AAIA exam format: questions, score and cost
Here is what ISACA publishes about the AAIA exam, and what it leaves out.
| Credential | ISACA Advanced in AI Audit (AAIA) |
| Number of questions | 90 |
| Domains | 3 |
| Eligibility | CISA or a qualifying audit/accounting designation |
| Exam fee — ISACA member | US$459 |
| Exam fee — non-member | US$599 |
| Application processing fee | US$50 after passing |
| Eligibility period after registering | 6 months to sit the exam |
| Window to apply after passing | 5 years |
| Duration | Not published on ISACA’s AAIA pages |
| Passing score | Not published on ISACA’s AAIA pages |
Two deadlines, not one
This catches people out. There are two separate clocks:
Six months to sit. Registering gives you a six-month eligibility period to take the exam. Register when you are ready to study, not when you first think about it.
Five years to apply. Passing the exam does not make you certified. You must submit an application, with a US$50 processing fee, and you have five years to do it. A passed exam never converted into a credential is money spent for nothing.
The domain weighting is lopsided
| Domain | Weight | Approx. questions |
|---|---|---|
| AI Governance and Risk | 33% | ~30 |
| AI Operations | 46% | ~41 |
| AI Auditing Tools and Techniques | 21% | ~19 |
Question counts derive from ISACA’s percentages against the 90-question total.
AI Operations is nearly half the exam. Most candidates plan as though an audit credential would weight audit technique heavily. It is the smallest domain, at 21%. The bulk of your study time belongs in operations: data management, the AI development lifecycle, change management, supervising outputs, testing techniques, threats and incident response.
Put differently: this exam tests whether an auditor understands how AI systems actually work. The audit method you bring with you.
How ISACA questions read
The house style is consistent across ISACA credentials:
- Scenario-led, from the perspective of the professional accountable for an opinion.
- BEST, FIRST, MOST qualifiers, usually capitalised. Several answers are defensible; one is right for the stated priority.
- Evidence-oriented. As an audit credential, AAIA leans hard on what you can demonstrate, not what you believe. Questions frequently hinge on what constitutes sufficient, appropriate evidence for an AI system.
If you hold CISA this style is already yours, and it is a real advantage. The adjustment is the subject matter, not the format.
What ISACA does not publish
Neither exam duration nor passing score appears on ISACA’s AAIA pages. Be sceptical of specific figures elsewhere unless they cite ISACA. ISACA has historically used scaled scoring, so calculating how many questions you can afford to miss is the wrong exercise.
What the weighting means for revision
Because operations is 46% and audit technique 21%, the efficient revision order is the opposite of what most auditors’ instincts suggest.
Spend your first and largest block on understanding AI systems as systems: how training data becomes behaviour, what a development lifecycle looks like, what changes when a model is retrained, and what can go wrong. Then map your existing audit method onto it — planning, sampling, evidence, reporting — which is the smallest domain precisely because you already have it.
A useful test while studying: if you cannot explain to a colleague what evidence you would request to verify that a model was validated before release, you are not ready, however strong your audit background.
Maintaining it
AAIA carries continuing professional education requirements, and your qualifying designation must remain active. Confirm the current CPE hours and annual maintenance fee with ISACA before certifying — you will be maintaining two credentials, not one.