IT Systems and Data for the CPA Exam: AUD and ISC

Kyle Ashcraft, CPA · 2019 CPA Exam Scores · 95 FAR · 98 BEC · 91 REG · 90 AUD

IT turns up on both AUD and ISC, and it is one of the easiest areas to lose points on for a reason that has nothing to do with difficulty. The material is not hard. It arrives scattered, in a dozen unrelated lists, and it never gets organized.

This page puts it in one place: governance, the people involved, the systems, change management, databases, ETL, SQL, general IT controls, SOC reports and the risk frameworks. The concepts underneath are manageable once the structure is visible.

In this guide

• How AUD and ISC test IT
• IT governance
• Who does what
• Types of IT systems
• Change management and the cloud
• The systems development life cycle
• Legacy systems
• Databases, processing and ETL
• Data analytics
• SQL
• General IT controls
• SOC reports
• Inherent limitations
• Enterprise risk management
• Glossary

How do AUD and ISC test IT?

Differently enough that it changes how you should study. AUD wants to know how the client's systems affect your audit. ISC wants to know how the systems and the data themselves work.

On AUD

IT sits mostly in Area II, assessing risk and developing a planned response. Very little of it is vocabulary recall. Most of it is about how the IT environment changes what you do as an auditor.

Topic	Representative task	Skill level
COSO framework	Define internal control, its purpose, objectives and components	Remembering and understanding
IT general controls	Understand and test the design and implementation of relevant ITGCs	Application
Business processes and IT environment	Document significant processes and perform walkthroughs	Application
IT infrastructure	Understand ERP, cloud and applications	Application
IT applications and transaction data	Understand the systems that capture and process transactions	Analysis
Automated and manual controls	Test relevant transaction-level controls	Application

On ISC

IT and data management make up the largest area of the exam, and the skill levels run higher. SOC 2 work reaches evaluation level, which is as high as the exam goes.

Topic	Representative task	Skill level
Information systems
IT infrastructure	Architecture, cloud models and governance basics	Remembering and understanding
ERP and AIS	Evaluate systems and process improvements	Analysis
Business process reconciliation	Compare the actual process against the documented one	Analysis
SOC 2 and trust services criteria	Detect deficiencies in control design or operation	Evaluation
Data management
Data extraction and storage	Identify extraction methods and storage options	Remembering and understanding
Data life cycle	Summarize data from creation to disposal	Remembering and understanding
Relational databases	Analyze structure and integrity rules	Analysis
SQL queries	Evaluate whether retrieved data is relevant and complete	Analysis
Data integration	Combine data from different sources for decision use	Analysis

What this means for how you study. On AUD, learning what an ERP is earns you almost nothing. Learning what an ERP does to your risk assessment earns you the question. On ISC, the same topic is tested one level deeper: you may have to say whether a control over it is designed properly.

What is IT governance?

The framework for running the IT environment: aligning it with what the business is trying to do, getting value from it, managing its risks, allocating its resources and checking whether it is working. The IT Governance Institute breaks it into five components.

Component	What it means
Strategic alignment	IT supports the business strategy rather than running as a back-office utility. Includes high-level choices such as physical against virtual networks, and centralized against decentralized
Value delivery	IT is treated as an investment that generates value, not purely a cost centre
Risk management	IT risks are identified and managed continuously, weighing the cost of mitigation against likelihood and severity
Resource management	Software, hardware, people and support are used efficiently
Performance measurement	Once a system is live, the company checks whether it is delivering what was expected

The IT risks the third component is concerned with are the usual suspects: natural disasters, user error, fraud and intentional misuse, unauthorized access, system unavailability, inefficiency and compliance failures.

Why risk identification has to be ongoing. An IT risk assessment done once is out of date almost immediately, because the environment changes underneath it. New software, a new vendor, a departed administrator whose access was never revoked. Questions that describe a company assessing IT risk at implementation and never again are describing a deficiency.

Who does what in IT governance?

Participant	Role
Board of directors	High-level oversight, and ensuring IT aligns with company strategy
Executive management	Implementation and day-to-day tone at the top. How seriously they treat IT structure sets how seriously everyone else does
Steering committee	Senior group that directs, reviews and approves strategic IT plans, major initiatives and resource allocation

The name is the mnemonic: the steering committee steers, pointing the company toward the IT it needs.

What types of IT systems are there?

Do not memorize the list. Sort it into two buckets and the list mostly memorizes itself.

Decision-making systems inform a decision.
Transaction-processing systems execute a process.

