1.1 CPA Evolution Architecture & ISC Exam Logistics

CPA Evolution Architecture & ISC Exam Logistics

Quick Summary: The Information Systems and Controls (ISC) exam is one of three discipline sections under the CPA Evolution licensure model. Spanning 4 hours, the exam presents 82 multiple-choice questions and 6 task-based simulations, scored using a unique 60% MCQ / 40% TBS split with a passing scaled threshold of 75. Passing ISC earns the exact same unrestricted CPA license as passing BAR or TCP.

---

1. The CPA Evolution Licensure Architecture (Core-Plus-Discipline Model)

In January 2024, the American Institute of Certified Public Accountants (AICPA) and the National Association of State Boards of Accountancy (NASBA) implemented the CPA Evolution licensure model. This structural overhaul modernized the CPA examination to reflect the reality of modern accounting practice, where data analytics, cloud architectures, cybersecurity governance, and technology assurance have become integral competencies for newly licensed CPAs.

Under CPA Evolution, the legacy four-section exam structure—Auditing and Attestation (AUD), Business Environment and Concepts (BEC), Financial Accounting and Reporting (FAR), and Regulation (REG)—was replaced with a Core-Plus-Discipline framework:

1. Three Core Sections (Mandatory for all candidates):
   • AUD: Auditing and Attestation
   • FAR: Financial Accounting and Reporting
   • REG: Taxation and Regulation
2. One Discipline Section (Selected by candidate from three options):
   • BAR: Business Analysis and Reporting
   • ISC: Information Systems and Controls
   • TCP: Tax Compliance and Planning

                  ┌─────────────────────────────────────────┐
                  │             ALL CANDIDATES              │
                  │   Pass 3 Mandatory Core Examinations    │
                  └────────────────────┬────────────────────┘
                                       │
         ┌─────────────────────────────┼─────────────────────────────┐
         ▼                             ▼                             ▼
┌──────────────────┐          ┌──────────────────┐          ┌──────────────────┐
│     AUD Core     │          │     FAR Core     │          │     REG Core     │
│ Auditing & Assur │          │ Fin. Accounting  │          │ Taxation & Reg.  │
└──────────────────┘          └──────────────────┘          └──────────────────┘
                                       │
                                       ▼
                  ┌─────────────────────────────────────────┐
                  │         CHOOSE ONE DISCIPLINE           │
                  └────────────────────┬────────────────────┘
                                       │
         ┌─────────────────────────────┼─────────────────────────────┐
         ▼                             ▼                             ▼
┌──────────────────┐          ┌──────────────────┐          ┌──────────────────┐
│  BAR Discipline  │          │  ISC Discipline  │          │  TCP Discipline  │
│ Advanced Fin/Gov │          │ IT Audit/Sec/SOC │          │ Advanced Tax/Fin │
└──────────────────┘          └──────────────────┘          └──────────────────┘
                                       │
                                       ▼
                  ┌─────────────────────────────────────────┐
                  │       ONE UNIFIED CPA CREDENTIAL        │
                  │     Identical Full Practice Rights      │
                  └─────────────────────────────────────────┘

Licensure Equivalence

A critical principle of CPA Evolution is statutory licensure equivalence. Candidates who select and pass ISC receive the exact same unrestricted CPA license as those who select BAR or TCP. State accountancy boards do not issue "specialty" or "restricted" licenses. A CPA who passed ISC possesses full statutory authority to sign financial statement audit reports, execute individual and corporate tax filings, or provide general financial consulting. Choosing ISC demonstrates specialized proficiency in IT assurance, cybersecurity governance, and System and Organization Controls (SOC) engagements without limiting career mobility.

Discipline Comparison

---

2. ISC Examination Structure and Administration

The ISC exam is administered as a single, computer-based testing event lasting 4 hours (240 minutes) at authorized Prometric testing centers worldwide. The exam is divided into five distinct testlets that must be completed sequentially. Once a testlet is submitted, the candidate cannot return to review or change answers in that testlet.

Testlet Composition and Question Counts

Blueprint check: The 2026 Uniform CPA Examination Blueprints introduction sets the ISC testlet sequence at 41 MCQs, 41 MCQs, 1 TBS, 3 TBSs, 2 TBSs. Testlet 4 — not Testlet 5 — is the heaviest simulation testlet. Third-party summaries frequently reverse the last two testlets; trust the blueprint.

