Prepare for ISC by mastering concept pairs: general versus application controls, preventive versus detective controls, SOC 1 versus SOC 2 versus SOC 3, and confidentiality versus privacy. Practice classifying controls in short fact patterns, map controls to assertions and trust services categories, and use a written rubric to check whether your reasoning, not just your answer choice, is correct.
Classification Over Definitions: How to Study the Core Pairs
ISC content rewards the ability to place a described activity into the correct named concept. Build study sessions around contrasting pairs and practice sorting scenarios so classification becomes the reflex, not definition recall.
Build your study around pairs: preventive versus detective versus corrective controls, general versus application controls, confidentiality versus privacy, and SOC 1 versus SOC 2. For each pair, write one sentence stating the dividing line between the two concepts. A control type question turns on timing or purpose: does the control stop an error, find it, or fix it after detection?
Then practice the pairing actively. Take a scenario such as 'the system blocks purchase orders above a user's approval limit' and classify it on two axes at once: control type (preventive, because it blocks the transaction) and control category (application control, because it operates within the purchasing system). Two-axis classification is the habit to train, because the discipline's topics are easy to memorize individually and easy to confuse when they appear together in a single fact pattern.
General IT Controls Versus Application Controls: The Dividing Line
General controls govern the IT environment that all applications depend on, such as access administration, change management, and operations. Application controls operate inside a specific system to ensure particular processing is complete, accurate, and authorized.
Use a dependency test to separate them. Ask: would this control exist even if the organization had no particular business application in mind? Password complexity standards, segregation of duties in system administration roles, and procedures for testing and approving system changes are general controls because they protect the whole environment. Edit checks, field validations, and interface totals are application controls because they address processing within one system.
The two layers connect in a specific way worth internalizing: reliance on an automated application control assumes the underlying general controls are operating effectively. If change management is weak, a validation rule someone tested last year may have been altered since. When a fact pattern mentions a data input edit check, consider whether the question is actually steering you toward the general controls that keep that check reliable.
SOC 1, SOC 2, and SOC 3: Choosing the Right Engagement
SOC 1 reports address controls at a service organization relevant to user entities' financial statement audits. SOC 2 reports address controls related to trust services categories. SOC 3 is a general-use version of SOC 2 reporting.
The selection question is always about who needs the report and what they will use it for. If a service organization's controls could affect its customers' financial statements, a SOC 1 report is the fit, because user auditors rely on it when auditing those customers. If the customers' concern is security, availability, processing integrity, confidentiality, or privacy rather than financial reporting, SOC 2 is the fit. SOC 3 covers the same subject matter as SOC 2 but is designed for broad distribution without the detailed testing descriptions.
Distinguish the report contents as well. A Type I report expresses an opinion on the design of controls at a point in time; a Type II report adds an opinion on operating effectiveness over a period. So a SOC question can have two dimensions: which report type, and which opinion basis. Classify both dimensions before answering, because a fact pattern can be right on one and wrong on the other.
| Report | Subject matter | Primary audience | Time basis options |
|---|---|---|---|
| SOC 1 | Controls relevant to user entities' internal control over financial reporting | User entities and their auditors | Type I (design, point in time) or Type II (design and operating effectiveness, period) |
| SOC 2 | Controls related to trust services categories such as security, availability, and confidentiality | Parties with sufficient knowledge who need details | Type I or Type II |
| SOC 3 | Same trust services subject matter as SOC 2 | General public use | Report on the period, without detailed control testing |
Confidentiality Versus Privacy: Why the Distinction Changes the Answer
Confidentiality concerns protecting information the organization holds from unauthorized disclosure. Privacy concerns personal information gathered about individuals and covers the whole data lifecycle, including collection, use, retention, and disposal.
A practical dividing line: encryption of a customer database protects confidentiality. A policy limiting how long customer records are retained before destruction addresses privacy, because it governs the handling of personal information over its lifecycle. Build a sorting exercise: write ten safeguards on index cards, such as secure transmission, consent notices, access restrictions, and disposal schedules, and place each card on the confidentiality or privacy side, writing one sentence of justification for every placement.
Note where they overlap and where they do not. Personal information that is properly protected satisfies both concerns at once, but the concepts answer different questions: confidentiality asks who can see the data, while privacy asks whether the organization should have collected and kept it in the first place. When a fact pattern mentions data minimization or disposal, privacy is the concept in play even though no unauthorized disclosure has occurred.
Worked Scenario 1: Selecting the SOC Engagement for a Payroll Processor
A service organization whose processing affects client payroll expense must address controls relevant to financial reporting. The correct response is a SOC 1 engagement; a SOC 2 alone would not serve the user auditors' purpose.
Scenario: PayServe processes payroll for 40 client companies, and each client's financial statements include payroll expense. PayServe's CFO asks its service auditor for a report on security and availability and is advised accordingly. The plausible mistake here is accepting the security framing, which sounds urgent but answers the wrong question. PayServe's processing generates the numbers its clients report in their own financial statements.
The better decision: engage for a SOC 1 report, because the controls over payroll calculation and posting are relevant to user entities' internal control over financial reporting, and the clients' auditors need that report for their audits. If PayServe also wants to demonstrate security practices, a SOC 2 is a separate, additional engagement, not a substitute. The reason it matters: the wrong report leaves user auditors without the financial-reporting-focused evidence they require, and the service organization has spent money on the wrong deliverable.
Worked Scenario 2: Fixing a Segregation of Duties Gap in Procure-to-Pay
When one employee can both create vendors and approve payments, the exposure is fraudulent payments to fictitious vendors. The appropriate response is a preventive control through access and approval-role separation, not additional after-the-fact review alone.
Scenario: In a mid-sized distributor, the accounts payable supervisor can add new vendor records and also approve payment runs, and management proposes a monthly review of payment journals as the fix. The plausible mistake is treating a detective control as the remedy for a preventable authorization conflict. Journal review can catch an anomaly later, but it operates after payments have gone out the door.
The better decision: remove vendor creation from the payment approver's role, or require an independent party to maintain vendor master data, so the conflict cannot occur. Complementary detective monitoring can still be layered on, but the preventive separation addresses the risk directly. Why it matters: risk response questions test whether the control's timing and mechanism match the identified risk, and matching a detective control to a preventable fraud exposure is a reasoning error worth practicing until it is automatic.
A Control-Mapping Exercise and Your Readiness Sequence
Work one mapping exercise per week: write a business process, list its risks, and classify each control by type, category, and what it supports. Then score yourself with the rubric below before moving to new topics.
Exercise: draft a three-step procure-to-pay flow (purchase order, receipt, payment), then list at least six controls across it, including one automated edit check and one IT environment control. Classify each control twice: preventive, detective, or corrective; and general or application. Then state for each control whether it primarily supports transaction authorization, recording completeness, or asset safeguarding. A sound outcome looks like the automated check labeled preventive and application, and change approval procedures labeled preventive and general.
Self-check rubric: award one point per correct two-axis classification, one point for a defensible assertion or objective link, and one point only if your written reasoning would stand without the label. If you score below four of six on any item, rework the pair that failed rather than moving on. These scores are learning milestones for tracking your own progress, not predictions of exam results. Administrative details such as application and scheduling are handled by NASBA and the exam administrators, so check the official exam page (nasba.org/exams/cpaexam) for logistics. A realistic sequence: weeks one and two on control types and IT general controls; week three on SOC engagements and report types; week four on security, confidentiality, and privacy; week five on business process cycles and their risks; then two weeks of mixed scenario classification practice with the rubric applied to your written answers.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.