You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 451
The SOC 2 criteria for CONFIDENTIALITY apply to:
Select an option first.
Correct answer: D — Information DESIGNATED as CONFIDENTIAL by the entity — of any type (trade secrets, contracts, business plans)
Explanation: CONFIDENTIALITY applies to information the entity has DESIGNATED as confidential — trade secrets, contracts, business plans, customer lists — of any type. PRIVACY, by contrast, applies specifically to PERSONAL INFORMATION. A user needing assurance over PERSONAL data needs the PRIVACY criterion, not confidentiality.
Question 452
A user needs assurance over both FINANCIAL PROCESSING and SECURITY at the same service organisation. It should seek:
Select an option first.
Correct answer: A — BOTH a SOC 1 (for ICFR) AND a SOC 2 (for security) — they serve different purposes
Explanation: SOC 1 and SOC 2 address DIFFERENT things and serve DIFFERENT audiences. A user with BOTH financial reporting and security concerns needs BOTH reports. Many service organisations produce both, precisely because their customers ask for both.
Question 453
A SOC report's period covers a time when the service organisation MIGRATED to a new platform. The report should:
Select an option first.
Correct answer: A — DESCRIBE the migration and address the controls operating during EACH portion of the period
Explanation: Where a significant CHANGE occurs mid-period, DIFFERENT controls operated in different portions. The description must disclose it, and the auditor must TEST the controls in each portion. A report silently describing only the end-state system would not be FAIRLY PRESENTED.
Question 454
A SOC 1 Type 2's TESTS OF CONTROLS section shows a control was tested by INQUIRY ONLY. This is:
Select an option first.
Correct answer: D — INSUFFICIENT — inquiry alone is never sufficient evidence of operating effectiveness
Explanation: INQUIRY ALONE IS NEVER SUFFICIENT — a principle carried directly from AUD into SOC engagements. Operating effectiveness testing requires INQUIRY combined with OBSERVATION, INSPECTION or REPERFORMANCE. A user auditor reading Section 4 and finding inquiry-only testing should question the report's reliability for that control.
Question 455
The 'RISK OF MATERIAL MISSTATEMENT' at a user entity is affected by a service organisation because:
Select an option first.
Correct answer: C — Some of the CONTROLS over the user's transactions now reside at the SERVICE ORGANISATION
Explanation: When a user outsources a process, some of the CONTROLS over its own transactions now reside at the SERVICE ORGANISATION. Those controls are relevant to the user's RMM assessment — which is why the user auditor must obtain an understanding of them, via a SOC report or otherwise.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 456
A user entity that outsources but retains ALL key controls internally:
Select an option first.
Correct answer: A — May need LESS reliance on a SOC report — if the user's OWN controls fully address the risk, the service organisation's controls may not be relevant
Explanation: If the user retains sufficient controls of its OWN (independently reconciling all output, re-performing key calculations), it may not need to RELY on the service organisation's controls at all. The auditor can test the USER'S controls instead. The need for a SOC report depends on whether the auditor intends to RELY on the service organisation.
Question 457
A SOC report's value to the SERVICE ORGANISATION is primarily:
Select an option first.
Correct answer: D — COMMERCIAL — one report satisfies many customers' assurance demands, avoiding dozens of individual customer audits
Explanation: There is no legal REQUIREMENT for a SOC report. The driver is COMMERCIAL: without one, the service organisation would face dozens of individual customer audits — disruptive and expensive. One SOC report satisfies them all. It has also become a de facto requirement to win enterprise business.
Question 458
The SOC 2 common criteria CC6 addresses:
Select an option first.
Correct answer: A — LOGICAL and PHYSICAL ACCESS controls
Explanation: The common criteria follow COSO: CC1 Control Environment; CC2 Communication and Information; CC3 Risk Assessment; CC4 Monitoring; CC5 Control Activities; CC6 LOGICAL AND PHYSICAL ACCESS; CC7 System Operations; CC8 CHANGE MANAGEMENT; CC9 Risk Mitigation.
Question 459
The SOC 2 common criteria CC8 addresses:
Select an option first.
Correct answer: B — CHANGE MANAGEMENT
Explanation: CC8 = CHANGE MANAGEMENT. Note how the SOC 2 common criteria map closely onto the ITGC domains: CC6 (access), CC7 (operations), CC8 (change management) — reflecting the same underlying control concerns the financial statement auditor cares about.
Question 460
A user auditor finds the SOC report covers the RIGHT period, RIGHT criteria, and is UNQUALIFIED. It should still:
Select an option first.
Correct answer: A — Identify and TEST the CUECs at the user entity, and evaluate the service auditor's competence and independence
Explanation: Even a perfect SOC report does NOT complete the work. The user auditor must still: identify the COMPLEMENTARY USER ENTITY CONTROLS and TEST them AT THE USER; evaluate the SERVICE AUDITOR'S competence and independence; and consider whether any SUBSERVICE organisations were carved out. The SOC report is an input, not a conclusion.
