You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 391
If a SOC report's period does NOT align with the user's year-end, the user auditor should:
Select an option first.
Correct answer: D — Address the GAP — via a bridge letter (limited comfort) and/or additional procedures
Explanation: A PERIOD MISALIGNMENT leaves a GAP between the SOC report's period-end and the user's year-end. A BRIDGE LETTER offers limited (unaudited) comfort; the auditor may also need to perform ADDITIONAL PROCEDURES, particularly if the gap is long or the risk is high.
Question 392
The service auditor must be:
Select an option first.
Correct answer: B — INDEPENDENT of the service organisation
Explanation: The SERVICE AUDITOR must be INDEPENDENT of the SERVICE ORGANISATION (the entity whose controls are being examined). Independence from the USER entities is not required — the user auditor is a different party entirely.
Question 393
A user auditor evaluating a SOC report should consider the SERVICE auditor's:
Select an option first.
Correct answer: A — COMPETENCE and INDEPENDENCE
Explanation: The user auditor must evaluate the SERVICE AUDITOR'S professional COMPETENCE and INDEPENDENCE before relying on the report — plus whether the report PERIOD aligns, whether the relevant CRITERIA are covered, and whether the CUECs are actually operating at the user entity.
Question 394
SOC 1 reports are prepared under:
Select an option first.
Correct answer: B — SSAE 18 (AT-C 320)
Explanation: SOC 1 engagements are performed under the ATTESTATION standards — SSAE 18, AT-C section 320 (Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting). SOC 2 engagements are under AT-C 105 and 205, using the Trust Services Criteria.
Question 395
The 'system' in a SOC report comprises:
Select an option first.
Correct answer: B — INFRASTRUCTURE, SOFTWARE, PEOPLE, PROCEDURES and DATA
Explanation: A SOC 'SYSTEM' comprises FIVE components: INFRASTRUCTURE (physical and hardware), SOFTWARE, PEOPLE, PROCEDURES (manual and automated), and DATA. Management's description must fairly present all of them — not merely the technology.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 396
A DEVIATION identified in a SOC 2 Type 2 test:
Select an option first.
Correct answer: A — Must be EVALUATED for significance — an isolated deviation may not preclude an unqualified opinion
Explanation: A single DEVIATION does not automatically qualify the opinion. The service auditor evaluates its NATURE, CAUSE and FREQUENCY, and whether the control objective was nonetheless achieved. Deviations are DISCLOSED in the report regardless, so users can assess them for themselves.
Question 397
A user entity that outsources payroll but RETAINS approval of the payroll register has:
Select an option first.
Correct answer: D — A COMPLEMENTARY USER ENTITY CONTROL that must be operating for the service organisation's controls to be effective
Explanation: The retained APPROVAL is a COMPLEMENTARY USER ENTITY CONTROL (CUEC). The SOC report ASSUMES it is operating. If the user entity does NOT actually perform it, the service organisation's controls do NOT achieve their objectives — and the user auditor must TEST it at the user entity.
Question 398
The INCLUSIVE method for a subservice organisation means:
Select an option first.
Correct answer: A — Subservice controls ARE INCLUDED in the report — the subservice organisation provides a description and cooperates
Explanation: INCLUSIVE: the subservice organisation's controls are INCLUDED in the SOC report; it provides its own description and assertion, and cooperates with the service auditor. It gives the user a complete picture in ONE report — but requires the subservice organisation's cooperation, which is why CARVE-OUT is far more common.
Question 399
A SOC 1 report is RESTRICTED to:
Select an option first.
Correct answer: D — MANAGEMENT of the service organisation, USER ENTITIES, and their AUDITORS
Explanation: A SOC 1 is RESTRICTED to management of the service organisation, USER ENTITIES (existing customers) and their INDEPENDENT AUDITORS. It contains detailed control and testing information and is not for general distribution.
Question 400
A SOC 2 report may cover PRIVACY only if:
Select an option first.
Correct answer: D — The service organisation SELECTS it — only SECURITY is mandatory
Explanation: Only SECURITY (the common criteria) is MANDATORY in a SOC 2. The service organisation SELECTS which of AVAILABILITY, PROCESSING INTEGRITY, CONFIDENTIALITY and PRIVACY to include. A user must therefore CHECK which criteria the report actually covers — a SOC 2 does not automatically address privacy.
Question 401
The service auditor's TESTS OF CONTROLS in a Type 2 engagement include:
Select an option first.
Correct answer: D — INQUIRY, OBSERVATION, INSPECTION and REPERFORMANCE
Explanation: A Type 2 engagement requires the service auditor to TEST OPERATING EFFECTIVENESS using INQUIRY, OBSERVATION, INSPECTION and REPERFORMANCE. Inquiry ALONE is never sufficient — a point carried straight over from AUD.
