AAIR course
AAIR free course: Advanced in AI Risk
A free written AAIR course in 13 lessons with diagrams: AI governance, life cycle risk and risk program management, in the order of the ISACA outline.
This free written course teaches the AAIR content outline from the ground up, in the order ISACA lists it. Each lesson takes about five to seven minutes to read, builds one idea with a diagram or a worked example, and ends with three check questions. No account is needed. It is independent study material and is not affiliated with or endorsed by ISACA.
ISACA publishes the outline as subtopic headings and task statements, not as detailed content, so the lessons teach each heading with standard risk-management knowledge applied to AI, and use frameworks and regulations as examples a risk professional works with. The three domains map to the lessons like this:
| Lessons | Domain | Weight |
|---|---|---|
| 1 to 4 | AI Risk Governance and Framework Integration | 37% |
| 5 to 7 | AI Life Cycle Risk Management | 21% |
| 8 to 12 | AI Risk Program Management | 42% |
| 13 | All three together: how scenario questions are built | – |
How to use the course
Read the lessons in order the first time. The program management lessons are the largest part of the exam and they reuse the vocabulary of the governance lessons: risk appetite, ownership, policy and the AI inventory come back in almost every scenario. After a lesson, answer its check questions before reading the next one.
When the order is clear, use the other guides for what a course cannot do. The exam format page explains the 90 questions and how ISACA questions read. The study plan spreads the work over six weeks. The cheat sheet is the page to reread the day before. The free practice test and sample questions show how scenario questions read.
Lessons
- What makes AI risk differentSee how AI risk differs from classic IT risk, how the AAIR exam is organised in three domains, and what a use-case decision weighs before approval.
- Governance structuresLearn who owns AI risk: roles, board and committee oversight, three lines, and human oversight at critical decision points, with a worked company example.
- Policy, training and regulationWhat belongs in an AI policy, who needs training, and how laws, standards and frameworks differ, using EU AI Act tiers, NIST AI RMF and ISO 42001.
- Trustworthiness and ethicsTurn bias, transparency, privacy, safety and ESG concerns into AI risk statements and controls, under the AAIR trustworthiness subtopic (1F).
- AI life cycle and designWalk the AI life cycle stage by stage and see which risks arise at design and procurement, and why documentation matters, for AAIR subtopic 2A.
- Testing and operationLearn risks in AI model training, validation, deployment, drift, change management and decommissioning, covering AAIR subtopics 2B and 2C.
- Data and asset managementSee how data quality, provenance, an AI inventory, access, retention and disposal reduce AI risk, as covered by AAIR subtopic 2D.
- AI risk scenarios and assessmentLearn to build an AI risk scenario from threat, vulnerability and asset, rate likelihood and impact, and choose qualitative or quantitative analysis.
- Risk treatment and controlsHow to compare an AI risk with tolerance, pick mitigate, transfer, avoid or accept, then evaluate, select and validate controls and log the result.
- Metrics, monitoring and reportingLearn to define AI key risk indicators with thresholds, set up continuous monitoring and report AI risk to operations, management and the board.
- Third-party AI riskAssess AI supply chain risk: vetting third-party models, APIs and data, writing data-usage and IP contract clauses, and spotting concentration.
- Incidents and continuityPlan for AI incidents and outages: how AI incident response differs, how a BIA ranks AI-dependent processes, and how BCP and DRP cover model failures.
- Putting it togetherApply the AAIR course: three cross-domain AI risk scenarios, a situation-domain-first-action table, and a method for reading scenario questions.