AAIA is not an entry point — it's a layer on top of a credential you already hold. ISACA launched the Advanced in AI Audit certification in 2025 as the first audit-specific AI credential in the field, and it only opens to candidates who already carry CISA, CIA, or a qualifying CPA designation with IT audit or advisory experience. That single fact shapes everything about how you should practice for it: this isn't a test of whether you can audit, it's a test of whether you can audit AI. The 90 questions assume you already know controls, evidence, and risk language cold.
ISACA structures the exam around three domains, and the split is not even — which matters for where you spend your practice time.
Domain 1 — AI Governance and Risk (33%) covers how organizations set up AI oversight before anything gets deployed: model selection and requirements, governance program structure, AI-specific risk management, data privacy programs, and the ethics and regulatory frameworks now attached to AI use. Expect questions built around scenarios like an organization skipping a bias assessment before rollout, or a governance committee with no defined ownership of AI risk.
Domain 2 — AI Operations (46%) is the largest single slice of the exam by a wide margin, and it's the domain most candidates under-prepare for because it reads as "technical" when it's operational. It covers data management specific to AI, the AI solution development lifecycle, change management for AI systems, supervision of AI outputs and decisions, testing techniques, AI-specific threats and vulnerabilities, and incident response for AI failures. If you only study governance language and skip lifecycle and monitoring mechanics, you will feel the gap here.
Domain 3 — AI Auditing Tools and Techniques (21%) is where the exam turns the lens back on your own function: audit planning and design for AI engagements, testing and sampling methodologies adapted for AI systems, evidence collection when the "system" is a model rather than a static process, data quality and analytics, and how to structure audit outputs and reports on AI findings. This domain also covers using AI tools to run audits more efficiently, not just auditing AI systems.
The candidate pool is narrower and more senior than most Official AAIA ISACA Exams. You're either a CISA holder moving into AI-specific engagements, an internal auditor (CIA) whose organization just handed them an AI governance review with no playbook, or a CPA in an IT-audit-adjacent role who's now being asked to opine on model risk. Very few people take AAIA as a first certification — it's a specialization layer, which is why the exam leans on scenario judgment rather than definitional recall.
The official AAIA exam is 90 multiple-choice questions in 150 minutes, delivered at PSI test centers or via remote proctoring (candidates in India, mainland China, and Hong Kong must test in person at a center — remote proctoring isn't available there). ISACA uses its standard scaled scoring model, converting raw results to a 200–800 scale with 450 as the passing mark, the same approach used across CISA and CISM, so a handful of harder questions won't sink you the way a strict percentage cutoff would.
Because Domain 2 carries 46% of the exam, expect roughly four in nine questions to come from AI Operations — lifecycle, monitoring, testing, incident response. Time pressure shows up less in raw pacing (150 minutes for 90 questions is workable) and more in scenario length: AAIA questions tend to describe a situation — a vendor's AI model drifting in production, a chatbot generating biased outputs, an audit team lacking access to training data — and ask what the auditor should do next, not what a term means. Candidates who studied AI concepts in isolation, without tying them to an audit action, consistently lose time re-reading questions to find the actual ask.
Don't treat the three domains as equal-weight study blocks — that's the single most common miscalibration candidates make going in. Given the 46% weighting, run more repetitions on AI Operations items than on Governance or Auditing Tools combined, and specifically drill the boundary between "this is a governance failure" (Domain 1) and "this is an operational control failure" (Domain 2), since AAIA distractor answers are often built around that exact ambiguity. When you miss a practice question, don't just note the right answer — note which domain's lens the question wanted you to apply, because the same scenario (say, a biased model output) can be a Domain 1 question about ethics policy or a Domain 2 question about output supervision depending on what's actually being asked.
The most frequent failure pattern is answering from general AI knowledge instead of audit judgment — knowing what "model drift" means doesn't tell you what an auditor should test for it. A close second is underestimating Domain 3: candidates who've spent years doing traditional IT audits assume "auditing tools and techniques" is the easy, familiar 21% and skim it, then get tripped up by questions on adapting sampling methodology to non-deterministic AI outputs, which doesn't behave like sampling a static control population. Third, because the prerequisite pool skews toward experienced auditors, some candidates over-trust their CISA-era instincts and under-read AI-specific regulatory and ethics content in Domain 1, missing questions on emerging frameworks that didn't exist when they earned their base certification.
Read ISACA's official AAIA exam content outline domain-by-domain before touching any question bank — the task statements listed there (23 in total) are the actual skills being tested, and several practice sources paraphrase them loosely. Pair every AI Operations topic you study with a specific audit test procedure: for "testing techniques for AI solutions," don't just read about model validation — write out what evidence you'd request and what you'd flag if it's missing. If your prerequisite is CISA, deliberately over-index your study time on AI-specific ethics, bias, and regulatory content, since that's the least overlap with what CISA already covered. If your prerequisite is CIA or CPA, do the reverse and shore up audit sampling and evidence-collection terminology, since AAIA assumes ISACA-style audit vocabulary that IIA and AICPA paths don't always emphasize the same way Test your knowledge with a free AWS ANS-C01 practice exam practice test.
Work through the domain-weighted questions below in the same proportion as the exam — roughly 30 from Governance and Risk, 41 from AI Operations, and 19 from Auditing Tools and Techniques — and review every explanation even on items you got right, since AAIA distractors are built to reward the correct reasoning path, not just the correct fact.
Last updated on Oct, 9 2026