Question 402
A user entity CANNOT rely on a SOC report for:
Select an option first.
Correct answer: D — Controls that reside at the USER ENTITY itself (including the CUECs)
Explanation: A SOC report addresses controls AT THE SERVICE ORGANISATION. Controls at the USER ENTITY — including the COMPLEMENTARY USER ENTITY CONTROLS the report assumes are operating — must be tested BY THE USER'S OWN AUDITOR. The SOC report does not cover them.
Question 403
The service organisation's SYSTEM DESCRIPTION must be:
Select an option first.
Correct answer: A — FAIRLY PRESENTED — accurate, complete, and not misleading about the system's boundaries
Explanation: The DESCRIPTION must be FAIRLY PRESENTED against the AICPA Description Criteria — accurately describing the system's BOUNDARIES, the services provided, the controls, and any subservice organisations and CUECs. Overstating the system's scope, or omitting a subservice organisation, would make it unfair.
Question 404
A SOC report identifies CONTROL OBJECTIVES in:
Select an option first.
Correct answer: B — SOC 1 — where MANAGEMENT specifies the control objectives; SOC 2 uses the pre-defined TRUST SERVICES CRITERIA instead
Explanation: SOC 1: MANAGEMENT specifies the CONTROL OBJECTIVES (relevant to user entities' ICFR), and the auditor opines on whether the controls achieve them. SOC 2: the criteria are PRE-DEFINED by the AICPA (the Trust Services Criteria) — management does not get to write its own.
Question 405
A user auditor who cannot obtain a SOC report should:
Select an option first.
Correct answer: C — Perform ALTERNATIVE PROCEDURES — visit the service organisation, or test at the user entity
Explanation: If no SOC report is available, the user auditor must obtain the evidence ANOTHER way: contact the service organisation to request procedures be performed, VISIT the service organisation to test controls directly, or perform SUBSTANTIVE procedures at the user entity sufficient to address the risk.
Question 406
The AICPA's Trust Services Criteria are organised around:
Select an option first.
Correct answer: D — The COSO framework — the common criteria map to COSO's components and principles
Explanation: The TRUST SERVICES CRITERIA are aligned to the COSO INTERNAL CONTROL FRAMEWORK — the common criteria (CC1 through CC9) map to COSO's five components and 17 principles. That alignment is deliberate, connecting SOC 2 to the same control framework used in financial reporting.
Question 407
A SOC 2 'common criteria' section CC1 addresses:
Select an option first.
Correct answer: B — The CONTROL ENVIRONMENT (integrity, ethical values, board oversight, competence)
Explanation: The common criteria follow COSO: CC1 = CONTROL ENVIRONMENT; CC2 = Communication and Information; CC3 = Risk Assessment; CC4 = Monitoring; CC5 = Control Activities; CC6 = Logical and Physical Access; CC7 = System Operations; CC8 = Change Management; CC9 = Risk Mitigation.
Question 408
A SOC engagement is performed under:
Select an option first.
Correct answer: B — The ATTESTATION standards (SSAEs)
Explanation: SOC engagements are ATTESTATION engagements performed under the SSAEs — reporting on subject matter OTHER THAN historical financial statements. GAAS governs financial statement AUDITS; the attestation standards govern examinations, reviews and agreed-upon procedures on other subject matter.
Question 409
A service organisation should obtain a SOC report because:
Select an option first.
Correct answer: D — USER ENTITIES and their AUDITORS DEMAND assurance — and one SOC report serves many customers, avoiding dozens of individual audits
Explanation: There is no legal REQUIREMENT for a SOC report. The commercial driver is that CUSTOMERS AND THEIR AUDITORS demand assurance — and without a SOC report, the service organisation would face dozens of individual customer audits. One report satisfies them all, which is far cheaper.
Question 410
A SOC 2 report that discloses several DEVIATIONS may still carry:
Select an option first.
Correct answer: B — An UNQUALIFIED opinion — if the auditor concludes the controls nonetheless operated effectively to achieve the criteria
Explanation: Deviations are DISCLOSED in the report, but do not automatically qualify the opinion. The service auditor evaluates their NATURE, CAUSE, FREQUENCY and whether the criteria were nonetheless achieved. Users should read the DEVIATIONS section themselves rather than relying on the opinion alone.
Question 411
The 'Section 4' of a typical SOC report contains:
Select an option first.