Decision-making systems

System	Purpose
Management information system	Supports the strategic process
Decision support system	Supports day-to-day decisions
Executive information system	Built for senior executives
What-if analysis	Forecasts scenarios
Artificial intelligence	Automates or supports decision-making
Performance management systems	Support executive decision-making

Transaction-processing systems

System	What it does
Accounting information system	Handles invoices, cash receipts, reconciliations and financial reporting. Creates audit trails and can carry edit checks and other controls
Customer relationship management	Manages relationships with customers and prospects
Enterprise resource planning	Integrates departments onto one shared platform so accounting, inventory, sales and the warehouse communicate in real time
Supply chain management	Manages sourcing through production and delivery

Why the auditor cares about an ERP specifically. One shared platform means one entry updates several modules at once. That is good for consistency and bad if the configuration is wrong, because a single misconfigured rule propagates everywhere rather than staying in one department. It also concentrates access risk: rights that would be split across four systems now sit in one.

How does IT change management work?

Change management is how new or modified systems get implemented in a controlled way. Change is when things break, so it needs policies, assigned responsibility, segregation of duties and a way back.

1. Plan. Decide what should be implemented and how.
2. Do. Implement the change.
3. Check. Verify it works properly.
4. Act. Adjust what needs adjusting.

On transition method, a parallel run is safer than a direct changeover, because both systems operate together while the new one is validated. A direct changeover is faster and cheaper and leaves you nothing to fall back on.

Approach	Scale of change
Business process re-engineering	Major and radical
Business process management	Smaller and gradual

Cloud computing

On-demand access to IT resources over the internet, rented from a provider rather than maintained on site. The service models are worth knowing because they determine who is responsible for what, which is exactly what a control question turns on.

Model	What the provider supplies	What the customer manages
IaaS, infrastructure as a service	Servers, storage, networking	Operating system, applications, data
PaaS, platform as a service	Infrastructure plus the development platform	Applications and data
SaaS, software as a service	The finished application	Data and user access only

The point of that table. Moving to the cloud does not remove the entity's responsibility for controls, it relocates it. The further down the list you go, the more the entity depends on the provider's controls, which is precisely when a SOC report becomes the evidence you need.

What is the systems development life cycle?

Step	Stage	What happens
1	Plan	Identify the need
2	Analyze	Gather and analyze requirements
3	Design	Visualize the system
4	Develop	Build or code it
5	Test	Test before live use
6	Deploy	Go live
7	Maintain	Monitor and update over time

Textbooks split the SDLC into anywhere from five to seven stages, and the boundaries move. Learn the sequence and the logic rather than the count, because a question that merges analysis into planning is still the same life cycle.

Why do companies keep legacy systems?

A legacy system is old software still in use. The exam tests both halves: why a rational business keeps one, and why an auditor should be uneasy about it.

Why it stays	Why it worries the auditor
Already paid for	Security weaknesses
Staff already know how to use it	No vendor support or patches
Customized to how the company actually works	Poor integration with modern systems
Replacing it is disruptive and expensive	Slower performance, and often nobody left who understands the code

How is data stored and moved?

Relational databases

A relational database stores interconnected data across tables, linked by shared keys rather than duplicated in each place it is needed.

Term	What it is
Table	The full dataset
Data type	The kind of data a column holds, such as text or number
Record or row	One horizontal entry
Column	One vertical entry
Field	An individual cell

Real-time against batch processing

Method	How it works	Example
Real-time	Each transaction is processed as it is entered	Immediate posting
Batch	Transactions accumulate and are processed together	End-of-day EFT file reviewed before submission

The control angle the exam is usually after. Batch processing creates a natural review point, because someone can inspect the batch before it goes anywhere. Real-time processing is faster and gives up that window. Neither is better in the abstract, and a question naming one is usually asking what control opportunity it creates or removes.

Extract, transform, load

1. Extract. Pull the raw data out of the source system.
2. Transform. Clean and structure it so it can be analyzed. Unstructured data is not ready for analysis. Structured data is.
3. Load. Put it in the right destination.

Destination	Holds	Scope
Data warehouse	Structured data only	Company-wide
Data mart	Structured data only	One department
Data lake	Structured and unstructured	Broad, raw storage

Warehouse and mart take structured data only and differ by scope. The lake is the one that takes anything, which is its point and also its risk: nothing forced the data into a usable shape on the way in.

What are the four types of data analytics?

Type	Looks	Answers	Example
Descriptive	Backward	What happened	Sales fell 20% last year
Diagnostic	Backward	Why it happened	A competitor entered the market
Predictive	Forward	What will happen	We expect to regain 10% share
Prescriptive	Forward	What to do about it	Increase marketing spend to capture that share

Descriptive and diagnostic look back. Predictive and prescriptive look forward. Within each pair, the first says what and the second says why or how.

What do you need to know about SQL?

ISC is less interested in whether you can write a query than in whether you can read one and say whether the data it returns is relevant and complete.

