AAIA study resources

AAIA tests audit discipline applied to AI, not AI knowledge with an audit flavour. If you already audit IT, the new material is the AI-specific subject matter and it is a four-to-six week exam. If you do not, no resource list will close that gap — the reasoning the questions reward comes from having sat on the other side of a control walkthrough.

Start with the official material

ISACA’s own study material for the certificate. As a newer credential, the official resources are the only ones written directly to the syllabus, and third-party coverage is thin.

The domain weighting. AI Operations carries 46%, AI Governance and Risk 33%, and AI Auditing Tools and Techniques 21%. The operations domain dominates, which surprises people who expect a governance-heavy exam.

Free material worth reading

• The NIST AI Risk Management Framework. The best free structuring of AI risk available, and it gives you vocabulary the exam uses.
• ISO/IEC 42001 if you have access through work. The AI management system standard maps closely onto what the exam considers good governance.
• The EU AI Act’s risk classification approach, even if it does not apply to you directly. It has shaped how the profession talks about high-risk AI systems.

Do not buy these if you must pay personally. The NIST framework alone is free and covers the conceptual ground.

The mindset the exam rewards

This is worth more than any reading list. AAIA questions consistently prefer the answer that:

• An auditor could evidence. A signed policy shows design; completed assessments for systems actually in production show operation.
• Respects segregation of duties. The person who builds a model does not approve its deployment.
• Starts with the inventory. Without a complete list of AI systems and their owners, no assurance about coverage is possible.
• Treats absent ownership as the most serious finding. A production system with no accountable owner outranks incomplete documentation every time.

If those four feel obvious, you are ready. If they feel like arbitrary preferences, that is the gap to close.

Worth paying for

ISACA membership, if you are not already a member — it usually reduces the exam fee enough to offset itself, and gives access to material.

A practice test for diagnosis. The free 20-question test here is weighted to the published domains and will show whether the audit reasoning or the AI content is your weak side.

What to skip

Deep technical AI material. You do not need to train a model. You need to know why a non-deterministic system cannot be assured by testing alone, and what monitoring substitutes for that.

Braindumps, as ever.

General AI ethics writing. Interesting, but the exam asks what an auditor does about it, not whether it matters.

A sensible order

1. Read the syllabus and note that AI Operations is 46%.
2. Work through the official material, weighting towards operations.
3. Read the NIST AI RMF for the governance vocabulary.
4. Take the practice test.
5. Notice whether you lost marks on audit reasoning or AI content, and study accordingly.

Which ISACA certificate?

AAIA is for auditors. If you manage risk, AAIR fits; if you manage security, AAISM. They are siblings, not a sequence — the ISACA AI certification path explains why taking all three signals confusion rather than depth.