missed test, a delayed test, or one missed review reflects failure in execution of an existing control, which is an operating deviation rather than a design flaw.
Topic: Security, Confidentiality and Privacy
Northside Pediatrics has the following arrangements and requests:
Which statement is the best interpretation under HIPAA?
Best answer: C
Explanation: Northside is a HIPAA covered entity because it is a health care provider that transmits standard transactions electronically. The health plan request relates to payment, which is a permitted disclosure without authorization, while the employer HR request generally is not permitted without the patient’s authorization. Under HIPAA, covered entities include health care providers that transmit health information electronically in connection with covered transactions such as claims submission. That means Northside remains a covered entity even though it outsourced billing support. ClaimsPro, acting under a business associate agreement, is a business associate rather than the covered entity replacing Northside. The Privacy Rule generally permits uses and disclosures of PHI without authorization for treatment, payment, and health care operations. A health plan’s request for documentation to adjudicate a submitted claim fits payment, so Northside may disclose the necessary information without separate patient authorization. By contrast, an employer HR department requesting diagnosis and treatment notes for leave administration is generally not a permitted routine disclosure unless the patient authorizes it or another specific exception applies.
Topic: Considerations for System and Organization Controls Engagements
A claims-processing service organization is preparing a SOC 2 report. A third-party cloud provider hosts the production environment and performs physical security, hypervisor patching, and backup replication. Those controls are relevant to the security and availability criteria.
The cloud provider will not allow the service auditor access to its personnel or records and will not provide a written assertion for inclusion in the report. Management can describe the services the cloud provider performs and the controls it expects the provider to operate.
How should this subservice organization arrangement be characterized in the SOC 2 report?
Best answer: B
Explanation: The cloud provider is a subservice organization because it performs part of the system relevant to the SOC 2 report. Since it will not provide audit access or a written assertion for inclusion, the arrangement would generally be presented using the carve-out method rather than the inclusive method. The choice between inclusive and carve-out presentation turns largely on whether the subservice organization can be brought into the scope of the service auditor’s work. Under the inclusive method, the subservice organization’s relevant controls are included in the system description and are subject to testing, which generally requires the subservice organization’s cooperation, access to personnel and records, and appropriate representations. When that participation is unavailable or impractical, the service organization usually uses the carve-out method. Under carve-out, the report describes the services performed by the subservice organization but excludes that organization’s controls from the service auditor’s opinion. The service organization may also identify complementary subservice organization controls expected at the provider. These provider-operated controls are not complementary user entity controls, because user entities do not perform them.
Topic: Information Systems and Data Management
An entity’s internal IT team administers a virtualized environment dedicated exclusively to the entity for its core general ledger system. During quarter-end, the entity shifts certain reporting workloads to a third-party provider’s multi-tenant cloud platform through a secure connection, while both environments remain in use. Which cloud deployment model best describes the entity’s overall arrangement?
Best answer: D
Explanation: Hybrid cloud is correct because the entity uses both a private environment dedicated to its own use and a public multi-tenant cloud service. The key fact is that the two distinct environments are connected and both support operations. A private cloud is used exclusively by one organization, even if a third party hosts or manages parts of it. A public cloud is a shared, multi-tenant environment provided to multiple customers. A hybrid cloud exists when an organization uses at least two distinct environments, such as private and public cloud, and they remain separate but are connected to support data sharing or workload movement. Here, the core general ledger runs in an environment dedicated exclusively to the entity, which indicates private cloud characteristics, while quarter-end processing uses a third-party multi-tenant platform, which indicates public cloud characteristics. Because both environments are used together through a secure connection, the overall arrangement is hybrid cloud.
Topic: Security, Confidentiality and Privacy
During implementation of a new billing application, a company refreshed its QA database from production for user acceptance testing. Company policy states that confidential payment card numbers must not be readable in nonproduction environments. Management concludes that confidential data was protected during testing.
Which source most strongly supports that conclusion?
