ISACA AAIA - Advanced in AI Audit¶

The credential for the auditor who is asked to give assurance over an AI system. It assumes CISA (or an equivalent audit credential) and tests whether you can evaluate AI governance and risk, assess how AI is operated and controlled, and use audit techniques, including AI itself, to produce reliable findings. For the AI-side background see AI safety at ai.noblerworks.com.

Exam Details¶

• Exam Code: AAIA
• Duration: 2.5 hours (150 minutes)
• Questions: 90 multiple-choice
• Passing Score: 450 on a 200-800 scale
• Cost: US$459 member / US$599 nonmember (ISACA, checked 2026-11-07)
• Prerequisites: active CISA, or a listed audit or accounting credential with an IT audit or advisory role
• Content outline: current AAIA exam content outline (ISACA's page shows no version date, checked 2026-11-07)

Full detail, with sources, in the fact sheet.

Domains¶

How the exam thinks¶

Nearly every supporting task starts with "evaluate". The exam wants the auditor's view: what is the objective, what control should exist, what evidence shows it works, and what is the finding and who owns it. The best answer usually asks for evidence or evaluates design and operating effectiveness, rather than fixing the problem yourself. Auditors report; management remediates.

Study sequence¶

1. AI Governance and Risk (33%) - what AI is, governance, risk, privacy and data governance, regulations and standards.
2. AI Operations (46%) - the largest domain: data, development life cycle, change, supervision, testing, threats, incidents.
3. AI Auditing Tools and Techniques (21%) - planning, sampling, evidence, data analytics and reporting.

Schedule in the practice plan.

Study resources¶

• 📖 ISACA AAIA certification page - official entry point
• 📖 AAIA exam content outline - study against this
• Practice questions - original question bank in this repo
• AI safety pillar - the AI-side companion site

After AAIA¶