AAIA study scenarios: three audit profiles
How you should study for AAIA depends on where your audit experience stops and AI begins. The exam has 90 questions, and ISACA’s candidate guide gives 150 minutes and a pass mark of 450 on a scaled 200 to 800 range. Its weights are lopsided: AI Operations is 46%, AI Governance and Risk is 33%, and AI Auditing Tools and Techniques is only 21%. Because every candidate must already hold CISA or a qualifying audit designation held in an IT audit or advisory role, the open question is never audit method; it is which AI topics you are missing.
Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.
The CISA holder with no AI exposure
Starting point. This profile has run IT general control audits and application reviews and holds CISA. It knows sampling, evidence sufficiency and ISACA’s question style. Machine learning, training data and model drift are new vocabulary.
Where the time goes. In AI Operations (46%): data management, the development lifecycle, change management, supervision of outputs, testing techniques, AI-specific threats and incident response. Governance and risk (33%) is second, and the audit domain (21%) is largely a mapping exercise onto method already owned.
The trap. Studying the audit domain first because it feels like home. It is the smallest domain, and time spent there comes at the expense of the part that decides the result.
Suggested order. Governance and risk, then operations in three blocks (data and lifecycle, change and supervision, testing and threats), then audit techniques and practice. This follows the site’s study plan.
Planning assumption. The plan assumes six weeks at 6 to 8 hours a week, which is 36 to 48 hours: roughly 12 to 16 on governance and risk, 18 to 24 on operations, and 6 to 8 on audit techniques and revision. It is a planning figure, not a promise.
The CPA or CIA in IT advisory who does not use ISACA’s style
Starting point. This profile qualifies through an accounting or internal audit designation held in an IT audit or advisory role. Audit principles are solid, but ISACA’s scenario-led BEST, FIRST and MOST questions, and its vocabulary around IT governance, are less familiar than they are for a CISA holder.
Where the time goes. Two places. First, AI Governance and Risk (33%), where inventories, ownership, risk thresholds expressed as measurements and privacy obligations require some IT governance fluency. Second, operations (46%) as for everyone. Question practice matters more here than for the previous profile because the qualifiers are the question.
The trap. Answering from a financial-audit instinct. Questions often hinge on what is sufficient, appropriate evidence for an AI system, such as validation results, monitoring history and approval records, and a candidate who answers from general assurance principles picks the defensible option instead of the best one.
Suggested order. The same domain order as the plan, with practice questions from the first week rather than the sixth, sorted by qualifier.
Planning assumption. Seven to eight weeks at 6 to 8 hours a week is a reasonable assumption, the extra time going to question style and the IT governance parts of domain 1.
The auditor who already reviews analytics and model risk
Starting point. This profile has audited data analytics, model validation or algorithmic decision tools, and has read model documentation. It can describe training and inference and has seen drift reports.
Where the time goes. A diagnostic will usually show that operations is mostly familiar at the technical level, so the gaps are in the audit-specific questions: what evidence to request for a data lineage, how change management must handle a provider updating a hosted model, and how to write findings about a probabilistic system without overstating certainty.
The trap. Complacency in governance and risk (33%). Technical depth does not substitute for programme-level topics such as ownership, approval paths, privacy and data governance, or the regulatory pattern of inventory, impact assessment, human oversight and documentation.
Suggested order. A cold practice exam, then governance and risk, then the operations topics that scored lowest, then audit techniques.
Planning assumption. Three to four weeks at the same weekly hours is a reasonable assumption, with the diagnostic deciding the split.
The three AAIA profiles compared
| Profile | Front-loaded domains | Main risk |
|---|---|---|
| CISA holder, new to AI | Governance and risk, then operations (46%, the largest block) | Starting with the familiar audit domain |
| CPA or CIA in IT advisory | Governance and risk, plus question practice | Answering from general assurance instinct |
| Auditor of analytics models | Governance and risk, then low-scoring operations | Assuming technical depth covers programme topics |
How to check which AAIA profile fits before booking
Run a timed set of sample questions and sort the misses by domain and by qualifier. Check the prerequisites first, because the eligibility gate is absolute, and note the six-month window after registering on the exam format page. A full practice test will show whether operations or governance is weaker. Then use the 6-week study plan as the baseline and stretch or compress it by profile. If you are also considering the security-management credential, the AAISM hub covers its different gate.