AAIA (ISACA Advanced in AI Audit) is ISACA’s AI audit certification for experienced IT auditors and advisors, and it’s only open to people who hold an active CISA or one of a list of audit and accounting credentials, such as the CIA or a CPA, with an IT audit or IT advisory focus. The exam is 90 multiple-choice questions in 2.5 hours, you need 450 on ISACA’s 200 to 800 scale to pass, and it costs $459 for ISACA members or $599 for non-members, plus a $50 application fee once you pass.
This guide covers the full eligibility list, ISACA’s three domains and 17 subdomains (labeled as ISACA’s published outline), how to study each, a six-week plan using ISACA’s own prep resources, and how AAIA compares with ISACA’s other AI credentials and IAPP’s AIGP.
AAIA at a glance
| Credential | ISACA Advanced in AI Audit (AAIA) |
| Certifying body | ISACA |
| Who can take it | Active CISA holders, or holders of a listed audit or accounting credential (such as the CIA or a CPA) with an IT audit or IT advisory role focus |
| Exam fee | $459 for ISACA members, $599 for non-members |
| Application fee | $50, one time, paid after you pass when you apply for certification |
| Questions | 90 multiple choice, each with four options and one best answer |
| Time | 2.5 hours (150 minutes) |
| Passing score | 450 on a scale of 200 to 800 |
| Domains | AI Governance and Risk 33%, AI Operations 46%, AI Auditing Tools and Techniques 21% |
| Delivery | PSI test center or remote proctoring (test centers only for residents of India, Mainland China and Hong Kong) |
| Languages | English, Simplified Chinese and Spanish |
| Booking window | Six months from registration |
| Retakes | Up to four attempts in a rolling 12 months, with waits of 30, 90 and 90 days; full fee each time |
| Apply within | Five years of passing the exam |
| Maintenance | 10 CPE hours in AI a year (30 over three years), a $20 or $35 annual fee, and an active prerequisite |
| Announced | May 19, 2025 |
Checked against ISACA’s AAIA certification page, AAIA exam content outline, AAIA exam candidate guide, Get AAIA Certified page and AAIA maintenance page on October 15, 2026.
Get an email when the ISACA Advanced in AI Audit (AAIA) exam changes
We check the official exam pages every day. If the price, version, format or retirement date changes, you’ll get a short email. At most one a week, plus the HOW TO // AI newsletter on Thursdays.
Unsubscribe anytime. Privacy policy.
Who can take the AAIA? The eligibility rule
You need one of these credentials before you register. Every active CISA holder qualifies. Holders of the others qualify only if they work in an IT audit or IT advisory role:
- CIA (Certified Internal Auditor), from the Institute of Internal Auditors
- US CPA, from a US state board of accountancy
- ACCA or FCCA, from the Association of Chartered Certified Accountants
- Australian CPA or FCPA, from CPA Australia
- Japanese CPA, from the Japan Financial Services Agency
- Canadian CPA (Chartered Professional Accountant), from the Canadian provincial accounting bodies
- ICAEW ACA or FCA, from the Institute of Chartered Accountants in England and Wales
- CNA (Certified National Accountant), from the Association of National Accountants of Nigeria
- CA or FCA, from Chartered Accountants Australia and New Zealand
- Hong Kong CPA or FCPA, from the Hong Kong Institute of Certified Public Accountants
ISACA’s May 2025 launch announcement named only CISA, CIA and CPA holders, and ISACA has since noted that the prerequisites were updated, so older articles may be out of date. The credential also has to stay active: ISACA’s maintenance rules require you to keep the prerequisite you applied with in active status for as long as you hold the AAIA.
If you don’t hold any of these yet, ISACA’s AAIA page points you to the CISA first. You can still learn the material: ISACA says its AAIA virtual workshop is open to all IT auditors.
Who the AAIA is for
ISACA aims the AAIA at experienced IT auditors and advisors, and at people who assess, implement, maintain or audit AI systems. Its candidate guide says it’s for IT audit professionals who want recognition for assuring that AI-driven processes meet high industry standards, and ISACA calls it the world’s first advanced AI audit certification.
