ISC topic guide

Access controls for ISC CPA candidates.

Access control questions test whether the right people have the right access at the right time, and whether the organization can prove access is appropriate.

Practice ISC access control questions CPA sections

By World of Accountants editorial team. Last reviewed August 23, 2026. World of Accountants is independent and not affiliated with the AICPA, NASBA, Becker, NINJA, UWorld, Gleim, or other CPA review providers.

ISC sample question

Test the rule before you leave this ISC guide.

Read the topic explanation, then use this real ISC question to check whether the controlling fact is sticking.

ISC-000006ISC-IILogical access

An access review finds that a terminated system administrator's privileged account remains enabled. Logs show no activity after termination. Which response best addresses the control risk?

A.Close the finding because the logs show no use
B.Disable the account, investigate the period of inappropriate access, and determine whether other access records need review
C.Keep the account enabled for continuity and monitor it annually
D.Delete the logs so the inactive account cannot be misunderstood

Answer: B. Disable the account, investigate the period of inappropriate access, and determine whether other access records need review

An enabled privileged account creates an avoidable unauthorized-access risk even when no activity is currently visible. The account should be disabled and the exposure period investigated.

Why the other answers are wrong

A. Absence of observed use does not eliminate the risk created by an enabled privileged account.
C. Continuity does not justify retaining inappropriate privileged access after termination.
D. Logs are evidence and should be preserved, not deleted.

Core idea

Access controls protect systems and data by limiting permissions, approving access changes, removing access promptly, and monitoring for inappropriate activity.

What ISC likes to test

Expect least privilege, role-based access, multi-factor authentication, privileged accounts, joiner-mover-leaver processes, access reviews, and segregation of duties.

Common miss

Candidates often choose a preventive control when the facts ask for monitoring evidence, or they forget deprovisioning when an employee changes roles or leaves.

How to practice

Ask whether the risk is unauthorized access, excessive access, stale access, or lack of evidence. Then match the control to that risk.

How to use this guide

Turn access controls for isc cpa candidates into a short practice loop.

Read the core idea first, then answer a small set while the rule is still active in your head. The goal is to see whether you can recognize the tested fact without rereading the guide.

Spot the tested fact

Before choosing an answer, name the one fact that should control the result. ISC questions often become easier once the controlling fact is separated from background detail.

Explain the distractor

When an answer is wrong, say why it is wrong in one sentence. That habit turns answer review into durable exam judgment instead of memorizing a letter.