CPA ISC: Planning and performing SOC engagements
Blueprint III.A · Area III, Considerations for System and Organization Controls (SOC) Engagements · 15–25% of ISC
Ten ISC questions on planning and performing soc engagements, untimed, with a reason for every answer option.
Or take the full ISC mock examWhat is a SOC 3 report?
Planning and performing SOC engagements on CPA ISC
Area III of ISC (15–25%) covers System and Organization Controls (SOC) engagements. This topic covers planning and performing SOC 1 and SOC 2 examinations, including subservice organizations and complementary user entity controls.
- Blueprint groups
- III.A
- Share of the section
- Area III, Considerations for System and Organization Controls (SOC) Engagements: 15–25%
- Our drill
- 10 questions from 10 on this topic, untimed, with a reason for every option; one free attempt, unlimited with a pass
What to know
- SOC 1 reports on controls relevant to user entities' internal control over financial reporting (AT-C 320); SOC 2 reports on the Trust Services Criteria.
- Security (the common criteria) is always in scope in a SOC 2; availability, processing integrity, confidentiality and privacy are optional.
- Type 1 reports cover the description and design as of a date; Type 2 adds operating effectiveness over a period with tests and results.
- Under the carve-out method, a subservice organization's controls are excluded and complementary subservice organization controls are identified; the inclusive method includes them.
- Service organization management prepares the system description and a written assertion; the service auditor must be independent of the service organization.
- Complementary user entity controls are controls the user entity must have for control objectives to be achieved.
Test yourself on planning and performing soc engagements
Ten ISC questions on planning and performing soc engagements, untimed, with a reason for every answer option.
Or take the full ISC mock examCommon questions
How much of the ISC section is planning and performing soc engagements?
It sits in Blueprint Area III (III.A). The AICPA weights whole areas, not single topics; see the area’s range on the ISC page. Our 82-question mock draws each area at the middle of its range.
Are these real ISC questions?
No. The AICPA does not release live exam questions. These are original practice questions written to the published 2027 CPA Exam Blueprints, with a reason for every answer option and the standard or code section behind the key.
More ISC topics
- Information systems, IT general controls and change managementdrill
- Data management, databases and data analyticsdrill
- Security controls and threatsdrill
- Frameworks, confidentiality, privacy and incident responsedrill
- SOC reports and opinionsdrill
ISC full mock exam: 4 hours, 5 testletsISC task-based simulations
Blueprint and exam facts checked November 2026: AICPA: Learn what is tested on the CPA Exam (Blueprints effective January 1, 2027) · AICPA: CPA Exam score release and testing windows · NASBA: CPA Exam FAQ · Virginia Board of Accountancy: CPA Exam fees.
Original independent practice questions written to the AICPA CPA Exam Blueprints. Not affiliated with or endorsed by the AICPA or NASBA.