Clause	What it does
SELECT	Chooses the columns
FROM	Names the source table
WHERE	Filters individual rows
GROUP BY	Aggregates rows into groups
HAVING	Filters the groups
ORDER BY	Sorts the output

The distinction most worth understanding: WHERE against HAVING. WHERE filters rows before they are grouped. HAVING filters groups after the aggregation has happened. So a condition on an individual transaction belongs in WHERE, and a condition on a total or a count belongs in HAVING. Put an aggregate in a WHERE clause and it will not work.

Clause order is fixed: SELECT, FROM, WHERE, GROUP BY, HAVING, ORDER BY. Reading a query in that order tells you what it filtered, what it combined, and what it then filtered again, which is how you judge whether anything was missed.

Aggregate function	Returns
COUNT()	Number of matching rows
SUM()	Total of a numeric column
AVG()	Average value
MAX()	Highest value
MIN()	Lowest value

String function	Does
CONCAT()	Joins strings together
SUBSTR() or SUBSTRING()	Extracts part of a string
REPLACE()	Substitutes one substring for another
LENGTH()	Returns the length of a string

What are the general IT controls?

Logical controls

These govern system access: who gets in, and what they can do once inside. Logical, as in logging in.

Control	What it does
Firewall	Controls incoming and outgoing network traffic
Encryption	Renders data unreadable without the key
VPN	Encrypted tunnel for remote access
Multi-factor authentication	Requires more than one type of credential
Digital signature	Verifies authenticity and that the document has not changed
Electronic signature	Electronic signing of a document
Passwords	Basic access control. Length matters more than complexity

Physical controls

Security cameras, security guards, key cards, biometric devices. These stop someone walking up to the hardware.

Manual against automated controls

Manual controls depend on a person doing something. Automated controls are performed by the system. Automated controls are faster and consistent, which is their advantage and also the reason they fail invisibly when they fail at all.

The link the exam is testing. An automated control is only as reliable as the general IT controls around it. If change management is weak, someone can alter the logic and the control keeps reporting success while doing something else. That is why an auditor cannot rely on automated application controls without first getting comfortable with the ITGCs underneath, and it is the single most useful sentence in this section.

What do SOC reports tell you?

A SOC report gives assurance over controls at a service organization, so that a user auditor can rely on work already performed instead of repeating it.

Report	Covers	Typical use
SOC 1	Controls relevant to financial reporting	A payroll processor whose work lands in payroll expense
SOC 2	Controls against the trust services criteria: security, availability, processing integrity, confidentiality and privacy	Data security at a service provider. Restricted distribution
SOC 3	The same subject matter as SOC 2, at a summary level	General distribution, including marketing use

Type	Covers	Period	Assurance
Type I	Whether controls are suitably designed and implemented	As of a single date	Lower
Type II	Design, plus whether controls operated effectively	Over a period	Higher

Type I is a photograph. Type II is a film. Type I tells you the controls existed and were sensibly designed on one day. Type II tells you they actually worked, day after day, across the period. If a question asks which gives more assurance, or which supports reliance on the service organization's controls, the answer is Type II.

What are the inherent limitations of internal control?

These are why no system, however well designed, provides absolute assurance. Reasonable assurance is the ceiling.

Limitation	Why it cannot be designed away
Human error	People make mistakes even when the control is sound
Faulty judgment	Decisions rest on incomplete information and are subject to bias
Collusion	Segregation of duties assumes two people will not cooperate. Sometimes they do
Management override	The people who designed the controls can step around them
Cost against benefit	A control costing more than the loss it prevents will not be implemented
External events	Some things sit outside the entity's control entirely

Management override is the one that shows up most, and it is the reason the auditor is required to test journal entries on every engagement regardless of how strong the control environment looks. Controls are designed by management, so management is the party best placed to defeat them.

What is enterprise risk management?

ERM is the entity-level version of the risk conversation. Internal control asks whether processes are reliable. ERM asks what risks the organization is taking on across the whole business and whether those match the risk it says it wants.

Term	Definition
Risk appetite	The type and amount of risk the organization is willing to accept
Risk portfolio	The total collection of risks across the entity
Inherent risk	Risk before mitigation
Residual risk	Risk after mitigation

The five components

ERM component	Internal control parallel
Governance and culture	Control environment
Strategy and objective-setting	No direct equivalent. This is the one that makes ERM different
Performance	Risk assessment and control activities
Review and revision	Monitoring
Information, communication and reporting	Information and communication

The five risk responses

Response	Meaning	Example
Accept	Take no action, because the risk sits inside appetite	Live with ordinary competitor risk
Avoid	Exit the activity entirely	Leave a market
Pursue	Take on more risk deliberately, for more return	Expand into an adjacent line of business
Reduce	Lower likelihood or impact	Add controls, diversify
Share	Transfer part of it to someone else	Insurance, a joint venture, outsourcing

Pursue is the one candidates forget, and the one that shows ERM is not just defensive. Internal control is about preventing bad outcomes. ERM includes deliberately accepting more risk when the return justifies it and the risk sits within appetite. A question describing a company expanding into a riskier market is not describing a control failure. It is describing a risk response.

