AAIA exam format: questions, score and cost
Here is what ISACA publishes about the AAIA exam, and what it leaves out.
| Credential | ISACA Advanced in AI Audit (AAIA) |
| Number of questions | 90 |
| Domains | 3 |
| Eligibility | CISA or a qualifying audit/accounting designation |
| Exam fee — ISACA member | US$459 |
| Exam fee — non-member | US$599 |
| Application processing fee | US$50 after passing |
| Eligibility period after registering | 6 months to sit the exam |
| Window to apply after passing | 5 years |
| Duration | 150 minutes (ISACA exam candidate guide) |
| Passing score | 450 on a scaled 200 to 800 range (ISACA exam candidate guide) |
| Languages | English, Simplified Chinese and Spanish (ISACA exam candidate guide) |
| Remote proctoring | You can chat with the remote proctor in English only, even if you sit the exam in another language (ISACA exam candidate guide) |
Two deadlines, not one
This catches people out. There are two separate clocks:
Six months to sit. Registering gives you a six-month eligibility period to take the exam. Register when you are ready to study, not when you first think about it.
Five years to apply. Passing the exam does not make you certified. You must submit an application, with a US$50 processing fee, and you have five years to do it. A passed exam never converted into a credential is money spent for nothing.
The domain weighting is lopsided
| Domain | Weight | Approx. questions |
|---|---|---|
| AI Governance and Risk | 33% | ~30 |
| AI Operations | 46% | ~41 |
| AI Auditing Tools and Techniques | 21% | ~19 |
Question counts derive from ISACA’s percentages against the 90-question total.
AI Operations is nearly half the exam. Most candidates plan as though an audit credential would weight audit technique heavily. It is the smallest domain, at 21%. The bulk of your study time belongs in operations: data management, the AI development lifecycle, change management, supervising outputs, testing techniques, threats and incident response.
Put differently: this exam tests whether an auditor understands how AI systems actually work. The audit method you bring with you.
How ISACA questions read
The house style is consistent across ISACA credentials:
- Scenario-led, from the perspective of the professional accountable for an opinion.
- BEST, FIRST, MOST qualifiers, usually capitalised. Several answers are defensible; one is right for the stated priority.
- Evidence-oriented. As an audit credential, AAIA leans hard on what you can demonstrate, not what you believe. Questions frequently hinge on what constitutes sufficient, appropriate evidence for an AI system.
If you hold CISA this style is already yours, and it is a real advantage. The adjustment is the subject matter, not the format.
Duration and score, from the candidate guide
ISACA’s AAIA web pages do not state the exam length or the pass mark, but its exam candidate guide does: 150 minutes for 90 questions, and a scaled score on a 200 to 800 range in which 450 is a pass. Scaled scoring means the number of questions you can miss is not a fixed figure. Treat figures from other sites with suspicion unless they cite ISACA, and check the current candidate guide before you book.
What the weighting means for revision
Because operations is 46% and audit technique 21%, the efficient revision order is the opposite of what most auditors’ instincts suggest.
Spend your first and largest block on understanding AI systems as systems: how training data becomes behaviour, what a development lifecycle looks like, what changes when a model is retrained, and what can go wrong. Then map your existing audit method onto it — planning, sampling, evidence, reporting — which is the smallest domain precisely because you already have it.
A useful test while studying: if you cannot explain to a colleague what evidence you would request to verify that a model was validated before release, you are not ready, however strong your audit background.
Maintaining it
AAIA carries continuing professional education requirements, and your qualifying designation must remain active. Confirm the current CPE hours and annual maintenance fee with ISACA before certifying — you will be maintaining two credentials, not one.