Question 461
A SOC 2 report's SECURITY criteria include controls over:
Select an option first.
Correct answer: A — Access, system operations, change management, and risk mitigation — protecting against unauthorised access
Explanation: The SECURITY (common) criteria protect against UNAUTHORISED ACCESS — physical and logical — that could result in improper disclosure, misuse, alteration, destruction, or damage to systems affecting the entity's ability to meet its objectives. They span the full COSO-aligned CC1-CC9 range.
Question 462
If a service organisation's controls FAIL and the user suffers a loss, the user's PRIMARY recourse is:
Select an option first.
Correct answer: B — The CONTRACT — the SOC report is assurance, not a warranty or an indemnity
Explanation: A SOC report is ASSURANCE about controls during a PAST period. It is NOT a WARRANTY of future performance and creates no liability to the user. The user's recourse for a failure lies in the CONTRACT — SLAs, indemnities, limitation of liability clauses. Users sometimes treat a clean SOC report as though it were a guarantee. It is not.
Question 463
A SOC report is assurance about:
Select an option first.
Correct answer: D — CONTROLS DURING A PAST PERIOD — it says nothing about what happens tomorrow
Explanation: A SOC 2 Type 2 tells you the controls OPERATED EFFECTIVELY during the PERIOD EXAMINED. It says NOTHING about what happens after the period ends — which is exactly why the GAP between the report period-end and your year-end matters, and why bridge letters exist.
Question 464
A user's reliance on a SOC report should be documented in:
Select an option first.
Correct answer: A — The AUDIT WORKPAPERS — recording the report obtained, the CUECs tested, and the conclusions reached
Explanation: The user auditor DOCUMENTS: which SOC report was obtained (type, period, criteria); the evaluation of the service auditor's competence and independence; the CUECs identified and how they were tested at the user; any carve-outs and the response; and the conclusion on reliance. Reliance on a SOC report is an audit judgement and must be evidenced.
Question 465
A service organisation with MANY user entities benefits from a SOC 2 because:
Select an option first.
Correct answer: C — One report serves ALL of them — the alternative is being audited individually by each customer
Explanation: The economics are compelling: without a SOC report, a service organisation with 200 enterprise customers could face 200 individual customer audits, each disruptive and each asking similar questions. ONE SOC 2 satisfies them all. That is why SOC reports became a market standard without any law requiring them.
Question 466
The MOST common reason a user cannot rely on a SOC report is:
Select an option first.
Correct answer: A — SCOPE — the report covers the wrong period, the wrong criteria, or a system boundary that excludes the service the user actually uses
Explanation: SCOPE mismatches are the most common and most overlooked problem: the report covers 9 months of a 12-month year; it covers Security but not Availability; or it covers the vendor's core platform but not the module the user actually bought. Users obtain a SOC report, see an unqualified opinion, and never check whether it covers what they need.
Question 467
A SOC 2 report where the SERVICE AUDITOR also implemented the controls raises:
Select an option first.
Correct answer: A — A SELF-REVIEW threat — the auditor would be examining their own work, impairing independence
Explanation: An auditor who DESIGNED or IMPLEMENTED the controls cannot INDEPENDENTLY examine them — that is a SELF-REVIEW threat, and it impairs independence. The user auditor must evaluate the service auditor's INDEPENDENCE, and this would be a disqualifying impairment.
Question 468
A SOC 1 report tests a control that operates DAILY, with a sample of 3. The user auditor should:
Select an option first.
Correct answer: D — QUESTION the sufficiency — a daily control (hundreds of operations) tested with 3 items provides limited evidence
Explanation: Sample size scales with FREQUENCY. A DAILY control has hundreds of operations; a sample of 3 provides very limited evidence of operating effectiveness. The user auditor reads SECTION 4 precisely to evaluate whether the testing was SUFFICIENT to support the conclusion they intend to rely on.
Question 469
A user entity discovers its service organisation had a BREACH during the SOC period, but the SOC report does not mention it. The user should:
Select an option first.
Correct answer: B — INQUIRE — a material breach during the period may indicate a control failure that should have been identified and disclosed
Explanation: A material SECURITY INCIDENT during the SOC period that is NOT reflected in the report raises serious questions: did the auditor know? Was a control failure not identified? Was the description not fairly presented? The user should INQUIRE of both the service organisation and (through them) the service auditor.
Question 470
A SOC 2 report covers 'the XYZ Platform'. The user actually uses 'XYZ Analytics', a separate module. The report:
Select an option first.
Correct answer: C — Does NOT cover it — it falls OUTSIDE the described SYSTEM BOUNDARIES
Explanation: SYSTEM BOUNDARIES are definitive. A SOC report scoped to 'the XYZ Platform' provides NO assurance over a separately-named module unless the description explicitly includes it. This is a common and consequential trap — users assume the vendor's SOC covers everything the vendor sells.
