AAISM renewal and retake rules

AAISM is maintained, not retaken. ISACA asks holders for a minimum of 10 CPE hours a year and 30 over a three-year period, plus an annual fee of US$20 for members or US$35 for non-members, due by 1 January. Those numbers are a third of the 20 and 120 hours that CISM carries, which is the first thing that surprises people who assume an advanced credential is heavier to keep. If you fail the exam instead, ISACA allows four attempts in a rolling 12 months, with 30 and 90 day waits. All figures below come from ISACA’s AAISM maintenance page and the AAISM exam candidate guide (version 1.26).

How AAISM maintenance compares with CISM

CISM figures are from ISACA’s CISM maintenance page. The AAISM page also says one payment covers all your ISACA Advanced certifications, and that CPE hours can count toward several ISACA certifications when the activity fits each one’s knowledge area. The CISM page adds a reduced fee for a third and later certification (US$25 for members). Whether that reduction applies to the AAISM fee is not stated on the AAISM page, so confirm before you budget around it.

For the sibling AI credentials, AAIA and AAIR, check their own maintenance pages: this page does not assume their hours match. See AAIA and AAIR.

The rule that makes two credentials into one dependency

To maintain AAISM you must submit proof of an active CISM or CISSP. That means a CISM lapse is not only a CISM problem. Plan the calendar so your base credential’s CPE and fees are never behind the AAISM ones. If your base is CISSP, the continuing-education rules are ISC2’s and are not covered by ISACA’s pages; ISACA’s pages here do not state them, so read ISC2’s own policy.

CPE hours should be relevant to AAISM knowledge or tasks and must be reported each year. Because the three-year minimum is only 30, a holder who does the annual 10 will be exactly at the line. Banking extra hours in a strong year is a sensible cushion.

What an audit asks for

ISACA can select holders for a CPE audit. If selected, you provide documentation for all reported activities from a specific calendar year. Keep records for 12 months after each three-year reporting cycle ends, each showing attendee, sponsor, title, description, date and hours. One oddity: the audit paragraph on the AAISM maintenance page refers to revocation of a CISA certification, which looks like a copy error. Treat the rule as applying to AAISM and confirm with ISACA if it matters.

What happens if AAISM is revoked

Not meeting the requirements leads to revocation of the AAISM designation. The holder can no longer present themselves as certified. The route back is a written appeal to the AAISM Working Group via ISACA’s Customer Experience Center, with an explanation and CPE documentation from the revocation period to the present. If approved, you pay outstanding fees plus a US$50 reinstatement fee. If denied, you must pass the exam again and reapply with appropriate experience. ISACA also offers Non-Practicing and Retired statuses to qualifying holders; the page does not give the criteria in detail.

If you have not passed yet: the clock before the credential

Passing the exam does not make you certified. Per the candidate guide:

• Registration gives you six months to sit the exam. Fees are nonrefundable and nontransferable and are forfeited if you miss that period, miss the appointment or arrive more than 15 minutes late.
• A six-month extension costs US$75.
• Rescheduling is free at least 48 hours before the appointment.
• After passing you have five years to apply, paying the US$50 application fee. Someone who passed cannot sit the same exam again within that application period.

Retakes: four attempts, two long waits

All four must fall inside a rolling 12-month period from the first attempt, and the full registration fee (US$459 member, US$599 non-member) is paid each time. Practically, a candidate who fails twice should assume the fourth attempt is the last of the year.

The same guide states that results show as preliminary pass or fail on screen, official scores arrive within 10 working days, and scores use a 200 to 800 scale with 450 needed to pass. The exam is 90 questions in 150 minutes. A rescore request must be submitted in writing within 30 days of results and costs US$75; rescores are done by the test provider. Special accommodation requests must be approved before scheduling, submitted no later than four weeks before the preferred date, and are valid for one sitting only.

ISACA states that it does not reissue scores because of later question updates. For how ISACA-wide rules differ from other vendors, see certification costs and exam changes. The career page covers what to do with the credential once held, and exam format has the fees in context.