Pacing Strategy and Break Logistics

Time management is paramount on ISC. Candidates face 82 MCQs and 6 complex simulations. To finish without rushed guessing, adhere to the following tactical budget:

• Multiple-Choice Questions (Testlets 1 & 2): Allocate an average of 1.1 minutes per question. Completing 41 questions in approximately 45 minutes per testlet allows you to finish both MCQ testlets within 90 minutes, leaving a healthy 150-minute reserve for the 6 simulations.
• Task-Based Simulations (Testlets 3, 4 & 5): Budget 20 to 25 minutes per simulation. Testlet 3 contains 1 TBS (~20–25 min), Testlet 4 contains 3 TBSs (~65–75 min), and Testlet 5 contains 2 TBSs (~45–50 min).
• The 15-Minute Scheduled Break: The exam software offers a 15-minute scheduled break between Testlet 3 and Testlet 4. When accepted, the 240-minute testing timer pauses. You can leave the testing room, use the restroom, hydrate, and clear mental fatigue without losing exam time. If you take an unscheduled break between any other testlets (e.g., between Testlets 1 and 2, or between 4 and 5), the testing timer continues to run.

---

3. Scoring Architecture: The Unique 60/40 Split and Scaled Scoring

One of the most defining characteristics of the ISC exam is its scoring weight distribution. Across the CPA exam landscape, ISC is the only section that does not employ a 50% MCQ / 50% TBS scoring split.

Scoring Breakdown Across CPA Exam Sections

Rationale for the 60/40 Split

The AICPA publishes the 60% MCQ / 40% TBS weighting in the blueprint introduction but does not publish a rationale for it. What the blueprint does say is consistent with the weighting: ISC is the only section whose skill allocation is dominated by Remembering and Understanding (55–65%), and that breadth of terminology — security frameworks, privacy regulations, and the AT-C attestation sections — is efficiently sampled by multiple-choice items. Evaluating whether a candidate understands the operational distinctions between symmetric and asymmetric encryption, disaster recovery hot sites versus warm sites, or the five Trust Services Criteria categories is highly effective via targeted multiple-choice items.

Scaled Scoring (0 to 99 Scale)

Passing ISC requires achieving a scaled score of 75. A scaled score of 75 is not a raw percentage (it does not mean answering 75% of questions correctly). The AICPA uses Item Response Theory (IRT) psychometric scoring:

• Each scored test question is calibrated for statistical difficulty, discrimination capability, and guessing factor.
• Correctly answering a highly difficult question yields more scaled points than correctly answering an elementary question.
• The scoring engine equates candidate performance across different test forms to guarantee that candidates receiving harder test forms are evaluated on an equitable standard.

Scored vs. Pretest Items

Embedded within your 82 MCQs and 6 TBSs are unscored pretest items. The AICPA uses pretest questions to gather performance data on newly authored questions before promoting them to scored status on future forms. The AICPA does not publish the operational-versus-pretest item split for the ISC section, so any specific count you see quoted is an estimate rather than an official figure. Pretest questions are indistinguishable from operational questions on screen. Treat every single question and simulation as fully scored.

---

4. Eligibility, Testing Windows, Score Release, and Credit Expiration

Testing Windows vs. Continuous Testing

While the three Core sections (AUD, FAR, REG) operate under a continuous testing model (candidates can test year-round, subject to Prometric seat availability), the Discipline sections (ISC, BAR, TCP) operate under quarterly testing windows.

• In 2026 the Discipline windows run the full first month of each calendar quarter: January 1–31, April 1–30, July 1–31, and October 1–31. No Discipline testing is offered in the remaining eight months.
• Because Discipline scoring is batched at the close of each window rather than rolling, Discipline scores are released only four times in 2026 — on March 13, June 16, September 11, and December 15 — roughly six weeks after the window closes. Core-section scores, by contrast, post within a few weeks of the exam data file reaching the AICPA.
• Plan backwards from the window, not forwards from your study start date: a candidate who is ready in mid-February waits until April 1 to sit and until June 16 to learn the result.

Retake Restrictions

A candidate who sits for ISC and does not achieve a passing score cannot retake ISC within that same quarterly testing window. The candidate must wait until the opening of the subsequent quarterly window to re-test. However, if a candidate decides that ISC is not aligning with their strengths, they are permitted to switch disciplines (e.g., switching to TCP or BAR) for their next test appointment.

The 30-Month Rolling Credit Rule

Historically, candidates were required to pass all four sections of the CPA exam within an 18-month rolling window. In 2023, NASBA approved an amendment to the Uniform Accountancy Act (UAA) Model Rules extending the credit retention period to 30 months. Under this rule:

• Once a candidate passes their first exam section, they have 30 months from the date that score is officially released by NASBA to pass the remaining three sections.
• If any section expires before all four are passed, only the expired section loses credit and must be retaken.
• Note on State Board Jurisdiction: While the majority of state accountancy boards have formally adopted the 30-month rule (and some jurisdictions have granted temporary pandemic-related transitional extensions), state board rules govern licensure. Candidates should always verify the exact credit expiration rules with their specific state accountancy board.