AAIR study scenarios: three risk profiles

For AAIR the planning question is how much of the risk method you already own, because 79% of the exam is risk discipline applied to AI. ISACA’s three domains are AI Risk Program Management (42%), AI Risk Governance and Framework Integration (37%) and AI Life Cycle Risk Management (21%), across 90 questions. ISACA’s AAIR pages do not publish the duration or passing score, so any figure quoted elsewhere should be checked. The eligibility list is the broadest of ISACA’s AI credentials, which means the candidates who sit it come from very different backgrounds.

Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.

The CRISC holder who runs an enterprise risk register

Starting point. This profile identifies scenarios, assesses likelihood and impact, selects treatments and reports metrics as daily work. Acceptance, transfer, mitigation and avoidance are second nature. AI is the new asset class, not the new method.

Where the time goes. On the AI-specific content inside familiar disciplines: the AI threat catalogue and the lifecycle stage each threat targets, thresholds expressed as measurements such as accuracy or fairness disparity, supply chain risk from model providers and third-party datasets, and what incident response means when behaviour lives in weights. That is domain 3 of the blueprint (42%), plus a light pass through lifecycle (21%).

The trap. Over-reliance on existing frameworks. Candidates who recite the register process give generic answers where the question asks what changes for a model, such as drift forcing monitoring to be mandatory.

Suggested order. Governance and framework integration, a short lifecycle block, then programme management, then practice. Revising programme management twice is better than a long lifecycle study.

Planning assumption. Using the site’s study plan, a reasonable assumption is the full six weeks at 6 to 8 hours (36 to 48 hours), with about 12 to 16 hours on programme management and fewer on lifecycle. It is a planning figure, not a promise.

The CISSP security practitioner who is strong on technology

Starting point. This profile knows architecture, controls and incident handling, and probably reads model-security material with ease. Risk language is familiar but the practice of building a risk programme, with owners, appetite and reporting, may be less central to the job.

Where the time goes. The lifecycle domain (21%) is the comfortable one and needs the least attention. The hours belong to domain 1 on governance and framework integration (37%): policies, procedures and training, regulatory and legal considerations, accountability and oversight, plus trustworthiness, ethics and ESG, which is distinctive to this exam. Programme management (42%) needs attention to treatment decisions and metrics.

The trap. Reaching for a control. ISACA’s “FIRST” and “BEST” questions often turn on a step the scenario skipped, such as identification or assessment, and a documented, owned, in-threshold acceptance is frequently the right answer. A technologist who always implements a control loses marks.

Suggested order. Governance first, because it is least familiar, then programme management, then lifecycle as a confirmation pass.

Planning assumption. Six weeks at 6 to 8 hours a week is a reasonable assumption, with the lifecycle week shortened and the time moved to governance.

The CPA or compliance professional who is new to AI

Starting point. This profile works in compliance or finance and qualifies through a designation on the broad eligibility list, such as a CPA, CIA or ACCA. It is comfortable with policies, controls and evidence but has limited exposure to how models are trained, validated or retired.

Where the time goes. The lifecycle domain (21%) is here the biggest relative gap, even though it is the smallest domain: design, development or procurement, training, testing and validation, implementation, maintenance and decommissioning, and data and asset management. Without that literacy the programme and governance scenarios stay abstract. The rest of the time goes to programme management (42%), where metrics and incident response are new in AI form.

The trap. Concluding from the 21% weight that the lifecycle can be skipped. It cannot, because scenarios in the other two domains presuppose that you know what validation does and does not demonstrate.

Suggested order. Models, frameworks and use cases in governance, then the lifecycle, then governance policy and law, then programme management.

Planning assumption. Seven to eight weeks at 6 to 8 hours a week is a reasonable assumption, with about double the lifecycle time of the plan.

The three AAIR profiles compared

How to check which AAIR profile fits before booking

Confirm your designation on the prerequisites list first, then run the sample questions and sort the misses by domain. The practice test will tell you whether governance, lifecycle or programme management is the weakest. The exam format page explains the two deadlines, six months to sit and five years to apply, and the 6-week study plan gives the hour split these profiles adapt. If you already hold CRISC, AAIR vs CRISC shows the delta, and the AAIA hub covers the audit-side credential.