ISACA Advanced in AI Audit (AAIA): Cost, Eligibility, and What the Exam Actually Covers

What Advanced in AI Audit (AAIA) Exam Actually Certifies

AAIA doesn't teach someone to audit — it certifies that someone who already audits can do it credibly when AI is involved. ISACA built it explicitly on top of existing audit credentials rather than as a standalone entry point, and its own launch materials describe it as the first advanced, audit-specific AI certification on the market. That framing matters for how you should read this page: there isn't yet a direct, apples-to-apples competing exam from another body. The closest things are ISACA's own sibling credentials (AAISM for AI security management, AAIR for AI risk) and general AI-audit training from bodies like the IIA, but none of those test the same combination of audit methodology plus AI governance that AAIA does.

The exam covers three domains: AI Governance and Risk, AI Operations, and AI Auditing Tools and Techniques — evaluating whether you can assess AI model risk, review data governance and privacy programs built around AI, and apply audit sampling, evidence-gathering, and reporting techniques to systems that behave less predictably than traditional software.

Who Advanced in AI Audit (AAIA) Exam Is For (and Who It's Not For)

You cannot sit for AAIA cold. ISACA gates registration behind an existing credential: a CISA in good standing, or — if you're currently working in an IT audit or advisory role — a CIA (IIA), a US CPA, or one of several accountancy-body equivalents ISACA added in mid-2025 (ACCA, Canadian CPA, CPA Australia, Japanese CPA, and others). If you don't hold one of those, this isn't your exam yet; CISA is the more common on-ramp.

That gating means the  candidate is a working IT auditor, internal auditor, or risk/compliance professional who's being asked to opine on AI systems their organization is deploying and wants a credential that says they can do it rigorously rather than by instinct. It's a poor fit for someone new to audit who's mainly interested in AI technology itself — the exam assumes you already know how to run an audit and is testing whether you can extend that skill to AI-specific risk.

Exam Format and Structure

Ninety multiple-choice questions in 150 minutes works out to under two minutes per question on average, which is tighter than it sounds once you hit the scenario-based items. ISACA's own guidance notes that questions carry qualifiers like "MOST likely" or "BEST" rather than single obviously-correct answers, so the exam rewards careful reading over speed. There's no penalty for wrong answers, so every question should get an answer even if it's a guess.

You'll take it either at a PSI test center or through PSI's remote-proctored option at home. The remote route comes with friction worth knowing about before exam day: a mandatory 360-degree room scan, a desk scan, and a mirror check using a phone or handheld mirror to show blind spots around your laptop. Once registered, you have a six-month eligibility window to actually sit the exam (extendable once, for a $75 fee), and appointments only open 90 days out.

Domains and Weightings

AI Operations carries nearly half the exam, which surprises candidates who assume a certification called "AI Audit" would weight the Tools and Techniques domain most heavily. In practice, ISACA is testing whether you understand how AI systems actually get built, changed, and monitored — the auditing skills in domain three are assumed competency you're applying to that operational context, not the main event.

Cost Breakdown

The exam fee itself is $459 for ISACA members and $599 for non-members — a meaningful gap that makes membership worth pricing out if you're not already a member, since annual ISACA membership can cost less than the fee difference alone. That's not the full cost of becoming certified, though: passing gets you a $50 application processing fee before ISACA issues the credential. Missed appointments or no-shows forfeit the entire exam fee with no refund, and rescheduling is only penalty-free if done at least 48 hours out.

Prerequisites and Eligibility

This is the one area where AAIA differs sharply from most exam-info pages on this site: you cannot simply pay and sit for it. ISACA requires an active qualifying credential at registration. As of the most recent guidance, the accepted list is:

• CISA (Certified Information Systems Auditor, ISACA)

• CIA (Certified Internal Auditor, IIA) — if in an IT audit/advisory role

• US CPA — if in an IT audit/advisory role

• ACCA / FCCA (UK)

• Canadian CPA

• CPA Australia / FCPA Australia

• Japanese CPA

• ICAEW ACA / FCA

• CNA (Nigeria)

• CA / FCA (Australia and New Zealand)

• Hong Kong CPA / FCPA

If your qualifying credential lapses after you earn AAIA, that affects your AAIA standing too — ISACA ties AAIA maintenance to keeping the underlying credential active.

How Advanced in AI Audit (AAIA) Exam Is Scored and What Passing Requires

ISACA reports results on a scaled score from 200 to 800, not a raw percentage. You need 450 to pass. Domain-level breakdowns appear on your score report for your own reference, but they don't factor into pass/fail — your total correct answers across all 90 items (minus unscored pre-test items ISACA seeds into the exam for research) determine the outcome. You'll see a preliminary pass/fail indicator on screen right after finishing; the official scaled score follows by email within about ten business days.

If you don't pass, ISACA's retake policy allows four attempts in a rolling 12-month period, but with mandatory waiting periods between them: 30 days before a first retake, then 90 days before each subsequent one. Once you do pass, you're locked out of retaking the same exam for five years, and you can't sit for it again at all while currently AAIA-certified.

Renewal and Continuing Education Requirements

AAIA doesn't expire on a fixed cycle the way some IT certifications do, but it isn't a one-and-done credential either. To keep it active you need to:

• Earn and report a minimum of 30 CPE hours over a rolling three-year period, specifically in AI-related content relevant to the AAIA domains

• Pay an annual maintenance fee — $20 for ISACA members, $35 for non-members (capped at that amount even if you hold multiple ISACA "Advanced" credentials)

• Keep your underlying qualifying certification (CISA, CIA, CPA, etc.) in good standing

• Comply with ISACA's Code of Professional Ethics and respond to a CPE audit if selected

Miss these and ISACA revokes the designation outright — there's no grace period built into the published policy.

 Preparation Timeline

Because AAIA assumes you already have audit fundamentals down (that's what your prerequisite credential covers), study time goes almost entirely into the AI-specific content: model risk, AI governance frameworks, data lifecycle issues unique to machine learning systems, and how conventional audit sampling and evidence techniques translate to systems whose outputs aren't fully deterministic. Given the 46% weight on AI Operations, spend time on the practical mechanics — data management, change management, and incident response as they apply to AI — rather than over-indexing on governance theory. Most candidates report several weeks of structured study using ISACA's official review manual and question bank rather than treating this as a light add-on to an existing certification.