AAIA
AAIA: Advanced in AI Audit
Everything you need for ISACA AAIA: exam format, the three domains and weights, the CISA prerequisite, a study plan and free sample questions.
- Questions
- 90
- Domains
- 3
- Requires
- CISA or equivalent
- Exam fee
- $459 member
AAIA — ISACA Advanced in AI Audit — is a credential for auditors who now have to audit AI systems. It validates the ability to audit complex systems and mitigate AI-related risks, and like its sibling AAISM, it sits on top of an existing professional designation rather than standing alone.
The eligibility gate is specific: CISA, or one of a defined set of audit and accounting designations held in an IT audit or IT advisory role — CIA, US CPA, ACCA, and the Canadian, Australian, Japanese and other equivalents.
That tells you the perspective. AAIA does not teach you to audit. It assumes you audit well already, and tests whether you can do it when the subject is a model whose behaviour comes from data, cannot be read like source code, and changes without anyone deploying anything.
What the exam covers
| Domain | Weight |
|---|---|
| AI Governance and Risk | 33% |
| AI Operations | 46% |
| AI Auditing Tools and Techniques | 21% |
Ninety questions, and an unusually lopsided distribution. AI Operations is nearly half the exam — data management, development lifecycle, change management, supervision of outputs, testing techniques, AI-specific threats and incident response.
The audit techniques domain, which candidates expect to dominate, is the smallest at 21%. That is the single most important planning fact about this exam: you are being tested mostly on understanding how AI systems are built and run, not on audit method you already know.
Where to start
Check the prerequisites — the eligibility list is specific. Then the exam format, and how AAIA differs from CISA if you hold it and want the honest delta.
AAIA guides
- AAIA exam format: questions, score and costThe ISACA AAIA format: 90 questions across three domains, fees, the CISA eligibility gate, the six-month window and the five-year application period.
- AAIA vs CISA: how they differCISA is a prerequisite for AAIA, not an alternative. What AAIA adds for auditors, what transfers, and how much new study a CISA holder needs.
- AAIA study plan: pass in 6 weeksA six-week AAIA study plan weighted to match ISACA's domains, with most time in AI Operations rather than the audit techniques auditors already know.
- Free AAIA sample questions with answersFive free ISACA AAIA practice questions across the three domains, written in ISACA's BEST and FIRST style, each with an explained answer.
- AAIA AI governance and risk explainedThe AAIA governance domain explained: AI models and requirements, programme management, risk management, privacy and data governance, ethics and standards.
- AAIA AI operations explainedThe largest AAIA domain explained: AI data management, lifecycle, change management, supervision, testing techniques, threats and incidents.
- AAIA AI auditing tools and techniquesThe smallest AAIA domain explained: planning an AI audit, sampling, evidence collection for models, data analytics and reporting on probabilistic systems.
- AAIA prerequisites: CISA or equivalentAAIA requires CISA or a qualifying audit designation such as CIA or CPA held in an IT audit role. What qualifies, what it costs, and the alternatives.
- Is AAIA hard? Exam difficulty explainedHow hard ISACA AAIA really is: why AI Operations at 46% catches auditors out, and what separates candidates who pass from those who do not.
- Is AAIA worth it? Who should take itIs ISACA AAIA worth taking? Who benefits, what it costs including the CISA requirement, and when a different AI credential fits better.