Question 471
A service organisation provides a SOC 2 Type 1 when the user needs a Type 2. The user should:
Select an option first.
Correct answer: C — Recognise it provides NO evidence of OPERATING effectiveness — and either obtain a Type 2 or perform its own testing
Explanation: A TYPE 1 addresses DESIGN at a POINT IN TIME. It provides NO evidence that the controls actually OPERATED across the period, and therefore supports almost NO reliance. The user must obtain a Type 2, test the controls itself, or perform substantive procedures that do not depend on the service organisation's controls.
Question 472
A service organisation's SOC 2 lists 15 CUECs. The user entity should:
Select an option first.
Correct answer: D — IDENTIFY which apply to it, and TEST each one AT THE USER — the service organisation's controls depend on them
Explanation: CUECs are conditions the SOC report ASSUMES are true at the user. Fifteen of them is a lot — and every one the user fails to perform breaks the corresponding control chain. The user auditor must map each CUEC to its own environment and TEST whether it is actually operating.
Question 473
A SOC report's opinion covers the DESCRIPTION, the DESIGN, and (Type 2) the OPERATION. A failure in any one:
Select an option first.
Correct answer: B — May result in a MODIFIED opinion — and the user must determine WHICH element failed and whether it matters to them
Explanation: THREE separate opinion elements. A failure in any could modify the opinion — but the user's response differs. A DESCRIPTION failure means the report may misrepresent the system. A DESIGN failure means the control could never work. An OPERATING failure means it did not work in practice. The user must read WHICH.
Question 474
A user auditor may use a SOC report as evidence of:
Select an option first.
Correct answer: C — The DESIGN and OPERATING EFFECTIVENESS of controls AT THE SERVICE ORGANISATION
Explanation: A SOC report provides evidence about controls AT THE SERVICE ORGANISATION during a PAST PERIOD. It is not evidence about the USER'S own controls (including the CUECs), the vendor's financial viability, or what will happen after the period ends.
Question 475
A service organisation's financial VIABILITY is:
Select an option first.
Correct answer: B — NOT addressed by any SOC report — vendor financial risk requires separate due diligence
Explanation: A SOC report addresses CONTROLS, not the vendor's FINANCIAL HEALTH. A service organisation could have a perfect SOC 2 and be about to go bankrupt — with severe consequences for a user dependent on it. VENDOR FINANCIAL DUE DILIGENCE and exit/continuity planning are separate exercises entirely.
Question 476
A user's EXIT STRATEGY from a service organisation should address:
Select an option first.
Correct answer: A — DATA RETRIEVAL (in a usable format), TRANSITION assistance, and the vendor's obligation to DELETE data after exit
Explanation: CONCENTRATION and LOCK-IN risk are real. The contract should address: retrieval of YOUR DATA in a USABLE format; transition assistance; a defined notice period; and the vendor's obligation to DELETE your data after exit (with certification). A vendor that will not commit to data portability has you locked in.
Question 477
A user relying on a service organisation for a MATERIAL process with NO SOC report and NO ability to test should:
Select an option first.
Correct answer: D — Recognise a potential SCOPE LIMITATION and consider the effect on the audit opinion
Explanation: If controls at a service organisation are MATERIAL to the financial statements, and the auditor can obtain NO evidence about them — no SOC report, no access to test, and substantive procedures at the user cannot compensate — that is a SCOPE LIMITATION, leading to a QUALIFIED opinion or a DISCLAIMER.
Question 478
A SOC 2's SECURITY criteria are described as the 'COMMON CRITERIA' because they:
Select an option first.
Correct answer: D — Apply to EVERY SOC 2 engagement, and underpin the other four criteria
Explanation: SECURITY is the COMMON CRITERIA — mandatory in every SOC 2, and foundational to the others. Availability, processing integrity, confidentiality and privacy all DEPEND on security: an insecure system cannot be reliably available, correct, confidential or private.
Question 479
A SOC 1 report's control objectives are written by:
Select an option first.
Correct answer: C — MANAGEMENT of the service organisation
Explanation: In a SOC 1, MANAGEMENT specifies the CONTROL OBJECTIVES relevant to user entities' ICFR, and the auditor opines on whether the controls achieve them. This is a meaningful difference from SOC 2, where the criteria are PRE-DEFINED by the AICPA — management cannot write its own bar.
Question 480
The risk that management writes WEAK control objectives in a SOC 1 is mitigated by:
Select an option first.
Correct answer: B — The SERVICE AUDITOR evaluating whether the objectives are REASONABLE and COMPLETE for user entities' ICFR needs
Explanation: Because management writes the objectives, there is an obvious risk they set an easy bar. The SERVICE AUDITOR must evaluate whether the objectives are REASONABLE and sufficiently COMPLETE to address the ICFR risks that user entities would care about — and the USER auditor should read them critically too.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.