Best answer: D
Explanation: The change record with masking and validation is the best support because it directly ties the production-to-QA refresh to a control that made the confidential field unreadable in nonproduction. The other sources are relevant background, but they do not prove the test data itself was protected during testing. For confidential data in design, development, testing, and implementation, the strongest evidence is direct evidence that the sensitive data was protected where the risk exists. Here, the risk is that production payment card data was copied into QA for testing. A change record showing that a masking routine was applied during the refresh, plus validation that no full card numbers remained, directly supports management’s conclusion. A data dictionary only identifies the field as sensitive; it does not show any protection was applied. An access listing supports least-privilege access, but authorized users could still view full values if masking was not performed. A vendor SOC 2 excerpt about encryption at rest helps with infrastructure security, but it does not show the application test data was de-identified or otherwise unreadable in QA.
Topic: Considerations for System and Organization Controls Engagements
A service auditor is planning a SOC 2 Type 2 examination for a payroll SaaS provider for the year ended December 31, 20X5. Relevant planning facts:
Which statement best reflects the planning impact of these facts?
Best answer: D
Explanation: Under the carve-out method, controls at the subservice organization are excluded from the service auditor’s opinion. Planning therefore focuses on whether the carve-out is properly described and whether the service organization has effective controls to monitor the outsourced provider. In a SOC engagement, a subservice organization may be presented using either the inclusive method or the carve-out method. If management uses the carve-out method, the subservice organization’s controls are not included in the service auditor’s opinion on the service organization’s system. That planning fact affects scope and procedures: the auditor evaluates whether the carve-out is appropriately disclosed and tests the service organization’s own controls over selecting, overseeing, and responding to issues at the outsourced provider. The outsourced provider’s controls are not complementary user entity controls, because CUECs are controls expected at the user entity, not at another service organization. The outsourcing also affects risk assessment because hosting and backup services can significantly affect security and availability commitments.
Topic: Information Systems and Data Management
An auditor is reviewing an emergency configuration change to a payment application. Based on the exhibit, which control deficiency is best supported?
| Item | Detail |
|---|---|
| Change ID | EC-417 |
| Reason | API timeout errors were blocking customer orders |
| Change type | Emergency configuration change |
| Preimplementation approvals | CIO 9:10 p.m.; Operations manager 9:12 p.m. |
| Testing | Staging smoke test passed; results attached |
| Rollback plan | Restore prior timeout value from config backup; estimated 5 minutes |
| Production access used | Shared account prod-admin; individual user activity not separately identifiable |
| Implementation time | 9:20 p.m. |
| Postimplementation review | Scheduled for next business day |
Best answer: A
Explanation: The strongest deficiency is the use of a shared production account. Emergency changes may be expedited, but production activity still should be attributable to a specific authorized person, and the exhibit shows that approvals, testing, and rollback planning were present. Emergency changes can shorten normal timelines, but they should not bypass key control objectives. The exhibit documents preimplementation approvals, evidence of staging testing, and a defined rollback plan, so those areas are not the clearest problem. The control gap is production access: the change was implemented through a shared administrative account, and individual actions were not separately identifiable. That weakens accountability, monitoring, and investigation because management cannot reliably determine who performed which production actions. A stronger control would use individually assigned, time-limited elevated access with logging and follow-up review.
Topic: Security, Confidentiality and Privacy
A company uses the following access-control process for its ERP system:
During testing, the CPA notes that two terminated employees kept active ERP access for up to 6 days after termination. Which action is the best correction to this control weakness?
Best answer: D
Explanation: The weakness is not how users authenticate or how access is initially approved. It is that terminated users keep access too long, so the best fix is an access revocation control that disables accounts promptly when HR records the termination. Authentication confirms who the user is, such as with passwords and MFA. Authorization and access provisioning determine what access a user receives, often through approved roles. Access review is a periodic check that existing access remains appropriate. Access revocation removes access when it is no longer needed, especially after termination. In this scenario, authentication is already in place, role-based provisioning exists, and quarterly reviews occur. The failure is that IT waits for a weekly HR spreadsheet, leaving terminated users active for several days. The most effective correction is to link HR termination events to immediate account disablement or deprovisioning so access ends as soon as employment ends.
Topic: Considerations for System and Organization Controls Engagements
A CPA is reviewing the following draft SOC 2 system description excerpt for CloudLedger, a payroll SaaS provider.
Based on the exhibit, which conclusion about the system boundary is supported?