It’s an audit credential, not a data science one. Of the 23 supporting tasks in ISACA’s outline, 21 start with the word “evaluate”, so expect to judge whether an organization governs, operates and controls its AI well, not to build a model.
The three AAIA domains at a glance
| Domain (ISACA’s published outline) | Weight | About how many of 90 questions | Subdomains |
|---|---|---|---|
| 1. AI Governance and Risk | 33% | 30 | 5 |
| 2. AI Operations | 46% | 41 | 7 |
| 3. AI Auditing Tools and Techniques | 21% | 19 | 5 |
The question counts are our math on ISACA’s percentages. ISACA’s candidate guide says the exam includes unscored pretest items and that your score is based on the total number of questions you get right, regardless of domain, so you can’t skip one. The outline in the candidate guide is dated June 2025.
ISACA also lists 23 supporting tasks as one set rather than by domain. Below, we’ve grouped each under the domain where it fits best; that grouping is ours.
Domain 1: AI Governance and Risk (33%)
ISACA describes this domain as advising stakeholders on AI solutions that meet the organization’s strategic goals, creating ethical and responsible AI policy and governance practices, and mitigating implementation risk, including leading practices in data governance, privacy and security.
What the outline lists:
- 1A AI models, considerations and requirements
- 1B AI governance and program management
- 1C AI risk management
- 1D Privacy and data governance programs
- 1E Leading practices, ethics, regulations and standards for AI
Related tasks from ISACA’s list: advise on the impact, opportunities and risk of AI solutions; evaluate AI decision-making systems and AI’s effect on people, systems and the environment; evaluate AI policies, including legal and regulatory compliance; check that ownership of AI risk, controls and decisions is defined; evaluate data governance and privacy programs for AI; advise on AI’s workforce impact; and check that awareness programs match AI policy.
How to study it: if you hold a CISA, governance audits are familiar; the subject is what’s new. Start with 1A, because the rest assumes you know, at a conceptual level, how a model is trained, validated and used. ISACA’s outline mentions regulations and standards without naming any, so get comfortable with widely used references such as the NIST AI Risk Management Framework, ISO/IEC 42001 and the AI laws where you work, and practice turning them into audit criteria. Then audit a real artifact: list the evidence that would show an AI acceptable-use policy is followed, and check that every system in an AI inventory has a named owner. Our guides to an AI acceptable-use policy, building an AI inventory, mapping SOX and privacy obligations for AI and a lightweight AI council show what good looks like from the other side of the table.
Domain 2: AI Operations (46%)
The largest domain, worth almost half the exam. ISACA describes it as assessing the organization’s risk profile and the rewards and consequences of AI implementations, while making sure the organization is operationally ready to adopt AI.
What the outline lists:
- 2A Data management specific to AI
- 2B AI solution development methodologies and lifecycle
- 2C Change management specific to AI
- 2D Supervision of AI solutions (for example, outputs, impacts and decisions)
- 2E Testing techniques for AI solutions
- 2F Threats and vulnerabilities specific to AI
- 2G Incident response management specific to AI
Related tasks from ISACA’s list: evaluate AI data inputs (appropriateness, bias, privacy); check AI requirements against the enterprise architecture; evaluate the AI lifecycle from design to decommissioning; check that models align with business objectives and policy; evaluate change, configuration, and identity and access management for AI; evaluate threat, vulnerability, problem and incident management for AI; evaluate AI vendors and supply chains; and evaluate how AI metrics such as KPIs and KRIs are monitored and reported.
How to study it: treat it as a general controls review where the system happens to be an AI model. Walk one AI system through its lifecycle and ask what evidence would show each stage is controlled: where the data came from and who owns its quality, how a model or prompt change gets approved, who can reach the model, how outputs are watched in production, and what happens when it gives a wrong answer. For 2E and 2F, learn the vocabulary of AI testing (validation, bias and adversarial testing) and the main attacks on AI systems, such as prompt injection and data poisoning. Public catalogs like MITRE ATLAS and the OWASP Top 10 for LLM applications help, though ISACA doesn’t name either. Our posts on who should own data quality, identity as your AI control plane, logging what AI assistants do and AI questions for vendor reviews cover the controls you’ll be testing, and why AI makes things up explains what output supervision is meant to catch.
