ISC — Information Systems and Controls

How to pass ISC when you work full time

By Joey Arnold, CPA

ISC is the Discipline that looks least like accounting. Frameworks and privacy regulation, IT infrastructure, databases and SQL, security threats and controls, SOC engagements. For many candidates it’s genuinely new material rather than a deeper cut of something they already know.

That sounds like a problem. It’s often the opposite — ISC passed 67.98% in Q2 2026, well above BAR’s 45.62%. Unfamiliar doesn’t mean hard. It means you can’t coast on what you already know, and you have to actually learn it.

ISC pass rate: 67.98% (Q2 2026, the latest published) — between TCP at 79.75% and BAR at 45.62% among the three Disciplines.Source: AICPA published CPA Exam pass rates · Last updated August 21, 2026

What ISC tests

ISC covers three areas, and the AICPA publishes how heavily each is weighted:

Area	Weight	What’s in it
I. Information Systems and Data Management	35–45%	IT infrastructure, enterprise and accounting information systems, availability and change management, the data lifecycle, databases, SQL and data integration
II. Security, Confidentiality and Privacy	35–45%	Regulations, standards and frameworks, threats and attacks, mitigation and security testing, confidentiality and privacy, incident response
III. SOC Engagements	15–25%	SOC engagement planning, performing procedures, and reporting

The format

4 hours, five testlets
82 multiple-choice questions, weighted at 60% of your score
6 task-based simulations, weighted at 40%
Optional 15-minute break after testlet 3, which doesn’t count against your time

Worth noting: that 60/40 split is different from FAR and BAR, where MCQs and simulations are weighted evenly. On ISC the multiple-choice questions carry more of your score.

And here’s the number that should change how you study:

ISC gives Remembering and Understanding 55–65% of its weight. Application is 20–30%, Analysis 10–20%.

Compare that to FAR, where recall is 5–15%. These two sections reward almost opposite study behavior. ISC is built on knowing what things are — which framework covers what, what the functions are, what a SOC 2 Type II actually reports on. There’s a large body of terminology and structure to hold, and the exam mostly asks whether you hold it.

Why people fail ISC

They study it like an accounting section. Working problems is the right instinct on FAR and BAR. On a section that’s 55–65% recall, the winning behavior is different: repeated retrieval of definitions, frameworks and distinctions, spaced out over weeks.

They drown in the frameworks chapter. NIST, CIS, COBIT, the privacy regulations — it’s dense enumeration material and it comes first. Candidates burn out on it and arrive at the SOC material with nothing left.

They skip SQL because it looks like programming. It isn’t. You need to read a SELECT statement and understand a JOIN, not write software. It’s a small, learnable slice that people avoid on sight.

They treat SOC as an afterthought. Area III is 15–25%. SOC engagements are about planning work, gathering evidence and reporting on it — the same shape as the audit material you’ve already studied. Leaving it until last wastes that.

How long ISC takes around a full-time job

Most candidates need somewhere around 60–90 hours to get ready for ISC — one of the lighter sections to prepare, but it rewards steady, repeated recall over long study blocks. Your background in IT and controls will push you toward one end of that range or the other.

Consistency matters more than intensity. Study a little every week and you spend your time learning new material. Study in bursts and you spend half of it relearning what you forgot.

How to study ISC when your time is limited

Study for recall, deliberately. With 55–65% of the exam on Remembering and Understanding, flashcards and self-quizzing aren’t a supplement here — they’re the main event. Retrieve the material rather than re-reading it.

Space the frameworks out. Don’t sit down and learn NIST, CIS, COBIT and the privacy regulations in one week. That material fades fast and needs repeated short contact over a long stretch.

Learn to read SQL, not write it. SELECT, JOIN, and what a LEFT JOIN with a null check is doing. That’s the level the exam asks for.

Lean into SOC. As a CPA candidate you already understand engagements, evidence and reporting. Area III is where your background actually transfers, and it’s up to a quarter of the exam.

Interleave. Once you’ve covered a few areas, mix them in review rather than doing one topic at a time. It feels worse but it works better — mixed practice is closer to what exam day actually is.

How Smarter CPA covers ISC

ISC is a section built on holding a large amount of structured material — so the format matters more than the hours. We teach every area the Blueprint tests and cut the detail the examiners don’t ask about. Fewer hours, full coverage.

Our ISC lectures run 5 to 15 minutes each. On a section that’s mostly recall, a long lecture is the wrong tool: enumeration doesn’t stick from watching, it sticks from retrieving. So the lectures explain what actually needs explaining, and the memorizable material goes into cheat sheets, flashcards and questions where repetition can do its job.

You get, for ISC:

Short lectures across all five chapters — 5 to 15 minutes each, built to watch in the gaps in your day
A full written textbook plus cheat sheets carrying the frameworks and enumerations for repeated review
Exam-quality MCQs with explanations that teach the reasoning, not just the answer
Task-based simulations with full written explanations, weighted toward SQL and SOC
Spaced-repetition flashcards, elaboration journals, and progress quizzes to make it stick
Three full-length simulated exams that mirror exam-day timing and interface
A day-by-day study plan — 30, 45, 60, 75 days, and more
A Game Plan Call with Joey to set your date and build the plan around your real schedule

Get ISC

Not ready? Start free — no credit card, full access to Chapter 1 of every section. · Compare all plans

ISC FAQ

Do I need an IT background to pass ISC?

No. ISC is written for accountants, not engineers. You need to understand systems, controls and risk well enough to evaluate them — not to build or administer anything. Candidates with no technical background pass it regularly.

Is ISC the easy Discipline?

It has the second-highest pass rate of the three at 67.98% in Q2 2026, behind TCP at 79.75% and ahead of BAR at 45.62%. But the material is unfamiliar to most accountants, so “easier” only holds if you actually study it rather than assuming your background carries you.

How much SQL is on ISC?

Enough to matter, not enough to fear. You need to read a SELECT statement, understand JOINs, and know what a query is returning. You’re never asked to write production code.

What are SOC engagements and how much do they matter?

Area III is 15–25% of the exam — SOC engagement planning, performing procedures, and reporting. It’s accounting-adjacent work and usually quick scoring for a CPA candidate.

Can I buy just ISC?

Yes — a single section is $349, and you can add other sections later. The full six-section course is $1,249, which is less than buying the four sections you need separately.

What if I’ve already failed ISC?

The usual cause is studying it the way you’d study an accounting section. ISC gives Remembering and Understanding 55–65% of its weight, so it rewards retrieval practice far more than working problems. Changing that one habit is often the whole fix. The Coaching Circle includes comeback coaching for exactly this.

Pass-rate figures are AICPA published results for Q2 2026 (the latest available); rates update quarterly. Source: AICPA CPA Exam pass rates. Last updated August 21, 2026.