Best answer: A
Explanation: The system boundary includes the service organization’s own components used to provide the service, such as its people and procedures. Here, CloudLedger’s monitoring staff and incident response procedures are explicitly listed in scope, while AWS and Twilio are carved out and customer devices remain user responsibilities. In a SOC 2 engagement, the system boundary is defined by the components of the service organization’s system that are included in the description and subject to the engagement. Those components commonly include the service organization’s infrastructure, software, people, procedures, and data used to deliver the service. When a subservice organization is presented using the carve-out method, the subservice organization’s controls are not included within the described system boundary, even if its services are relevant. Likewise, customer-managed laptops, browsers, and access approval activities are user entity responsibilities, not part of the service organization’s system. In this exhibit, CloudLedger’s production monitoring personnel and incident response procedures are clearly listed as in scope, so they are within the system boundary.
Topic: Information Systems and Data Management
An accounting system team provided the following database exhibit. The “Key / rule” column lists every defined key constraint for each column.
| Table | Column | Key / rule |
|---|---|---|
| Customer | CustomerID | Primary key; not null |
| Customer | CustomerName | Not null |
| SalesRep | SalesRepID | Primary key; not null |
| SalesRep | SalesRepPhone | Not null |
| OrderHeader | OrderID | Primary key; not null |
| OrderHeader | CustomerID | Not null |
| OrderHeader | SalesRepID | Not null |
| OrderHeader | SalesRepPhone | Not null |
Current master rows:
Customer.CustomerID values: 100, 101SalesRep row: SalesRepID 7, SalesRepPhone 555-0100Current OrderHeader rows:
| OrderID | CustomerID | SalesRepID | SalesRepPhone |
|---|---|---|---|
| 8101 | 100 | 7 | 555-0100 |
| 8102 | 999 | 7 | 555-0100 |
| 8103 | 101 | 7 | 555-0100 |
Which conclusion is best supported by the exhibit?
Best answer: C
Explanation: The data dictionary shows that OrderHeader.CustomerID is only defined as not null, not as a foreign key, so referential integrity with Customer is not enforced. The order row with CustomerID 999 confirms an orphan reference, and repeating SalesRepPhone in each order suggests a normalization problem because that attribute depends on SalesRepID. A primary key uniquely identifies a row in its own table. A foreign key stores a related primary key value in another table and is what supports referential integrity by requiring a matching parent row. The data dictionary is the proper source to confirm whether those constraints are actually defined. Here, Customer.CustomerID and SalesRep.SalesRepID are primary keys, but OrderHeader.CustomerID is only marked not null. That allows OrderHeader to contain CustomerID 999 even though no matching customer exists. Also, SalesRepPhone is repeated in OrderHeader even though it is determined by SalesRepID, not by OrderID. Repeating that attribute across many order rows creates redundancy and possible update anomalies, which is a normalization issue.
Topic: Security, Confidentiality and Privacy
A company documents its current cybersecurity practices and its desired future cybersecurity outcomes, then compares the two against the NIST Cybersecurity Framework to identify gaps and prioritize improvements. Under the NIST Cybersecurity Framework, this is best characterized as a(n):
Best answer: A
Explanation: The correct classification is Organizational Profile. In the NIST Cybersecurity Framework, profiles are used to describe current and target cybersecurity outcomes and compare them to identify gaps and improvement priorities. The NIST Cybersecurity Framework has three main parts: the Core, Implementation Tiers, and Organizational Profiles. The Core organizes cybersecurity outcomes and activities, while Implementation Tiers describe how formally and consistently an organization manages cybersecurity risk. Organizational Profiles are used when an entity maps its current state and desired target state to the Framework and then compares them to identify gaps. Because the scenario focuses on documenting current and desired outcomes and using that comparison to prioritize improvements, it fits the definition of an Organizational Profile rather than the Core or an Implementation Tier.
Topic: Considerations for System and Organization Controls Engagements
In a SOC 2 Type 2 examination over the security category, the service auditor determined that management’s system description is fairly presented, quarterly privileged-access reviews were not performed for the production environment during 11 of the 12 months under examination, the production environment supports substantially all in-scope services so the failure is pervasive to the security criteria, and there is no scope limitation. What report conclusion is most appropriate?
