AAIA vs CISA: how they differ

CISA and AAIA are not alternatives. CISA — or a qualifying equivalent — is the eligibility requirement for AAIA. You hold one, then you add the other.

So the real question is what AAIA adds, and the answer is more than most CISA holders expect.

The relationship

CISA establishes that you can plan, execute and report an audit and form a defensible opinion. AAIA asks whether you can do that when the thing you are auditing behaves probabilistically, derives its logic from data rather than code, and can change without a deployment.

What transfers completely

Your audit method. All of it:

• Planning and scoping
• Sampling methodology
• Evidence collection and evaluation
• Data quality and analytics
• Reporting and communicating findings

That is AAIA’s third domain — AI Auditing Tools and Techniques — and it is the smallest at 21%. ISACA is explicitly not re-testing your audit discipline. It is checking you can apply it to a new subject.

What is genuinely new

AI Operations, 46% of the exam. Nearly half, and almost none of it is audit method:

• Data management specific to AI
• AI solution development methodologies and lifecycle
• Change management specific to AI
• Supervision of AI solutions — outputs, impacts and decisions
• Testing techniques for AI solutions
• Threats and vulnerabilities specific to AI
• Incident response specific to AI

Two items there deserve emphasis. Change management for AI is not change management as you know it: a model can change behaviour through retraining, through a provider updating a hosted model, or through drift as the world moves — none of which appear in a change advisory board record. Testing techniques for AI is not test-of-controls: you cannot verify a model by re-performing it, so evidence comes from validation results, evaluation metrics and monitoring records.

AI Governance and Risk, 33%. Familiar governance discipline with AI-specific content: AI models and their requirements, programme management, AI risk management, privacy and data governance, and the ethics, regulations and standards emerging around AI.

The hardest adjustment for an auditor

Evidence.

Auditing a traditional control means inspecting a configuration, re-performing a calculation, or tracing a transaction. None of that works cleanly on a model. You cannot read the weights and conclude anything. Re-performing an inference proves the system responds, not that it is correct.

So AAIA pushes you toward a different evidence set: validation and evaluation results, data provenance records, monitoring output over time, approval and oversight records, and documented testing against defined thresholds. Learning what constitutes sufficient, appropriate evidence for an AI system is the core intellectual work of this credential.

How much new study for a CISA holder?

Realistically five to six weeks, with roughly two thirds in the operations domain.

The mistake to avoid is allocating study time by familiarity. The audit domain feels comfortable and is 21%; the operations domain feels foreign and is 46%. Invert your instinct.

Does AAIA replace CISA?

No. Your qualifying designation must remain active, which means two credentials, two CPE obligations and two renewal cycles indefinitely. Factor that in before starting.

Who should add it

CISA holders being asked to give assurance over AI systems — which, in most organisations with an internal audit function, is now or shortly. If you have been handed an AI system to review and found your usual evidence requests did not quite fit, that experience is exactly what this credential addresses.