Domain 3: AI Auditing Tools and Techniques (21%)
The smallest domain, but the one that makes this an audit credential. ISACA describes it as optimizing audit outcomes through innovation: knowing audit techniques tailored to AI systems, and using AI-enabled tools to make audits more efficient and deliver faster, quality insight.
What the outline lists:
- 3A Audit planning and design
- 3B Audit testing and sampling methodologies
- 3C Audit evidence collection techniques
- 3D Audit data quality and data analytics
- 3E AI audit outputs and reports
Related tasks from ISACA’s list: evaluate the design and effectiveness of controls specific to AI; evaluate the impacts, opportunities and risks of bringing AI into the audit process; and use AI solutions to improve audit planning, execution and reporting.
How to study it: two skills show up here. The first is auditing AI: scoping from an AI inventory and risk assessment, sampling when outputs vary from run to run, deciding what counts as sufficient evidence (model documentation, validation results, change records, access reviews, output logs) and writing findings an audit committee can act on. The second is auditing with AI: where an AI tool can speed up planning, testing or reporting, and what risks it adds, such as confidential data leaving your environment or an unchecked AI summary in a workpaper. Our two-hour shadow AI review using your own logs is a realistic evidence exercise, and our AI fact-check workflow is a good habit for AI-assisted workpapers.
How AAIA questions work
ISACA’s candidate guide says every question has a stem and four options with one best answer, and some questions turn on a qualifier such as MOST likely or BEST. Its tips: read each question carefully, eliminate the answers you know are wrong, and answer every question, because there’s no penalty for a wrong answer and your grade is based only on how many you get right. With 90 questions in 150 minutes, you have about 100 seconds per question.
Our advice, not ISACA’s: read each option as an auditor. When two answers both look right, the better one usually keeps you evaluating and recommending rather than running the control yourself, and fixes the governance gap before the technical symptom.
A study plan for the AAIA
None of ISACA’s prep products is required; eligibility depends only on holding a qualifying credential. ISACA’s official AAIA resources are:
- AAIA Review Manual, in digital and print versions.
- AAIA Questions, Answers and Explanations (QAE) Database: a six-month subscription to 200+ practice questions.
- AAIA Online Review Course, with on-demand instruction.
- AAIA Virtual Workshop: a live event over two 8-hour days or four 4-hour days, worth up to 16 CPE. ISACA says enrollment includes the review manual eBook, the QAE database and the exam itself.
- Free AAIA practice quiz: 12 questions from ISACA’s test prep. You fill in a form to see your results.
- Engage AAIA study groups: a free online forum for ISACA members.
If AI itself is new to you, ISACA’s AI training path for IT auditors starts with its AI Fundamentals course, then Introduction to AI for Auditors and Auditing Generative AI. None of these is required.
We don’t have AAIA practice questions in HOW TO // AI CERT. For free warm-up practice on general AI concepts, our free AI practice exams cover related entry-level exams such as the AWS Certified AI Practitioner, but they won’t mirror ISACA’s audit-focused questions.
A six-week plan (about 42 hours): ISACA doesn’t publish recommended study hours, so this pacing is our suggestion for someone who already holds a CISA or similar. Domain 2 gets two weeks because it’s 46% of the exam.
| Week | Focus | Hours |
|---|---|---|
| 1 | Take ISACA’s free quiz cold, read the outline and all 23 tasks, and fill gaps in AI basics (1A) | 7 |
| 2 | Domain 1: governance, risk, privacy and data governance, ethics and standards (1B to 1E) | 7 |
| 3 | Domain 2, part one: data management, development lifecycle and change management (2A to 2C) | 7 |
| 4 | Domain 2, part two: output supervision, testing, threats and incident response (2D to 2G) | 7 |
| 5 | Domain 3: planning, sampling, evidence, analytics and reporting, plus using AI in audits | 7 |
| 6 | Timed practice with ISACA’s QAE at about 100 seconds per question, then your weakest subdomains | 7 |
Register when you start studying if a deadline helps: you have six months from registration to sit the exam, and appointments open up to 90 days ahead. ISACA’s candidate guide mentions a one-time six-month extension for $75 in one section but says no extensions are allowed in another, so don’t count on one.
