CPA Exam ISC Discipline: Format, Scoring, and Pass Rates

The Information Systems and Controls (ISC) discipline is one of three optional sections on the CPA Exam, and candidates pick it when they want to signal strength in IT audit, cybersecurity assurance, and SOC engagement work. Every CPA candidate passes three core sections (AUD, FAR, and REG) plus one discipline of their choice, and the ISC discipline of the CPA Exam is the technology-focused option among those three. It runs four hours, carries a 2025 cumulative pass rate of about 68 percent, and sits between the other two disciplines in measured difficulty.

Where ISC Fits Among the Three Disciplines

The CPA Evolution model from AICPA and NASBA reorganized the exam around a core-plus-discipline structure. The three core sections cover foundational accounting; the discipline is where you differentiate yourself. Choosing ISC does not lock you into an IT audit career and does not restrict your license in any way. You can practice in any area of public accounting regardless of which discipline you pass.

The alternatives are Business Analysis and Reporting (BAR), which leans into financial analysis, technical accounting, and state and local government reporting, and Tax Compliance and Planning (TCP), which covers taxation, personal financial planning, and property transactions. In 2025 cumulative pass rates, TCP came in around 78 percent, ISC around 68 percent, and BAR around 42 percent. AICPA has said a higher pass rate does not automatically mean a section is easier for every candidate, so your background and career direction matter more than the headline numbers.

What the ISC Section Tests

The blueprint divides ISC content into three areas, each weighted within a range that allows some variation across exam forms.

Information Systems and Data Management (35–45%)

This area covers how organizations collect, store, process, and govern data: database structures, data lifecycle management, and extraction-transformation-loading processes. It also covers business process integration with IT infrastructure, cloud computing, artificial intelligence and machine learning tools, and descriptive, diagnostic, and predictive data analytics.

Security, Confidentiality, and Privacy (35–45%)

Most candidates find this the most demanding area. It covers risk assessment aligned with frameworks from the National Institute of Standards and Technology and the COBIT guidelines, along with logical access controls, physical security, encryption, multi-factor authentication, incident response, and disaster recovery. The focus is evaluating whether internal controls actually prevent, detect, and correct system failures or security breaches.

System and Organization Controls Engagements (15–25%)

The remaining weight goes to SOC engagements. You need to know the difference between SOC 1 reports (controls relevant to financial reporting) and SOC 2 reports (the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy), and between Type I reports (design of controls at a point in time) and Type II reports (operating effectiveness over a defined period). Expect questions on management assertions, system descriptions, engagement boundaries, and how deviations affect the overall opinion.

Questions are weighted heavily toward application and analysis rather than memorization. Straight recall gets you through only a small share of the exam; most items hand you a scenario and expect you to work out what is going wrong or what should happen next.

Exam Format and Scoring

ISC is a four-hour exam delivered at Prometric testing centers.¹ The interface includes a functional spreadsheet and an authoritative literature database. You work through five testlets in a fixed sequence:

Testlets 1 and 2: 41 multiple-choice questions each, for 82 MCQs total.
Testlets 3, 4, and 5: six task-based simulations in total, presenting realistic scenarios that require application rather than recall.

A standardized 15-minute break is offered roughly midway through and does not count against your four-hour clock. You can accept or decline it. Optional breaks between other testlets are available but do come out of your testing time.¹

ISC is the only CPA Exam section that does not use a 50/50 weighting between multiple-choice questions and simulations. On ISC, MCQs count for 60 percent and simulations for 40 percent.² Strong performance on the first two testlets carries more weight here than on other sections.

Raw scores are converted to a scaled score from 0 to 99 using a psychometric model that adjusts for question difficulty across forms. You need a 75 to pass.² That number is a point on the scaled continuum, not a percentage correct.

When You Can Test and When Scores Release

The disciplines run on a different schedule from the core sections. While AUD, FAR, and REG are available year-round under continuous testing, discipline sections are only administered during the first month of each calendar quarter: January, April, July, and October. That compressed window makes planning matter more, especially if you are working full time or watching a credit expiration deadline.

Score release also differs. Instead of rolling releases, discipline scores come out on a single target date roughly six to ten weeks after the testing month closes. For 2026, January scores release in mid-March, April scores in mid-June, July scores in mid-September, and October scores in mid-December. Scores are typically posted at midnight Eastern Time on the target date and accessed through the NASBA candidate portal. If you do not pass, you receive a performance report showing relative strengths and weaknesses across the content areas.

Pass Rates and Trend

ISC pass rates have climbed since CPA Evolution launched. Early 2024 results hovered around 51 percent as candidates and prep providers adjusted to the new blueprint. By 2025, the cumulative rate reached 67.79 percent, and Q1 2026 came in at 66.79 percent.² Quarterly fluctuation is normal: 2025 ranged from 61.23 percent in Q1 to 71.96 percent in Q2.

Credit Expiration and Retakes

Under the updated model Uniform Accountancy Act rules, credit for a passed section expires 30 months from the score release date, replacing the previous 18-month window.³ Adoption depends on each jurisdiction’s legislative process, so not every state board has implemented it yet. Check with your state board to confirm which timeline applies to you.

If you fail ISC, there is no formal waiting period before retaking. You can register again as soon as you receive your score, obtain a new Notice to Schedule, and book an appointment.¹ The practical constraint is the quarterly testing window: a failed January attempt means the earliest retake is April.

Registration, Fees, and Rescheduling Costs

Registration starts with your state board of accountancy, which evaluates your credentials and authorizes you to register through NASBA. After matching your NASBA Dashboard account to your application and paying your fees, you receive a Notice to Schedule and book your Prometric appointment.⁴

The NASBA examination fee is $262.64 per section, putting all four sections at roughly $1,050.56. On top of that, each state board sets its own application and administration fees; some jurisdictions charge under $50 for initial application, others exceed $400. Candidates testing in Guam or at international centers pay additional administration fees.¹

Rescheduling or canceling costs more the closer you get to the appointment. The 2026 schedule:⁵

60 or more days before your appointment: no fee.
31 to 60 days before: $30.
5 to 30 days before: $60.
Less than 5 days but more than 24 hours before: $93.61.
Less than 24 hours before: no cancellation allowed; fees are forfeited and you must reapply.

Canceling does not extend your Notice to Schedule. If you cancel but fail to reschedule and sit before the NTS expires, you forfeit your examination fees. Arriving with the wrong identification or wrong NTS counts as a no-show and carries the same consequence. If personal hardship or an emergency prevents you from appearing, contact your state board directly for guidance rather than simply no-showing.⁵

1
National Association of State Boards of Accountancy (NASBA). CPA Exam FAQ
2
AICPA & CIMA. Learn more about CPA Exam scoring and pass rates
3
NASBA. Three Different Credit Extensions Happening Now!
4
National Association of State Boards of Accountancy (NASBA). CPA Portal
5
National Association of State Boards of Accountancy (NASBA). CPA Exam Candidate Guide