CPA ISC with Musa Shaikh

ISC – Information Systems and Controls is one of the three Discipline sections of the Uniform CPA Examination.

No.

Candidates choose one Discipline:

• BAR
• ISC
• TCP

ISC stands for Information Systems and Controls.

The current ISC Blueprint covers:

• Information Systems and Data Management – 35% to 45%
• Security, Confidentiality and Privacy – 35% to 45%
• SOC Engagement Considerations – 15% to 25%

ISC is a four-hour examination.

Candidates complete:

• 82 MCQs
• 6 Task-Based Simulations

ISC contains:

• Testlet 1 – 41 MCQs
• Testlet 2 – 41 MCQs

There are 6 Task-Based Simulations.

The TBS testlets contain:

• Testlet 3 – 1 TBS
• Testlet 4 – 3 TBSs
• Testlet 5 – 2 TBSs

Candidates need a minimum scaled score of 75.

ISC is unique among current CPA sections.

The scoring weights are:

• MCQs – 60%
• TBSs – 40%

ISC can initially appear challenging to candidates without an IT background because it contains specialised technology terminology.

However, the Blueprint places 55% to 65% of the examination at Remembering and Understanding level, making strong conceptual preparation particularly important.

No. ISC is not a programming examination.

Candidates need to understand technology from an accounting, control, risk and assurance perspective.

Yes. Security, confidentiality and privacy represent approximately 35% to 45% of ISC.

Yes. Candidates study cloud models, cloud providers, governance and related risks and controls.

Yes. Candidates develop knowledge of data storage, relational databases, data integrity and related concepts.

Candidates may need to understand standard SQL queries and evaluate whether retrieved data is relevant and complete. Advanced software development is not required.

Yes. IT general controls are an important part of information systems and control knowledge.

Yes. Change management is specifically covered, including authorisation, testing, migration, version control, patches and configuration changes.

Yes. Candidates develop knowledge of recognised security and cybersecurity frameworks, including NIST-related concepts.

Yes. Privacy and confidentiality are major components of the ISC syllabus.

Yes. SOC engagements represent approximately 15% to 25% of the examination.

SOC 1 focuses on controls relevant to user entities' internal control over financial reporting.

SOC 2 focuses on controls relevant to the Trust Services Criteria, including security and other selected categories such as availability, processing integrity, confidentiality and privacy.

Type 1 primarily addresses control design at a specific date.

Type 2 additionally includes testing of operating effectiveness over a period of time.

Yes. Auditors often have relevant experience in internal controls, IT controls, risk assessment and assurance.

Yes. Candidates with CISA or IT audit backgrounds may find significant conceptual familiarity in ISC, although CPA-specific SOC and assurance requirements still require dedicated preparation.

Yes. ISC has substantial conceptual links with AUD, particularly around controls, risk and assurance.

ISC may be particularly suitable if your strengths are:

• AUD
• Internal controls
• IT
• Systems
• Cybersecurity
• Risk
• Assurance

BAR may better suit financial reporting and analysis candidates, while TCP may better suit taxation specialists.

No. Candidates ultimately pursue the same CPA licence regardless of whether they pass BAR, ISC or TCP.

The designated 2026 Discipline testing windows are:

• January
• April
• July
• October

Candidates should confirm current scheduling availability before booking.

Yes, provided they satisfy the eligibility requirements of a participating U.S. CPA jurisdiction.

Eligible candidates can currently sit the CPA Exam in the United Arab Emirates, subject to jurisdictional eligibility and Prometric availability.

Yes. Saudi Arabia is an international CPA Exam testing market, subject to applicable requirements.

International CPA testing is currently available in England and Scotland, subject to eligibility.

The preparation includes:

• Complete ISC syllabus
• Instructor-led lectures
• Information systems
• IT controls
• Cloud computing
• Data management
• Cybersecurity
• Privacy and confidentiality
• SOC 1 and SOC 2
• MCQ practice
• Task-Based Simulations
• Revision
• Mock examinations
• Performance feedback

No. Berkeley provides preparation for the ISC examination and an applicable course completion certificate.

Candidates must pass all required CPA Exam sections and satisfy their selected jurisdiction's licensure requirements to become licensed CPAs.

The Berkeley programme is taught by Musa Shaikh, specialising in finance, accounting, audit, risk and professional examination preparation.

Yes. Candidates in Dubai, Abu Dhabi and throughout the United Arab Emirates can access the programme.

Yes. Candidates in Riyadh, Jeddah and throughout Saudi Arabia can access the programme.

Yes. Candidates throughout the United States of America can access the programme.

Yes. Candidates throughout the United Kingdom and Europe can access live online preparation.

The programme includes 15 lectures, 2 practice sessions and 3 mock examinations.

ISC covers Information Systems and Data Management, Security, Confidentiality and Privacy, and System and Organization Controls Engagements. 

The examination contains 82 Multiple-Choice Questions and 6 Task-Based Simulations and allows 4 hours. 

Multiple-Choice Questions contribute 60% and Task-Based Simulations contribute 40% of the examination score. 

Candidates must achieve a CPA examination score of 75 or higher.

No. ISC is one of three Discipline choices. Candidates select BAR, ISC or TCP and are required to pass only one Discipline. 

ISC is particularly suitable for candidates interested in information technology audit, cybersecurity, internal controls, risk management, data governance, compliance and technology assurance.

Yes. Security, Confidentiality and Privacy represents 35%–45% of the examination and includes security frameworks, threats, controls, privacy and incident response. 

Yes. System and Organization Controls engagements represent 15%–25% of the examination and include planning, performing and reporting considerations. 

No. Berkeley provides examination preparation and a course completion certificate. The official Certified Public Accountant licence is granted by the applicable United States Board of Accountancy after all requirements are satisfied.