AAIR
AAIR: Advanced in AI Risk
Everything you need for ISACA AAIR: exam format, the three domains and weights, eligibility, a study plan and free sample questions.
- Questions
- 90
- Domains
- 3
- Largest domain
- 42%
- Exam fee
- $459 member
AAIR — ISACA Advanced in AI Risk — validates the ability to evaluate AI-related vulnerabilities, assess opportunities and impacts, and manage the whole AI risk lifecycle. It is the third of ISACA’s AI credentials, alongside AAISM for security managers and AAIA for auditors, and it is aimed at risk professionals.
Like its siblings it sits on top of an existing designation, but its eligibility list is the broadest of the three: CISA, CISM, CRISC, CGEIT and CDPSE all qualify, as do CRMP, CIA, CISSP, several CPA designations, CGMA, ACCA and PMI-RMP. If you hold a recognised risk, audit, security or accounting credential, you are probably eligible.
What the exam covers
| Domain | Weight |
|---|---|
| AI Risk Governance and Framework Integration | 37% |
| AI Life Cycle Risk Management | 21% |
| AI Risk Program Management | 42% |
Ninety questions. The distribution is worth studying before you study anything else: risk programme management is the largest domain at 42%, governance is 37%, and the lifecycle domain — the most technical-sounding of the three — is the smallest at 21%.
That shape tells you what AAIR actually is. It is not a technical AI exam with risk framing. It is a risk management exam where the asset happens to be AI: scenario identification, treatment strategies, controls management, metrics and reporting, supply chain, and incident response together account for well over half the paper once you add the governance domain.
Where to start
Check eligibility — the list is long, and you may already qualify without realising. Then the exam format, and how AAIR differs from CRISC if you hold ISACA’s general risk credential.
AAIR guides
- AAIR exam format: questions, score and costThe ISACA AAIR format: 90 questions across three domains weighted 37, 21 and 42 per cent, fees, eligibility and the two deadlines that catch people out.
- AAIR vs CRISC: how they differCRISC is one route into AAIR, not a competitor. What AAIR adds for risk professionals, what transfers, and how much new study it really needs.
- AAIR study plan: pass in 6 weeksA six-week AAIR study plan weighted to ISACA's domains, concentrating on risk programme management and governance rather than the smaller lifecycle domain.
- Free AAIR sample questions with answersFive free ISACA AAIR practice questions across the three domains, written in ISACA's BEST and FIRST style, each with an explained answer.
- AAIR AI risk governance and frameworksThe AAIR governance domain explained: AI models and use cases, organisational alignment, ownership and accountability, policy, regulation, ethics and ESG.
- AAIR AI life cycle risk managementThe smallest AAIR domain explained: risk in AI design and procurement, training, validation, implementation, decommissioning and data management.
- AAIR AI risk program managementThe largest AAIR domain explained: AI risk scenarios, treatment, controls management, metrics, monitoring, supply chain and incident response.
- AAIR prerequisites: which certifications qualifyAAIR requires a recognised designation, but the list is broad: CISA, CISM, CRISC, CGEIT, CDPSE, CISSP, CIA, CPA, ACCA, PMI-RMP and more.
- Is AAIR hard? Exam difficulty explainedHow hard ISACA AAIR really is: why it is a risk exam rather than a technical one, and the ISACA reflexes that decide whether you pass.
- Is AAIR worth it? Who should take itIs ISACA AAIR worth taking? Who benefits, what it costs, and how to choose between AAIR, AAISM and AAIA.