Best answer: C
Explanation: The keyed response is correct because the service auditor identified a pervasive failure in operating effectiveness, not a narrow exception. Since the system description is fairly presented and there is no scope limitation, the appropriate modification is an adverse opinion on operating effectiveness rather than a qualified opinion or disclaimer. In a SOC 2 Type 2 examination, the service auditor opines on whether the system description is fairly presented, controls are suitably designed, and controls operated effectively over the period. When evidence shows a control deficiency, the opinion depends on how significant and pervasive the problem is. A material but limited problem may lead to a qualified opinion. A pervasive problem that affects substantially all in-scope services or criteria supports an adverse opinion on the affected aspect of the report. A disclaimer is different: it is used when the auditor cannot obtain sufficient appropriate evidence or another scope limitation prevents a conclusion. Here, the auditor has evidence, the description is fairly presented, and the operating failure is pervasive, so adverse on operating effectiveness is the best conclusion.
Topic: Information Systems and Data Management
A CPA is evaluating a retail company’s order-import control during a SOC 2 engagement.
Order import process: Web store -> ERP sales order table
Expected control:
- Reject any order if customer_id is not in the active customer master file.
- Log rejected orders for follow-up.
Test results for 500 imported web orders:
- 18 orders had customer_id values not found in the active customer master file.
- All 18 orders were still assigned ERP sales order numbers and released to fulfillment.
- Imported field values matched the source web orders exactly.
- All 500 orders were imported within the required 15-minute window.
Which processing integrity objective is most directly affected by the issue shown in the exhibit?
Best answer: B
Explanation: The exhibit shows that orders failing a master-file validation rule were processed instead of rejected. That is a validity problem because the system accepted inputs that did not meet required business rules, while the facts indicate the orders were processed completely, accurately transferred, and on time. Validity focuses on whether transactions accepted by the system meet defined business rules and represent acceptable inputs. Here, the control was supposed to reject any order whose customer_id was not found in the active customer master file. Because 18 such orders were still assigned ERP sales order numbers and sent to fulfillment, the system processed invalid transactions. This is not primarily a completeness issue because all 500 orders were imported, not an accuracy issue because the imported values matched the source web orders, and not a timeliness issue because processing occurred within the required 15-minute window. The most direct processing integrity failure is validity.
Topic: Security, Confidentiality and Privacy
During a quarterly access review of the payroll system, management noted these facts:
PAYROLL-ADMIN account for emergency fixes.PAYROLL-ADMIN but do not identify which individual used the account.Which issue is most directly identified by this access review?
Best answer: C
Explanation: The review points to weak privileged-access monitoring because a shared administrator account is used and the logs do not show which person performed each privileged action. The facts do not indicate unnecessary access, incompatible duties, or inactive accounts left enabled. Weak privileged-access monitoring exists when elevated activity cannot be effectively tracked, attributed, or reviewed at the individual-user level. Here, the employees still need elevated access, so the issue is not stale accounts or excessive access based on job need. The scenario also does not describe one person having incompatible responsibilities, so segregation of duties is not the main problem. The decisive fact is that privileged changes are logged only under a shared admin ID, which prevents clear accountability and weakens monitoring over high-risk access.
Topic: Considerations for System and Organization Controls Engagements
A CPA is reviewing a SOC 2 Type 2 report for a cloud payroll processor. Which excerpt most clearly belongs in the service auditor’s tests of controls and results section, rather than in management’s assertion, the system description, CUECs, CSOCs, or service commitments?
Best answer: B
Explanation: The excerpt about sampling terminated-user tickets and noting one late removal is the only choice that reports the service auditor’s procedure and the result of that procedure. Management assertions, system descriptions, CUECs, CSOCs, and service commitments describe claims, system facts, responsibilities, or promises, not audit test results. In a SOC 2 Type 2 report, the tests of controls and results section explains what the service auditor actually tested and what was found. Common clues are the control tested, the procedure performed, the sample or items examined, and any exceptions or deviations noted. Management’s assertion is management’s claim about fair presentation, suitable design, and operating effectiveness. The system description explains the service organization’s system and processing environment. CUECs and CSOCs identify complementary controls expected at user entities or carved-out subservice organizations. Service commitments are promises such as availability, security, or processing expectations. Those items help users understand the system and responsibilities, but they are not the service auditor’s testing results.