Correct answer: D — The auditor's DESCRIPTION OF TESTS PERFORMED and the RESULTS (including any deviations)
Explanation: A typical SOC report structure: SECTION 1 — the SERVICE AUDITOR'S REPORT (the opinion); SECTION 2 — MANAGEMENT'S ASSERTION; SECTION 3 — the SYSTEM DESCRIPTION; SECTION 4 — the auditor's DESCRIPTION OF TESTS and RESULTS; SECTION 5 (optional) — other information provided by management, which is NOT covered by the opinion.
Question 412
Section 5 of a SOC report (other information) is:
Select an option first.
Correct answer: D — NOT covered by the opinion — it is unaudited information provided by management
Explanation: SECTION 5 contains OTHER INFORMATION provided by management (business continuity plans, roadmaps, responses to deviations). It is explicitly NOT COVERED by the service auditor's opinion. Users sometimes mistakenly rely on it as though it were audited.
Question 413
A SOC report for a CLOUD PROVIDER is relevant to a user entity because:
Select an option first.
Correct answer: D — The provider's controls affect the SECURITY and PROCESSING of the user's data — outsourcing the SYSTEM does not outsource ACCOUNTABILITY
Explanation: Moving to the cloud transfers the CONTROL but NOT the ACCOUNTABILITY. The user entity remains responsible for its own financial statements and its own data. A SOC report is how it obtains assurance over the controls it no longer operates itself.
Question 414
The MOST significant limitation of a Type 1 report is that it:
Select an option first.
Correct answer: C — Provides NO evidence that the controls actually OPERATED — only that they were designed
Explanation: A TYPE 1 tells you the controls were suitably DESIGNED on ONE DAY. It provides NO evidence of OPERATING EFFECTIVENESS. A user auditor seeking to place RELIANCE needs a TYPE 2 — a Type 1 supports almost no reliance at all.
Question 415
If a service organisation's SOC 2 covers only SECURITY, a user concerned about system uptime should:
Select an option first.
Correct answer: C — Recognise the report does NOT address AVAILABILITY, and seek other assurance
Explanation: A SOC 2 covering only SECURITY says NOTHING about AVAILABILITY, PROCESSING INTEGRITY, CONFIDENTIALITY or PRIVACY. A user concerned about uptime must seek other assurance — request that availability be added to the next report, or rely on SLA reporting and its own monitoring.
Question 416
A SOC 1 control objective might be:
Select an option first.
Correct answer: C — Controls provide reasonable assurance that transactions are processed COMPLETELY and ACCURATELY
Explanation: SOC 1 CONTROL OBJECTIVES relate to the USER ENTITIES' ICFR — completeness, accuracy, validity, authorisation and cut-off of transaction processing. A password length requirement is a CONTROL, not a control objective, and would be more at home in a SOC 2 security context.
Question 417
The service auditor must obtain a WRITTEN ASSERTION from management. If management REFUSES:
Select an option first.
Correct answer: C — The auditor should WITHDRAW — the written assertion is a PRECONDITION for the engagement
Explanation: MANAGEMENT'S WRITTEN ASSERTION is a PRECONDITION for a SOC engagement. If management refuses to provide it, the service auditor should WITHDRAW. The engagement is built on management asserting, and the auditor examining — without the assertion, there is nothing to examine.
Question 418
A user entity's auditor finds the SOC 2 report covers 1 January to 30 September; the user's year-end is 31 December. The auditor should:
Select an option first.
Correct answer: C — Address the 3-MONTH GAP — obtain a bridge letter (limited comfort) and/or perform additional procedures
Explanation: The 3-month GAP between the SOC period-end (30 September) and the user's year-end (31 December) is NOT covered. A BRIDGE LETTER provides UNAUDITED management comfort. Depending on the risk, the auditor may need ADDITIONAL PROCEDURES — testing controls directly, or expanding substantive work.
Question 419
A bridge letter covering an 8-MONTH gap is:
Select an option first.
Correct answer: B — EXCESSIVE — bridge letters are generally limited to about 6 months; an 8-month gap needs more than management's assertion
Explanation: BRIDGE LETTERS are generally accepted only for gaps of up to about SIX MONTHS. An 8-month gap means the majority of the user's year is uncovered by an audited report, and an unaudited management assertion is thin comfort. The auditor should seek a SOC report covering the period, or test directly.
Question 420
A SOC 2 identifies a CUEC: 'user entities are responsible for removing terminated users' access'. If the user entity does NOT do this:
Select an option first.
Correct answer: C — The service organisation's ACCESS CONTROLS DO NOT achieve their objective — the gap is at the USER
Explanation: The SOC report ASSUMES the CUEC is operating. If the user does NOT remove terminated users' access, the service organisation's access controls DO NOT achieve their objective — but the FAILURE IS AT THE USER. The user auditor must TEST the CUEC at the user entity.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.