CPA ISC: SOC reports and opinions
Blueprint III.B · Area III, Considerations for System and Organization Controls (SOC) Engagements · 15–25% of ISC
Ten ISC questions on soc reports and opinions, untimed, with a reason for every answer option.
Or take the full ISC mock examA manufacturer's customers want assurance about its controls over producing and distributing goods. Which report fits?
SOC reports and opinions on CPA ISC
This topic covers SOC reports themselves and how they are used: report sections and opinions, report types for different needs, and how a user auditor relies on a SOC 1 report.
- Blueprint groups
- III.B
- Share of the section
- Area III, Considerations for System and Organization Controls (SOC) Engagements: 15–25%
- Our drill
- 10 questions from 10 on this topic, untimed, with a reason for every option; one free attempt, unlimited with a pass
What to know
- SOC 1 and SOC 2 reports are restricted-use; SOC 3 and SOC for Cybersecurity reports are general-use.
- Deviations in a Type 2 are described in the tests and results section; failures that prevent achieving a control objective lead to a qualified or adverse opinion.
- A user auditor considers whether the report period covers its client's year and obtains evidence for any gap, such as a bridge letter from service organization management.
- A user auditor does not refer to the service auditor's report in an unmodified opinion (AU-C 402.20).
- SOC for Supply Chain covers controls over producing and distributing products.
- A pervasively misstated system description results in an adverse opinion.
Test yourself on soc reports and opinions
Ten ISC questions on soc reports and opinions, untimed, with a reason for every answer option.
Or take the full ISC mock examCommon questions
How much of the ISC section is soc reports and opinions?
It sits in Blueprint Area III (III.B). The AICPA weights whole areas, not single topics; see the area’s range on the ISC page. Our 82-question mock draws each area at the middle of its range.
Are these real ISC questions?
No. The AICPA does not release live exam questions. These are original practice questions written to the published 2027 CPA Exam Blueprints, with a reason for every answer option and the standard or code section behind the key.
More ISC topics
- Information systems, IT general controls and change managementdrill
- Data management, databases and data analyticsdrill
- Security controls and threatsdrill
- Frameworks, confidentiality, privacy and incident responsedrill
- Planning and performing SOC engagementsdrill
ISC full mock exam: 4 hours, 5 testletsISC task-based simulations
Blueprint and exam facts checked November 2026: AICPA: Learn what is tested on the CPA Exam (Blueprints effective January 1, 2027) · AICPA: CPA Exam score release and testing windows · NASBA: CPA Exam FAQ · Virginia Board of Accountancy: CPA Exam fees.
Original independent practice questions written to the AICPA CPA Exam Blueprints. Not affiliated with or endorsed by the AICPA or NASBA.