AAIA course
AAIA free course: Advanced in AI Audit
A free written AAIA course in 13 lessons with diagrams: AI governance and risk, AI operations and audit techniques, in the order of the ISACA outline.
This free written course teaches the AAIA content outline from the ground up, in the order ISACA lists it. Each lesson takes about five to seven minutes to read, builds one idea with a diagram or a worked example, and ends with three check questions. No account is needed. It is independent study material and is not affiliated with or endorsed by ISACA.
ISACA publishes the outline as subtopic headings and task statements, not as detailed content, so the lessons teach each heading with established professional knowledge applied to AI, and use frameworks and regulations as examples a practitioner works with. The three domains map to the lessons like this:
| Lessons | Domain | Weight |
|---|---|---|
| 1 to 4 | AI Governance and Risk | 33% |
| 5 to 9 | AI Operations | 46% |
| 10 to 12 | AI Auditing Tools and Techniques | 21% |
| 13 | All three together: how scenario questions are built | – |
How to use the course
Read the lessons in order the first time. AI operations is nearly half of the exam and the audit lessons reuse its vocabulary: data lineage, change control, validation evidence and incident handling come back in almost every scenario. After a lesson, answer its check questions before reading the next one.
When the order is clear, use the other guides for what a course cannot do. The exam format page explains the 90 questions and how ISACA questions read. The study plan spreads the work over six weeks. The cheat sheet is the page to reread the day before. The free practice test and sample questions show how scenario questions read.
Lessons
- What AI auditing isHow auditing AI differs from auditing classic IT, how the three AAIA domains are weighted 33/46/21, and what to understand about a model before testing.
- AI governance programmeHow an AI governance programme should work: charters, roles, ownership of AI risk, strategy alignment and an AI inventory, and what an auditor checks.
- AI risk, privacy, dataAI risk assessment, risk appetite and impact assessments, plus privacy obligations and data governance for AI, taught from the auditor's point of view.
- Ethics, laws, standardsResponsible AI principles, bias, transparency and explainability, and how the EU AI Act, NIST AI RMF and ISO/IEC 42001 differ as audit criteria.
- Data management for AIData sourcing, quality, labelling, lineage, bias, dataset splits and retention for AI, and the evidence an auditor asks for at each point of the pipeline.
- AI development lifecycleThe AI solution lifecycle from requirements to retirement: stage gates, MLOps basics, documentation, model cards and the audit checkpoint for each stage.
- Change and supervisionLearn how model, data, prompt and provider changes escape normal change control, and how an auditor tests whether human oversight of AI is real.
- Testing AI solutionsLearn what validation, accuracy metrics, robustness, fairness and red-team testing prove about an AI model, and what evidence an auditor should request.
- Threats and incidentsUnderstand poisoning, prompt injection, extraction and adversarial input, then how AI incidents are handled and what an auditor tests in that process.
- Audit planning and designApply the audit process to AI: risk-based scoping, objectives and criteria, skills and specialists, and an audit programme for an AI system.
- Sampling and evidenceHow to sample AI outputs, judge evidence reliability and gather assurance over vendors and black-box models when internals cannot be inspected.
- Analytics and reportingAudit data quality, analytics, AI-enabled audit tools and their risks, plus how to write rated findings and report AI audit results to the audit committee.
- Worked scenariosThree AAIA-style scenarios across all domains, a method to read the role and stage, and a table mapping situations to the first auditor action.