You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 421
A SOC 1 Type 2 covering 6 months is used by a user auditor for a 12-month audit. The auditor should:
Select an option first.
Correct answer: D — Consider whether SIX MONTHS provides sufficient evidence for the FULL YEAR, and address the remaining period
Explanation: A 6-MONTH Type 2 covers HALF the user's year. The auditor must consider whether that provides sufficient evidence of operating effectiveness for the whole period — and address the remaining six months through a bridge letter, additional procedures, or expanded substantive testing.
Question 422
A SOC report contains a QUALIFIED opinion because a control did NOT operate effectively. The user auditor should:
Select an option first.
Correct answer: B — Identify WHICH control failed, assess whether it is RELEVANT to the user's financial statements, and respond accordingly
Explanation: A QUALIFICATION does NOT invalidate the entire report. The user auditor must determine WHICH control objective was not achieved, whether that control is RELEVANT to the user's own financial statement assertions, and — if so — perform additional procedures to compensate. Other controls in the report may remain reliable.
Question 423
A service organisation refuses to provide a SOC report, citing confidentiality. The user auditor should:
Select an option first.
Correct answer: C — Recognise this as a SCOPE LIMITATION risk — seek alternative evidence (visit the service organisation, test at the user) or consider the implications for the opinion
Explanation: A refusal to provide assurance is a serious matter. The auditor must seek the evidence ANOTHER way — requesting the service organisation permit procedures, VISITING to test directly, or performing sufficient SUBSTANTIVE procedures at the user. If evidence cannot be obtained and the amounts are material, a SCOPE LIMITATION arises.
Question 424
A SOC 2 report's DEVIATIONS section lists 4 exceptions in a control tested 40 times. The user should:
Select an option first.
Correct answer: C — EVALUATE the nature and cause of the deviations — a 10% deviation rate is significant and warrants investigation
Explanation: A 10% deviation rate (4 of 40) is significant. The user should read the DEVIATIONS section itself — examining the NATURE, CAUSE and the service organisation's RESPONSE — rather than relying solely on the opinion. The auditor may have concluded the objective was still achieved, but the user must form its own view of the residual risk.
Question 425
The 'SYSTEM BOUNDARIES' in a SOC report matter because:
Select an option first.
Correct answer: C — They define WHAT IS AND IS NOT COVERED — a service may fall OUTSIDE the described system
Explanation: The SYSTEM BOUNDARIES define exactly which services, applications, infrastructure and locations are COVERED. A user relying on a SOC report for a service that falls OUTSIDE the described boundaries gets NO assurance at all — a trap where a provider's SOC covers its core platform but not the newer module the user actually uses.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 426
A user entity relies on a service organisation for PAYROLL PROCESSING. The relevant SOC report is:
Select an option first.
Correct answer: D — SOC 1 — payroll affects the user's FINANCIAL STATEMENTS (ICFR)
Explanation: PAYROLL processing directly affects the user's FINANCIAL STATEMENTS — expense, accruals, liabilities. That makes it an ICFR matter, and the relevant report is a SOC 1. A SOC 2 might ALSO be useful (for security and availability), but the FINANCIAL STATEMENT auditor needs the SOC 1.
Question 427
A user entity relies on a cloud provider for DATA SECURITY but the provider does not process financial transactions. The relevant report is:
Select an option first.
Correct answer: D — SOC 2 — the concern is SECURITY, not financial reporting
Explanation: If the concern is SECURITY, AVAILABILITY or PRIVACY rather than financial reporting, the relevant report is a SOC 2. SOC 1 exists specifically to serve the user's FINANCIAL STATEMENT AUDITOR. Matching the concern to the report is the core SOC skill.
Question 428
A prospective customer asks for a SOC report before signing. The service organisation should provide:
Select an option first.
Correct answer: B — SOC 3 — it is GENERAL USE and can be shared with prospects; SOC 1 and SOC 2 are RESTRICTED
Explanation: SOC 1 and SOC 2 are RESTRICTED — to existing user entities and their auditors. A PROSPECT is not yet a user entity. The SOC 3, being GENERAL USE, is the report designed to be shared publicly (often posted on the website). Some providers share a SOC 2 with prospects under NDA, but SOC 3 is the intended vehicle.
Question 429
A SOC 2 covering SECURITY and AVAILABILITY but NOT CONFIDENTIALITY means:
Select an option first.
Correct answer: A — The report provides NO assurance over CONFIDENTIALITY controls
Explanation: Each Trust Services Criterion is DISCRETE. A report covering Security and Availability provides NO assurance over CONFIDENTIALITY, PROCESSING INTEGRITY or PRIVACY. Users routinely assume 'security' covers everything — it does not. Always check which criteria are in scope.
Question 430
The service auditor's opinion on the DESCRIPTION addresses whether it is:
Select an option first.
Correct answer: B — FAIRLY PRESENTED — accurate and not misleading, per the Description Criteria
Explanation: The auditor opines on whether the DESCRIPTION is FAIRLY PRESENTED against the AICPA's DESCRIPTION CRITERIA — accurate, complete in the required respects, and NOT MISLEADING. A description that omits a material subservice organisation, or overstates the system's boundaries, is NOT fairly presented.
