Certified Public Accountant (CPA) Information Systems and Controls (ISC) — Discipline Flashcards

24 sample cards from the Information Systems and Controls (ISC) — Discipline deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. Classify the three types of application controls by transaction stage.

   Input controls (validation, edit checks at data entry), processing controls (ensuring accurate computation/updating), and output controls (ensuring complete, accurate, authorized distribution of results).

2. What is an automated control versus a manual control, and what is a key advantage of automated controls?

   Automated controls are performed by the system without human intervention; manual controls require people. Automated controls are consistent and reliable — if designed properly and ITGCs are effective, a single test of one instance ('benchmarking') may suffice.

3. Distinguish testing the design effectiveness from testing the operating effectiveness of a control.

   Design effectiveness: whether the control, if operating as intended, would prevent or detect material misstatements. Operating effectiveness: whether the control actually operated as designed over the period (consistently, by authorized persons).

4. List common procedures for testing operating effectiveness of controls, from least to most persuasive.

   Inquiry (least persuasive), observation, inspection/examination of evidence, and reperformance (most persuasive). Inquiry alone is never sufficient to test operating effectiveness.

5. How does the frequency of a control affect the auditor's sample size?

   Generally, the more frequently a control operates, the larger the sample needed. For example, a control operating many times daily requires a larger sample than an annually performed control (which may need a sample of one).

6. Differentiate a control deficiency, a significant deficiency, and a material weakness.

   Control deficiency: control fails to prevent/detect misstatements timely. Significant deficiency: important enough to merit attention by those charged with governance. Material weakness: reasonable possibility of a material misstatement not being prevented/detected.

7. When evaluating an IT control deficiency, what two factors determine its severity?

   The likelihood (could a misstatement occur?) and the magnitude/potential impact (how large could the misstatement be?). Compensating controls may reduce the severity of an identified deficiency.

8. What is a compensating control?

   An alternative control that mitigates the risk created by a deficient or missing primary control. It can reduce the severity of a deficiency but must be evaluated for its own effectiveness.

9. What does a SOC 1 engagement report on, and under what standard?

   A SOC 1 reports on a service organization's controls relevant to a user entity's internal control over financial reporting (ICFR). It is performed under SSAE 18 (AT-C section 320).

10. Who are the intended users of a SOC 1 report?

    Restricted-use report: management of the service organization, user entities (customers), and the user entities' auditors. It is not for general public distribution.

11. What does a SOC 2 report address, and to whom is it provided?

    SOC 2 reports on controls relevant to the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). It is a restricted-use report for knowledgeable parties (customers, regulators, partners).

12. List the five Trust Services Criteria categories used in SOC 2.

    Security (the only mandatory/common criteria), Availability, Processing Integrity, Confidentiality, and Privacy. The service organization selects which apply beyond Security.

13. Which Trust Services Criterion is always included in a SOC 2 engagement?

    Security (also called the 'common criteria'). The other four (availability, processing integrity, confidentiality, privacy) are optional and selected based on the services provided and user needs.

14. Contrast SOC 2 with SOC 3 reports.

    Both use the Trust Services Criteria, but SOC 2 is a detailed, restricted-use report (includes the auditor's tests and results). SOC 3 is a short, general-use report suitable for public distribution (no detailed test results).

15. Distinguish a Type 1 from a Type 2 SOC report.

    Type 1: reports on the fairness of the description and suitability of control design at a point in time. Type 2: also tests and reports on the operating effectiveness of controls over a period of time (typically 6–12 months).

16. Why does a user auditor generally prefer a Type 2 over a Type 1 SOC report?

    A Type 2 provides evidence that controls operated effectively over a period, which the user auditor can use to reduce control risk. A Type 1 only covers design at a point in time and gives no operating-effectiveness assurance.

17. What are complementary user entity controls (CUECs)?

    Controls the service organization assumes the user entity (customer) will implement for the service organization's controls to achieve the control objectives/criteria. The user entity is responsible for these, and the user auditor must consider them.

18. What is a subservice organization, and what are the two methods of addressing it in a SOC report?

    A subservice organization is a vendor used by the service organization to perform some services. The two methods: the inclusive method (subservice controls described/tested in the report) and the carve-out method (subservice excluded, relying on CSOCs).

19. Define complementary subservice organization controls (CSOCs).

    Under the carve-out method, CSOCs are controls the service organization assumes the subservice organization has implemented (and excludes from its own report) that are necessary to meet the control objectives or trust services criteria.

20. What is the difference between the inclusive and carve-out methods for subservice organizations?

    Inclusive method: the subservice organization's relevant controls are described and tested within the service organization's SOC report. Carve-out method: those controls are excluded from the description and testing, with reliance placed on CSOCs.

21. Define encryption and contrast symmetric with asymmetric encryption.

    Encryption converts plaintext into unreadable ciphertext using a key. Symmetric: same key encrypts and decrypts (fast, key-distribution challenge). Asymmetric: a public/private key pair (public encrypts, private decrypts) enabling secure exchange and digital signatures.

22. What is a firewall and how does it differ from an intrusion detection system (IDS)?

    A firewall filters and controls network traffic based on rules (preventive). An IDS monitors traffic and alerts on suspicious activity (detective). An IPS (intrusion prevention system) can also actively block detected threats.

23. What is change management and what are its key control steps?

    A formal ITGC process for controlling modifications to systems. Key steps: request and authorization, testing in a non-production environment, approval, and controlled migration to production by independent personnel — with documentation throughout.

24. What is a business impact analysis (BIA) in continuity planning?

    A BIA identifies critical business functions and processes, the impact of their disruption over time, and recovery priorities. It drives the setting of RTOs and RPOs and the allocation of recovery resources.

What this deck covers

Information Systems and Controls (ISC) — Discipline flashcards FAQ