You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Information Systems and Controls
Free CPA Information Systems and Controls Practice Questions & Answers
500 exam-style Information Systems and Controls questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 481
A user auditor reads a SOC 1's control objectives and finds none addressing COMPLETENESS of transaction processing. The auditor should:
Select an option first.
Correct answer: C — Recognise a GAP — no assurance is provided over completeness, and address it through other procedures
Explanation: If no control objective addresses COMPLETENESS, the report provides NO ASSURANCE over it — regardless of an unqualified opinion. The user auditor must obtain that assurance elsewhere: reconciliations at the user, substantive testing, or direct testing at the service organisation.
Question 482
A SOC 2 report's SUBSERVICE organisation is described but its controls are carved out. The user's TOTAL assurance is:
Select an option first.
Correct answer: B — INCOMPLETE — a portion of the control environment is entirely unexamined by this report
Explanation: The CARVE-OUT means a portion of the control environment your data passes through is ENTIRELY UNEXAMINED. Your assurance has a hole in it — and the hole is invisible unless you read the description carefully. Obtaining the subservice organisation's own SOC report closes it.
Question 483
A service organisation uses THREE subservice organisations, all carved out. The user should:
Select an option first.
Correct answer: D — Obtain assurance over EACH — three carve-outs mean three unexamined portions of the control chain
Explanation: Each CARVE-OUT is a separate gap. Three carve-outs mean three portions of the chain are unexamined by the report you hold. The user must obtain assurance over EACH — which quickly becomes onerous, and is a legitimate reason to prefer vendors with fewer or INCLUSIVE subservice arrangements.
Question 484
A user's auditor should read a SOC report's Section 3 (system description) to:
Select an option first.
Correct answer: C — Understand the SYSTEM BOUNDARIES, the SUBSERVICE organisations, and the CUECs
Explanation: SECTION 3 is where the crucial practical information lives: what the system ACTUALLY covers (boundaries), which SUBSERVICE organisations exist and whether they are carved out, and which CUECs the report assumes you are performing. Reading only the opinion misses all of it.
Question 485
A SOC report with an unqualified opinion but 12 CUECs the user does NOT perform provides:
Select an option first.
Correct answer: B — LITTLE practical assurance — the controls depend on user actions that are not happening
Explanation: An unqualified opinion says the SERVICE ORGANISATION'S controls worked. But if TWELVE CUECs are not being performed at the user, twelve control chains are BROKEN at the user's end. The report is accurate; the user's assurance is nonetheless illusory.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 486
A SOC 2 tests a control 25 times and finds 2 deviations. The deviation rate is:
Select an option first.
Correct answer: D — 8%
Explanation: Deviation rate = 2/25 = 8%. The service auditor evaluates the NATURE and CAUSE of the deviations and whether the criterion was nonetheless achieved. The USER should read Section 4 and form its own view of the residual risk.
Question 487
A SOC 2 tests a critical access control 40 times and finds 6 deviations. The rate is:
Select an option first.
Correct answer: A — 15% — a significant failure rate on a critical control
Explanation: Deviation rate = 6/40 = 15%. On a CRITICAL ACCESS control, a 15% failure rate is highly significant regardless of the overall opinion. The user should investigate the cause and consider whether compensating controls exist at its own end.
Question 488
A SOC report tests 15 of a service organisation's 200 monthly control occurrences. The coverage is:
Select an option first.
Correct answer: D — 7.5% of occurrences — but sample size is driven by frequency and risk, not by a coverage percentage
Explanation: 15/200 = 7.5%. But COVERAGE PERCENTAGE is NOT the right lens — sample size is driven by control FREQUENCY, the RELIANCE placed, and the RISK. The relevant question is whether 15 items support a conclusion about a monthly control across the period, not what percentage it represents.
Question 489
A user obtains a SOC 2 Type 2 covering 6 months of its 12-month year. The COVERED portion is:
Select an option first.
Correct answer: C — 50% — and the remaining 6 months requires a bridge letter, another report, or additional procedures
Explanation: A 6-month report covers 50% of a 12-month audit period. The remaining 6 months is UNCOVERED. A bridge letter (unaudited) offers limited comfort for a short gap; a 6-month gap is well beyond the ~6-month bridge letter norm and warrants more.
Question 490
A service organisation with 250 enterprise customers avoids how many individual customer audits by producing ONE SOC 2?
Select an option first.
Correct answer: A — Potentially up to 250 — which is the entire commercial rationale for SOC reports
Explanation: Without a SOC report, each of the 250 customers (and their auditors) could demand their own audit — hugely disruptive and expensive. ONE SOC 2 satisfies them all. That economic logic, not any legal requirement, is why SOC reports became a market standard.
Question 491
A SOC 2 covers 1 Jan–31 Dec Year 1 with an unqualified opinion. The user's year-end is 31 Dec Year 1. The user does NOT perform 3 CUECs, and one SUBSERVICE organisation is carved out. The user's assurance is:
Select an option first.
Correct answer: D — MATERIALLY INCOMPLETE — three control chains are broken at the user, and one portion of the environment is entirely unexamined
Explanation: THREE separate problems compound. (1) The PERIOD aligns perfectly — good. (2) But THREE CUECs are not performed, breaking three control chains AT THE USER. (3) And a CARVE-OUT leaves a portion of the environment entirely unexamined. An unqualified opinion on a well-aligned report can still leave the user with materially incomplete assurance.