Question 431
A service organisation changes its systems significantly mid-period. The SOC 2 Type 2 report should:
Select an option first.
Correct answer: C — DESCRIBE the change and the controls in operation during EACH portion of the period
Explanation: A significant system change mid-period means DIFFERENT controls operated in different parts of the period. The DESCRIPTION must disclose the change, and the auditor must TEST the controls that operated in EACH portion. A report silently describing only the new system would not be fairly presented.
Question 432
A SOC 2 report's opinion is UNQUALIFIED but the DEVIATIONS section shows a critical access control failed 6 of 25 times. The user should:
Select an option first.
Correct answer: B — READ THE DEVIATIONS — a 24% failure rate on a critical access control is significant, whatever the opinion says
Explanation: The OPINION is the auditor's overall conclusion; the DEVIATIONS are the evidence. A 24% failure rate on a CRITICAL ACCESS control is material information regardless of how the auditor concluded. Users must READ SECTION 4 themselves and form their own view of the residual risk they are accepting.
Question 433
A SOC 1 report's control objective is not achieved. The user auditor should FIRST:
Select an option first.
Correct answer: B — Determine whether that control objective is RELEVANT to the USER'S financial statement assertions
Explanation: Not every control objective in a SOC 1 is relevant to every user. The auditor must FIRST determine whether the failed objective affects an assertion RELEVANT TO THIS USER'S financial statements. If it does not, no further response is needed. If it does, additional procedures are required.
Question 434
A service organisation's SOC 2 covers PROCESSING INTEGRITY. This provides assurance that:
Select an option first.
Correct answer: A — The PROCESSING is complete, valid, accurate, timely and authorised — NOT that the input data was correct
Explanation: PROCESSING INTEGRITY assures that the SYSTEM PROCESSES data correctly. It does NOT assure that the INPUT DATA was correct — garbage in, garbage out, correctly processed. A user relying on processing integrity for DATA ACCURACY has misread the criterion.
Question 435
A user entity's CUEC is 'review the exception report we provide'. The user does not have a process to do so. The consequence:
Select an option first.
Correct answer: C — The service organisation's control does NOT achieve its objective — and the USER auditor must treat this as a control gap AT THE USER
Explanation: The SOC report ASSUMES the user reviews the exception report. If the user has NO PROCESS to do so, the control chain is BROKEN — at the user's end. The user auditor must identify this gap and respond (test compensating controls, or expand substantive procedures).
Question 436
A service organisation issues its FIRST SOC 2 Type 2 covering only THREE MONTHS. A user should:
Select an option first.
Correct answer: B — Recognise the SHORT PERIOD provides LIMITED evidence of SUSTAINED operating effectiveness
Explanation: A THREE-MONTH period is common for a first-year engagement, but it provides LIMITED evidence of SUSTAINED effectiveness. A user auditor covering a 12-month year must consider how to address the other NINE months — and should expect subsequent reports to cover a full period.
Question 437
A service organisation's SOC report excludes a SUBSERVICE organisation under the carve-out method. The user's exposure is:
Select an option first.
Correct answer: B — UNASSESSED — the user must obtain the subservice organisation's own SOC report or perform other procedures
Explanation: The CARVE-OUT leaves the subservice organisation's controls entirely UNASSESSED in the report you hold. Your exposure to that provider is real and unmeasured. You must obtain ITS SOC report — and if IT uses a further subservice organisation, the chain continues. Nested outsourcing creates nested assurance gaps.
Question 438
A SOC 2 report is dated 15 March for a period ending 31 December. The user's year-end is 31 December. This is:
Select an option first.
Correct answer: C — FINE — the report period ALIGNS with the user's year; the report DATE is simply when it was issued
Explanation: Do not confuse the REPORT PERIOD with the REPORT DATE. The period (ending 31 December) is what matters, and it aligns perfectly with the user's year-end. The report DATE (15 March) is simply when the auditor completed and issued it — as with any audit report.
Question 439
A user relies on a SOC 1 for a service organisation that also holds the user's PERSONAL DATA. For privacy assurance, the user should:
Select an option first.
Correct answer: C — Seek a SOC 2 covering the PRIVACY criterion — SOC 1 addresses ICFR only
Explanation: A SOC 1 addresses INTERNAL CONTROL OVER FINANCIAL REPORTING. It says NOTHING about privacy, security or availability. For privacy assurance, the user needs a SOC 2 that INCLUDES the PRIVACY criterion — and must check, because privacy is optional in a SOC 2.
Question 440
The service auditor identifies a control that management DESCRIBED but that does NOT EXIST. This affects:
Select an option first.
Correct answer: A — The FAIRNESS OF THE DESCRIPTION — management described something that is not there, so the description is not fairly presented
Explanation: Describing a control that DOES NOT EXIST makes the DESCRIPTION not fairly presented — a separate opinion element from design and operating effectiveness. The service auditor opines on THREE things in a Type 2: description fairness, design suitability, and operating effectiveness. This failure hits the FIRST.