Exam day
- You can book as early as 48 hours after paying and reschedule free up to 48 hours before. Missing the appointment or arriving more than 15 minutes late forfeits the fee.
- At a test center, arrive 30 minutes early with one original government ID showing your registered name, signature and photo.
- One break of up to 10 minutes is allowed with the proctor’s permission, but the timer keeps running. No food or drinks, including water, at a test center or at home.
- Online exams need a room scan and a mirror or phone check of your screen and keyboard, and you can only chat with remote proctors in English.
- You see a preliminary pass or fail on screen. The official score arrives by email within 10 working days, and if you don’t pass you can request a rescore within 30 days for $75.
- If you need another attempt, you get four in a rolling 12 months, with waits of 30, 90 and 90 days and the full fee each time.
After you pass: applying for and keeping the AAIA
To be certified, you pay the $50 application processing fee once your official score is released and submit the application within five years of passing. You also agree to ISACA’s Code of Professional Ethics and CPE policy, and the candidate guide adds compliance with ISACA’s Information Systems Auditing Standards.
To keep it, report at least 10 CPE hours in AI every year, starting the calendar year after you’re certified, and 30 over each three-year period; ISACA says the hours may also count toward your other ISACA certifications if they meet those requirements. The annual fee is $20 for members or $35 for non-members, due January 1, and the AAIA maintenance page says one fee covers all your ISACA Advanced certifications (AAIR’s own page lists a higher fee, so check if you’ll hold both). You also need to keep your prerequisite active, and keep CPE records for three years in case you’re picked for ISACA’s annual CPE audit.
Our guide to AI certification renewal rules compares AAIA’s upkeep with other AI credentials, and the free renewal tracker keeps your CPE dates in one place.
AAIA vs AAISM, AAIR, AAIG and the AIGP
ISACA now has four Advanced AI credentials, and the biggest difference between them is who’s allowed in.
| Credential | Who can take it | Exam fee | Domains (ISACA’s published outlines) | Annual maintenance fee |
|---|---|---|---|---|
| ISACA AAIA (AI audit) | Active CISA, or a listed audit or accounting credential with an IT audit or advisory focus | $459 members, $599 non-members, plus $50 application fee | AI Governance and Risk 33%, AI Operations 46%, AI Auditing Tools and Techniques 21% | $20 members, $35 non-members |
| ISACA AAISM (AI security) | Active CISM or CISSP | $459 members, $599 non-members, plus $50 application fee | AI Governance and Program Management 31%, AI Risk Management 31%, AI Technologies and Controls 38% | $20 members, $35 non-members |
| ISACA AAIR (AI risk) | One of a long list, including CISA, CISM, CRISC, CISSP, CIA, CPA and PMI-RMP | $459 members, $599 non-members, plus $50 application fee | AI Risk Governance and Framework Integration 37%, AI Life Cycle Risk Management 21%, AI Risk Program Management 42% | $45 members, $85 non-members |
| ISACA AAIG (AI governance, beta) | Active CGEIT, or six years of enterprise governance experience including at least one in AI | Beta exam $399, including the review manual eBook | Practice areas: AI Enterprise Governance; Data and AI Architecture Principles; AI Enterprise Integration and Performance Monitoring | Not published |
Pick by the job you do. Auditors belong on the AAIA. Security managers with a CISM or CISSP should look at the AAISM (see our AAISM study guide and AAISM cost breakdown). Risk professionals fit the AAIR, which also accepts CISA, so a CISA holder in a risk role could qualify for either. AAIG is still in beta.
IAPP’s AIGP is the main AI governance credential outside ISACA. It comes from IAPP, the privacy professionals’ association, so it suits roles that lean toward policy, privacy and legal compliance more than assurance. Our AIGP study guide and AIGP cost guide cover its format and fees, and our AI governance certifications guide compares them all. For every AI credential in one place, see the AI certification index or our ranking of the best AI certifications in 2026.