Glossary

Term	Definition	Exam
IT governance	Framework covering IT strategy, value, risk, resources and performance	AUD, ISC
Steering committee	Senior group directing strategic IT plans	AUD, ISC
ERP	Integrated system connecting departments in real time	AUD, ISC
AIS	Accounting system recording transactions and supporting reporting	AUD, ISC
IaaS, PaaS, SaaS	Cloud models, from renting infrastructure to renting finished software	AUD, ISC
SDLC	Plan, analyze, design, develop, test, deploy, maintain	AUD, ISC
Legacy system	Old system still in use despite support and security issues	AUD, ISC
Relational database	Interconnected data stored across linked tables	ISC
Batch processing	Transactions grouped and processed together, allowing review first	AUD, ISC
ETL	Extract, transform, load	ISC
Data warehouse	Structured data, company-wide	ISC
Data mart	Structured data, one department	ISC
Data lake	Structured and unstructured data	ISC
WHERE against HAVING	WHERE filters rows before grouping, HAVING filters groups after	ISC
Logical controls	Access controls such as passwords, MFA, VPN, encryption	AUD, ISC
Physical controls	Controls over physical access to systems and premises	AUD, ISC
SOC 1	Service organization controls relevant to financial reporting	AUD, ISC
SOC 2	Controls against the trust services criteria, restricted distribution	AUD, ISC
SOC 3	Summary-level version of SOC 2 for general distribution	AUD, ISC
Type I and Type II	Design at a date, against design plus operating effectiveness over a period	AUD, ISC
Inherent and residual risk	Risk before mitigation, and what remains after	AUD, ISC
Risk appetite	The risk the organization is willing to accept	AUD, ISC
Reasonable assurance	The achievable standard. Absolute assurance is not attainable	AUD, ISC

Frequently asked questions

What is the easiest way to organize IT systems for the CPA exam?

Split them in two. Decision-making systems inform a decision. Transaction-processing systems execute a process. Almost every system named on the exam drops cleanly into one of those buckets.

What is the difference between SOC 1, SOC 2 and SOC 3?

SOC 1 covers controls relevant to financial reporting. SOC 2 covers the trust services criteria, including security and confidentiality, and has restricted distribution. SOC 3 covers the same ground as SOC 2 at a summary level and can be distributed freely.

What is the difference between a Type I and a Type II report?

Type I says the controls were suitably designed as of a single date. Type II says they were suitably designed and operated effectively across a period. Type II gives more assurance, which is why it is what a user auditor generally wants.

When do I use WHERE and when do I use HAVING?

WHERE filters individual rows before they are grouped. HAVING filters the groups after aggregation. A condition on a single transaction goes in WHERE, and a condition on a total or a count goes in HAVING.

What is the difference between a data warehouse, a data mart and a data lake?

Warehouses and marts hold structured data and differ by scope, company-wide against departmental. A data lake holds structured and unstructured data together.

Why can't an auditor rely on an automated control by itself?

Because an automated control is only as reliable as the general IT controls surrounding it. If access or change management is weak, the logic behind the control can be altered while the control continues to report that it ran.

How many risk responses are there under COSO ERM?

Five: accept, avoid, pursue, reduce and share. Pursue is the one most often left out, and it is the one that shows ERM covers taking on risk deliberately, not only defending against it.

Start free with CPA 101

IT is one slice of AUD and ISC. CPA 101 is free and includes all 25 of the 2026 AICPA released MCQs plus a study outline, so you can see how the rest of the material gets taught. No credit card required.

Start CPA 101 free

Kyle Ashcraft, CPA scored 90 or above on every section of the CPA exam in 2019, including a 95 on FAR. He is the founder and sole instructor of Maxwell CPA Review, a complete CPA review course covering all six sections, where he creates every lecture, textbook and study outline himself.

Explore More Comprehensive CPA Guides

The Complete Guide to Leases

Master operating and finance leases, journal entries, and amortization schedules.

Mastering Financial Ratios

The ultimate cheat sheet for turnover, liquidity, and profitability ratios.

Cost Accounting Explained

Break down variance analysis, job costing, and activity-based costing (ABC).

Capital Budgeting Mastery

Understand NPV, IRR, payback period calculations, and investment decisions.

Economics 101 for the CPA

Simplify macro and microeconomic concepts, supply, demand, and market structures.

IT Systems & Controls

Navigate relational databases, IT governance, segregation of duties, and cybersecurity.