Question 441
A user entity relies on a service organisation for INVOICE PROCESSING and INVENTORY MANAGEMENT. It receives a SOC 1 covering only invoice processing. The user should:
Select an option first.
Correct answer: B — Recognise INVENTORY MANAGEMENT is OUTSIDE the system boundaries — no assurance is provided over it
Explanation: SYSTEM BOUNDARIES define what is covered. A SOC 1 scoped to invoice processing provides NO assurance over inventory management, even though the same vendor performs both. Users routinely assume a vendor's SOC report covers everything the vendor does — it covers only what the description says it covers.
Question 442
A SOC 2 opinion states controls operated effectively 'throughout the period 1 Jan to 31 Dec'. A user whose year-end is 30 June:
Select an option first.
Correct answer: B — CAN use it — the SOC period FULLY ENCOMPASSES the user's year, but the second half of the user's prior year needs consideration
Explanation: A SOC period of 1 Jan to 31 Dec fully covers 1 Jan to 30 June of the user's year. What it does NOT cover is 1 July to 31 December of the PRIOR year — the first half of the user's fiscal year. The auditor needs the PRIOR year's SOC report for that portion.
Question 443
A user entity should evaluate whether the SOC report's TESTS were:
Select an option first.
Correct answer: B — SUFFICIENT in NATURE, TIMING and EXTENT to support the conclusion — a control tested ONCE provides limited evidence
Explanation: The user auditor should read SECTION 4 to see WHAT WAS TESTED, HOW, and HOW MANY items. A daily control tested with a sample of 2 provides very limited evidence. Evaluating the sufficiency of the service auditor's testing is part of evaluating the report's reliability.
Question 444
The service auditor's INDEPENDENCE must be assessed by:
Select an option first.
Correct answer: C — The USER AUDITOR, before relying on the report
Explanation: The USER AUDITOR must evaluate the SERVICE AUDITOR'S professional COMPETENCE and INDEPENDENCE before relying on their report. A SOC report from a firm with no relevant experience, or with an independence impairment relative to the service organisation, would not support reliance.
Question 445
A service organisation refuses to allow the user auditor to test controls directly, and provides no SOC report. This is:
Select an option first.
Correct answer: D — A SCOPE LIMITATION — if the amounts are material and no alternative evidence is available, the opinion must be modified
Explanation: If the auditor CANNOT obtain sufficient appropriate evidence about controls at a service organisation that are material to the financial statements — no SOC report, no access to test — that is a SCOPE LIMITATION. The auditor must consider whether substantive procedures at the user can compensate. If not, the opinion is QUALIFIED or DISCLAIMED.
Question 446
A SOC 2's PRIVACY criterion assesses whether personal information is:
Select an option first.
Correct answer: B — COLLECTED, USED, RETAINED, DISCLOSED and DISPOSED OF in accordance with the entity's PRIVACY NOTICE and criteria
Explanation: The PRIVACY criterion evaluates the full LIFECYCLE of personal information against the entity's own PRIVACY NOTICE and the applicable criteria: notice and choice, collection, use/retention/disposal, access, disclosure to third parties, quality, and monitoring/enforcement. Encryption is a control that may support it — it is not the criterion.
Question 447
A SOC report identifies that the service organisation uses a SUBSERVICE organisation for backups. Using CARVE-OUT, the user should:
Select an option first.
Correct answer: B — Obtain assurance over the BACKUP subservice organisation SEPARATELY — its controls are excluded from this report
Explanation: BACKUPS carved out means the report you hold provides NO assurance over them — a serious gap for an availability-dependent user. You must obtain the backup provider's own SOC report, or otherwise assess its controls. The carve-out is easy to overlook precisely because it appears in the description, not the opinion.
Question 448
A user auditor concludes the SOC 1 report is INSUFFICIENT. The alternatives are:
Select an option first.
Correct answer: B — VISIT the service organisation to test controls directly, or perform SUBSTANTIVE procedures at the user sufficient to address the risk
Explanation: If a SOC report is insufficient (wrong scope, wrong period, Type 1 rather than Type 2, or qualified in a relevant area), the auditor may: request the service organisation permit direct testing; VISIT and test the controls; or design SUBSTANTIVE procedures at the user entity that address the risk without relying on the service organisation's controls at all.
Question 449
A SOC 3 report is appropriate for:
Select an option first.
Correct answer: B — GENERAL public distribution — marketing, prospects, and website posting
Explanation: SOC 3 is GENERAL USE: it contains the auditor's opinion and a brief system description, but NO detailed description of controls, tests or results. That makes it safe for public distribution and useless for a user auditor seeking to place reliance — who needs the detail in a SOC 1 or SOC 2.
Question 450
A service organisation's management asserts controls were effective, but the auditor's testing finds otherwise. The report will:
Select an option first.
Correct answer: A — Contain a QUALIFIED (or adverse) opinion — the AUDITOR'S conclusion governs, not management's assertion
Explanation: MANAGEMENT ASSERTS; the AUDITOR EXAMINES and OPINES. Where the auditor's evidence contradicts the assertion, the auditor's opinion is MODIFIED and the basis explained. Management's assertion does not constrain the auditor's conclusion — that is the entire point of an independent examination.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.