Question 492
A user auditor relies on a SOC 1 Type 2 for payroll. The report is unqualified, the period aligns, and all CUECs are performed. The auditor must STILL:
Select an option first.
Correct answer: D — Evaluate the SERVICE AUDITOR'S competence and independence, and consider any SUBSERVICE organisations carved out
Explanation: Even a perfect report requires: evaluating the SERVICE AUDITOR'S COMPETENCE and INDEPENDENCE (would you rely on an unknown firm's opinion?); checking for CARVE-OUTS; and documenting the reliance decision in the workpapers. The SOC report is an input to a judgement, never a substitute for one.
Question 493
A service organisation's SOC 2 opinion is unqualified. Its SUBSERVICE organisation's SOC 2 is ADVERSE. The user's exposure is:
Select an option first.
Correct answer: C — SIGNIFICANT — the carved-out subservice organisation's controls FAILED, and the user's data flows through it
Explanation: The primary SOC's unqualified opinion says NOTHING about the carved-out subservice organisation. If THAT organisation's own SOC is ADVERSE, the user's data is flowing through a control environment that has FAILED — and the primary report's clean opinion provides no comfort whatever. This is exactly why chasing the carve-out matters.
Question 494
A SOC 1's control objective addresses ACCURACY but not COMPLETENESS. A user relying on it for completeness has:
Select an option first.
Correct answer: A — NO assurance over completeness — the report addresses only what its control objectives address, regardless of the opinion
Explanation: A SOC report provides assurance ONLY over the control objectives (SOC 1) or criteria (SOC 2) it ADDRESSES. An unqualified opinion on an ACCURACY objective says NOTHING about COMPLETENESS. Users read the opinion and assume comprehensive coverage; the coverage is precisely what management chose to include.
Question 495
A user entity has a 31 December year-end. It obtains SOC 2 reports for 1 Oct Yr1–30 Sep Yr2 and 1 Oct Yr0–30 Sep Yr1. Coverage of the Yr1 calendar year is:
Select an option first.
Correct answer: D — COMPLETE — the two reports together cover 1 Jan–30 Sep (from the earlier report) and 1 Oct–31 Dec (from the later one)
Explanation: The earlier report (Oct Yr0–Sep Yr1) covers 1 Jan–30 Sep of Year 1. The later report (Oct Yr1–Sep Yr2) covers 1 Oct–31 Dec of Year 1. TOGETHER they cover the full calendar year with NO GAP. Obtaining CONSECUTIVE reports is the standard solution when the SOC period does not align with the user's year.
Question 496
A SOC 2 Type 2 tests a control 25 times with 0 deviations. The control operates DAILY. The user auditor should:
Select an option first.
Correct answer: B — Consider whether 25 items adequately covers a control operating ~250 times per year — while noting 25 is within the normal range for a daily control
Explanation: For a DAILY control, a sample of 20-40 is within the normal range, so 25 is defensible. The user auditor's task is to EVALUATE whether the sample supports the reliance they intend to place — not to demand 100% testing. This question tests calibration: knowing what is REASONABLE, not merely what is large.
Question 497
A user entity's auditor identifies a MATERIAL WEAKNESS in the user's OWN control over reviewing the service organisation's output. The SOC report:
Select an option first.
Correct answer: B — Does NOT cure it — the weakness is at the USER, and a SOC report addresses controls at the SERVICE ORGANISATION
Explanation: A SOC report addresses controls AT THE SERVICE ORGANISATION. It cannot cure a control weakness AT THE USER — including a failure to perform a CUEC or to review the service organisation's output. The user's own control deficiencies are the user's own to remediate, and its auditor's to report.
Question 498
A SOC 1 report's tests show a control was tested at ONE point in time within a Type 2 engagement. This suggests:
Select an option first.
Correct answer: D — The control may operate ANNUALLY (in which case one test is correct) — OR the testing is INSUFFICIENT for a more frequent control; the user must check the FREQUENCY
Explanation: Context decides. If the control operates ANNUALLY, its population is ONE and a single test is CORRECT. If it operates DAILY, a single test is grossly insufficient. The user auditor must read the CONTROL DESCRIPTION to establish the FREQUENCY before judging the sample. The number alone means nothing.
Question 499
A user entity concludes it does NOT need a SOC report because it independently RECONCILES all of the service organisation's output. This is:
Select an option first.
Correct answer: A — POTENTIALLY CORRECT — if the user's own controls fully address the risk, the auditor may test THOSE instead of relying on the service organisation
Explanation: If the USER retains sufficient controls of its OWN (independently reconciling all output to an independent source), the auditor may test the USER'S controls and place NO reliance on the service organisation's. The need for a SOC report arises from the intention to RELY on the service organisation — not from the mere fact of outsourcing.
Question 500
A SOC 2 report is unqualified. The service organisation suffers a MAJOR BREACH two weeks after the period end. The report is:
Select an option first.
Correct answer: A — STILL VALID for its period — a SOC report is assurance about a PAST period, not a warranty of future performance
Explanation: A SOC 2 Type 2 opines that controls operated effectively DURING THE PERIOD EXAMINED. A breach AFTER the period does not invalidate that conclusion — controls can be effective and still be defeated, and circumstances change. This is precisely why the GAP between period-end and the user's year-end matters, and why users must not read a SOC report as a guarantee.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.