Is the AAIA worth it?
For the right person, yes. If you already hold a CISA and AI systems are showing up in your audit plan, the AAIA is a recognized way to show you can audit them, built on a credential you maintain anyway. Exam plus application fee comes to $509 for ISACA members or $649 for non-members before prep, plus $20 or $35 a year.
It’s less clear-cut in three cases. Without a qualifying credential, it isn’t open to you yet. If your job is security, risk or governance rather than audit, the AAISM, AAIR or AIGP fits better. And if you want hands-on AI skills, this tests judgment about governance, operations and audit evidence, not building models. The AAIA was announced in May 2025, so it lacks the CISA’s long track record; weigh it by how much AI is in your audit plan. We don’t make salary claims for it; our take on whether AI certifications increase salary explains why.
Want the full cost including prep and renewals? Try the AI certification cost calculator →
HOW TO // AI is not affiliated with or endorsed by ISACA. AAIA, Advanced in AI Audit, AAISM, AAIR, AAIG, CISA, CISM, CRISC, CGEIT and CDPSE are marks of ISACA, and the other credentials named here belong to their owners; we reference them descriptively. This guide is original and based on ISACA’s published exam content outline and candidate guide; we do not reproduce or reveal real exam questions. Check the official AAIA page before you register.
Related guides
- AAISM Study Guide: ISACA’s AI Security Management Exam, Domain by Domain
- AI Governance Certifications in 2026: Every Real Option Compared
- AIGP Study Guide: The IAPP AI Governance Exam, Domain by Domain
- AI Security Certifications in 2026: SecAI+, AAISM, GIAC and More
- AI Acceptable Use Policy Template: Free Download, Examples and a 30-Day Plan
Frequently asked questions
What is the ISACA AAIA certification?
AAIA (ISACA Advanced in AI Audit) is ISACA's certification for experienced IT auditors and advisors who audit or advise on AI systems. ISACA announced it in May 2025, and its exam covers AI governance and risk, AI operations, and AI auditing tools and techniques.
Do I need a CISA to take the AAIA?
Not necessarily. Every active CISA holder qualifies, and holders of a listed credential such as the CIA, a US, Canadian, Australian, Japanese or Hong Kong CPA, ACCA, ICAEW, CNA or CA ANZ also qualify if they work in an IT audit or IT advisory role. You must keep that credential active to keep the AAIA.
How much does the AAIA exam cost?
The AAIA exam costs $459 for ISACA members and $599 for non-members. After you pass you pay a one-time $50 application processing fee, and each retake costs the full exam fee again.
How many questions are on the AAIA exam?
The AAIA exam has 90 multiple-choice questions in 2.5 hours (150 minutes). Each question has four options and one best answer, and you can take it at a PSI test center or with remote proctoring.
What is the AAIA passing score?
You need a scaled score of 450 on ISACA's scale of 200 to 800. Your score is based on the total number of questions you answer correctly, not on each domain separately, and unscored pretest items don't count.
What are the AAIA exam domains?
ISACA's published outline has three: AI Governance and Risk (33%), AI Operations (46%) and AI Auditing Tools and Techniques (21%). They are split into 17 subdomains, and ISACA also lists 23 supporting tasks.
How should I study for the AAIA?
Start with ISACA's exam content outline and its free 12-question practice quiz, then work through the three domains, giving AI Operations the most time because it is 46% of the exam. ISACA's official prep includes a review manual, a 200+ question practice database, an online review course and a virtual workshop.
How do you maintain the AAIA certification?
Report at least 10 CPE hours in AI each year and 30 over three years, pay the annual maintenance fee of $20 for members or $35 for non-members, and keep your CISA or other qualifying credential active.
Should I take the AAIA or the AAISM?
Choose by role and credentials. The AAIA is for IT auditors with a CISA or a qualifying audit or accounting credential, while the AAISM is for security managers with an active CISM or CISSP.
