What are the prerequisites for the AAIA certification?

You need to hold a qualifying foundational credential with an IT audit or IT advisory focus. Accepted designations include CISA, CIA, US CPA, ACCA or FCCA, Canadian CPA, CPA Australia or FCPA, and the Japanese CPA. An active CISA is the most direct route to AAIA eligibility.

How many questions are on the AAIA exam?

According to ISACA's exam content outline, the AAIA exam consists of 90 multiple-choice questions, each with four possible answers. The questions are scenario-based and test analysis, evaluation, and applied judgment rather than rote recall. Always confirm current details on ISACA's official AAIA pages.

What domains does the AAIA exam cover?

AAIA covers three domains: AI Governance and Risk (33%), AI Operations (46%), and AI Auditing Tools and Techniques (21%). AI Operations is the heaviest domain and spans the full AI lifecycle, from data management and development through testing, threats, and incident response.

What is the difference between AAIA and AAISM?

AAIA is for auditors who verify AI controls and requires a CISA-family prerequisite. AAISM is a security-management credential from ISACA that requires an active CISM or CISSP and focuses on securing and governing AI systems, aimed at managers who set strategy rather than auditors who test it.

Is AAIA worth it for a CISA holder?

For CISA holders whose work increasingly involves auditing AI or machine learning systems, AAIA is a natural specialization. It builds directly on the CISA foundation, requires no separate experience exam, and validates AI-specific audit skills at a time when AI adoption is far outpacing organizational governance.

Does AAIA replace the need for a governance certification like AIGP?

Not necessarily. AAIA focuses on the operational audit side, while the IAPP AIGP focuses on policy, privacy, and regulation such as the EU AI Act. Many professionals combine an ISACA AI specialty like AAIA with AIGP to demonstrate both operational and regulatory expertise.

AAIA Certification: A Guide for AI Auditors

The AAIA certification, short for Advanced in AI Audit, is an ISACA credential built for experienced audit and assurance professionals who need to evaluate, govern, and test artificial intelligence systems. It sits on top of a foundational certification such as CISA and validates specialized skill in auditing AI controls, risk, and operations.

As organizations rush AI into production, auditors are being asked a harder question than ever: can these systems actually be trusted, and can that trust be evidenced? The AAIA certification is ISACA's answer to that gap. It was launched as the first advanced AI audit credential of its kind, and it targets professionals who already understand assurance and now need a rigorous, AI-specific toolkit. This guide walks through what AAIA covers, who is eligible, how the exam is structured, and how it compares to related credentials so you can decide whether it belongs on your roadmap.

What is the AAIA certification?

AAIA is a specialty certification, not an entry-level one. Rather than teaching audit from scratch, it assumes you already hold a recognized foundation and layers AI-specific competencies on top. The credential is aimed squarely at auditors who verify controls, as opposed to the managers who set AI strategy or the privacy and legal professionals who write policy. In practice, an AAIA holder is expected to be able to scope an AI audit, assess model and data governance, test whether controls are designed and operating effectively, and communicate findings to stakeholders who may not be technical.

ISACA's 2026 AI Pulse Poll of 3,400 global digital trust professionals found that 90% believe employees are using AI in their organization, yet only 38% of organizations have a formal, comprehensive AI policy. That governance gap is exactly what AI auditors are being hired to close. (Source: ISACA 2026 AI Pulse Poll)

AAIA prerequisites and the CISA connection

AAIA does not have its own separate experience exam in the way CISA does. Instead, eligibility is tied to holding a qualifying foundational designation with an IT audit or IT advisory focus. The most direct route is an active CISA (Certified Information Systems Auditor), but ISACA has deliberately widened the door beyond its own credential so that established auditors and accountants from other bodies can qualify.

At launch the eligibility was narrower, but ISACA later expanded the list of accepted prerequisite credentials. Qualifying designations include:

CISA (Certified Information Systems Auditor) from ISACA
CIA (Certified Internal Auditor) from the IIA
US CPA (Certified Public Accountant) from the AICPA
ACCA or FCCA (Chartered Certified Accountant)
Canadian CPA (Chartered Professional Accountant)
CPA Australia or FCPA (Certified Practising Accountant)
Japanese CPA designation

For most people reading this, the practical takeaway is simple: if you already hold CISA, you are eligible for AAIA, and the two are designed to work together. If you do not yet hold a qualifying credential, earning CISA first is the natural on-ramp.

AAIA exam domains and weighting

The AAIA exam is organized around three domains, and their weightings tell you exactly where to concentrate your study time. Treating all three equally is a common mistake, because AI Operations alone carries nearly half the exam.

AI Governance and Risk (33%) covers policies, roles, ethical principles, risk assessment, data governance, privacy, compliance, and oversight mechanisms
AI Operations (46%) spans the AI lifecycle including data management, solution development, change management, output supervision, testing, threats, and incident response
AI Auditing Tools and Techniques (21%) covers scoping AI audits, control design and effectiveness testing, evidence and documentation, AI-enabled analytics, and reporting

The heavy weighting on AI Operations reflects where real audit risk lives: models drift, data pipelines break, changes go unreviewed, and few organizations can say with confidence how quickly they could shut an AI system down after an incident. Expect scenario-based questions that ask you to apply judgment rather than recall definitions.

AAIA exam format

Based on ISACA's published exam content outline, the AAIA exam consists of 90 multiple-choice questions, each presenting four possible answers, and is designed to test analysis, evaluation, and applied judgment rather than memorization. After registering, candidates have a six-month eligibility window in which to schedule and sit the exam. Because ISACA periodically updates fees, scheduling rules, and eligibility windows, always confirm the current specifics on ISACA's official AAIA pages before you register.

Who should take AAIA?

IT auditors and IS auditors who now review AI or machine learning systems
Internal auditors expanding into emerging technology risk
Assurance and advisory consultants building an AI audit practice
CISA holders who want a credible AI specialization on top of their foundation
Risk and compliance professionals who evidence AI control effectiveness

AAIA vs AAISM vs AIGP

AAIA is one of three credentials that dominate AI governance conversations, and they are not interchangeable. The right choice depends on your role. AAIA is for auditors who verify controls and requires a CISA-family prerequisite. AAISM, also from ISACA, is a security-management credential that requires an active CISM or CISSP and centers on securing and governing AI systems; it is aimed at managers who set strategy rather than testers who verify it. The IAPP AIGP (AI Governance Professional) approaches AI from the policy, privacy, and law side, with deeper coverage of global regulation such as the EU AI Act, and it carries no security prerequisite.

Many professionals end up combining one ISACA AI specialty with a policy-oriented credential like AIGP. That pairing signals to hiring managers that you understand both the operational side, where AAIA lives, and the regulatory side. If your day job is testing and evidencing controls, AAIA is the strongest fit; if you set security strategy, look at AAISM; if you design enterprise AI policy, consider AIGP.

How to prepare

Start from ISACA's official exam content outline and map your study hours to the 33/46/21 weighting so AI Operations gets the attention it deserves. Because the questions are scenario-based, passive reading is not enough; you need to practice applying concepts to realistic audit situations. Full-length practice exams that mirror the domain weighting are the fastest way to expose weak areas, build exam stamina, and get comfortable with how AAIA frames its questions before test day.