ISACA • AAIA
ISACA Advanced in AI Audit (AAIA) Practice Test
Validates the ability to audit AI systems across three domains: AI governance and risk management, AI operations and lifecycle risks, and AI auditing tools and techniques, covering AI model assessment, algorithm development oversight, and AI-enhanced audit processes.
Exam Details
Questions
600
Duration
150 minutes
Passing Score
450/800
Difficulty
AssociateLast Updated
Feb 2026
Exam Domain Breakdown
AI Governance and Risk33%
AI Operations46%
AI Auditing Tools and Techniques21%
Exam Overview
The ISACA Advanced in AI Audit™ (AAIA™) is the world's first advanced, audit-specific certification focused on artificial intelligence, launched by ISACA in 2025. It validates that experienced audit and assurance professionals possess the specialized knowledge to evaluate AI systems across three core disciplines: AI governance and risk management, AI operations and lifecycle management, and AI auditing tools and techniques. The credential demonstrates competency in assessing AI model integrity, overseeing algorithm development, applying data governance principles, and leveraging AI-enhanced methodologies to strengthen audit processes.
Designed for professionals who already hold a foundational audit or accounting credential, the AAIA goes beyond general AI literacy to test applied judgment in real-world scenarios—covering ethical AI frameworks, regulatory compliance, threat identification, incident response, and the use of AI-powered analytics within audit engagements. As organizations accelerate AI adoption, the certification equips auditors to serve as credible advisors on AI-related risk, control design, and assurance reporting.
Who Should Take This Exam
The AAIA is intended for experienced IT auditors, internal auditors, and assurance advisors who already hold a qualifying credential such as the CISA, CIA, US CPA, ACCA/FCCA, Canadian CPA, CPA Australia, or Japanese CPA (JICPA). It is best suited for professionals with several years of audit or advisory experience who are now encountering AI systems in the scope of their work and need a recognized credential to formalize that expertise.
Beyond traditional IT audit roles, the certification is also relevant to risk managers, compliance officers, technology consultants, and governance professionals in industries such as financial services, healthcare, and government—anywhere that AI deployments require independent assurance and structured oversight.
Prerequisites
Candidates must hold an active, in-good-standing qualifying credential from an approved list: CISA (ISACA), CIA (IIA), US CPA (AICPA), ACCA or FCCA (Association of Chartered Certified Accountants), Canadian CPA, CPA Australia (CPA or FCPA), or Japanese CPA (JICPA). There are no formal work-experience requirements beyond holding one of these designations, but the exam content presupposes familiarity with audit methodology, risk assessment frameworks, and IT controls.
ISACA recommends that candidates have practical experience conducting IT or operational audits before attempting the AAIA, as the questions are scenario-based and test applied judgment rather than rote knowledge. Candidates do not need a prior AI background, though familiarity with AI concepts, machine learning lifecycles, and data governance will significantly aid preparation.
Exam Format
The AAIA exam consists of 90 multiple-choice questions, each presenting four answer options. Candidates have 150 minutes to complete the exam. Questions are entirely scenario-based, requiring candidates to analyze situations and select the best course of action rather than recall definitions. There are no unscored pretest items disclosed publicly.
The exam is delivered via computer at authorized PSI testing centers worldwide or through live remote proctoring. Candidates residing in India, Mainland China, or Hong Kong must test at a PSI center and are not eligible for remote proctoring. Scoring uses a scaled system ranging from 200 to 800; the passing score is 450. Preliminary pass/fail status is displayed on screen immediately after completion, and official scaled scores are emailed and posted to the candidate's ISACA account within 10 business days. Candidates who do not pass may retake up to four times within a 12-month period, with mandatory waiting periods of 30 days after the first failure and 90 days after subsequent failures.
Skills Measured
- 1.Domain 1 – AI Governance and Risk (33%): Establishing AI governance frameworks aligned with organizational strategy and ethical principles; defining roles and responsibilities for AI oversight; conducting AI-specific risk assessments; implementing data governance, privacy, and security controls; ensuring regulatory and compliance adherence; and advising stakeholders on policy development for responsible AI use.
- 2.Domain 2 – AI Operations (46%): Evaluating organizational readiness for AI adoption; assessing data management practices that support AI solutions; reviewing AI solution development methodologies and change management processes; supervising AI solution performance and monitoring metrics; applying testing techniques to validate AI model behavior; identifying AI-specific threats and vulnerabilities; and managing incident response for AI-related failures or breaches.
- 3.Domain 3 – AI Auditing Tools and Techniques (21%): Scoping and planning AI-focused audit engagements; designing and testing controls specific to AI systems; gathering and documenting audit evidence for AI processes; applying AI-enabled data analytics to enhance audit efficiency and coverage; assessing algorithm outputs for bias, fairness, and explainability; and communicating audit findings and recommendations to technical and non-technical stakeholders.
Study Tips
- Start with the official AAIA Exam Content Outline published on isaca.org to map every subdomain before opening any study material—allocate your preparation time proportionally to domain weights (46% for Operations, 33% for Governance, 21% for Tools).
- Use the ISACA AAIA Review Manual as your primary study resource; it is authored to align precisely with exam objectives and is updated to reflect the current content outline.
- Supplement reading with the ISACA Questions, Answers, and Explanations (QAE) Database, which provides 12 months of access to scenario-based practice questions mirroring the exam's applied-judgment format—prioritize understanding the rationale behind correct and incorrect answers.
- Leverage ISACA's member-exclusive online study group forum to discuss ambiguous scenarios with peers and subject-matter experts; this is particularly valuable for Domain 2 (AI Operations) subdomains like incident response and algorithm testing that require contextual judgment.
- Ground your study in real AI governance frameworks referenced in the exam—specifically NIST AI RMF, ISO/IEC 42001, and the EU AI Act—so you can apply regulatory context when answering compliance and risk scenario questions.
- Because the exam is entirely scenario-based, practice timed sets of 30 questions at a stretch to build the decision-making stamina needed for 90 questions in 150 minutes; aim for consistent 90-second-per-question pacing.
- Cross-reference your existing CISA or CIA knowledge with AI-specific extensions: map familiar control frameworks (COBIT, ISO 27001) to AI contexts, since many AAIA questions test how traditional audit concepts apply when AI is the subject of the audit.
Career Benefits
The AAIA positions holders at the intersection of two high-demand disciplines—AI governance and professional audit—at a time when enterprises are rapidly scaling AI deployments while regulators worldwide (EU AI Act, SEC guidance, NIST AI RMF) are tightening accountability requirements. Certified professionals report salary premiums averaging 15–20% over non-certified peers in comparable audit roles, and the credential opens pathways to specialized positions including AI Audit Lead, Chief Risk Officer, AI Compliance Manager, and technology assurance advisory roles.
Because the AAIA is the only advanced, audit-specific AI credential in the market, it carries early-mover advantage: organizations in financial services, healthcare, government, and technology are actively seeking auditors who can independently assess AI risk without relying solely on data science teams. The certification is globally recognized and maintains the ISACA brand's credibility with audit committees and regulators, making it a strong differentiator when competing for senior internal audit, consulting, or advisory mandates involving AI systems.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 600 questions.
1. A retail company uses a recommendation engine with a feature store architecture that maintains both offline storage for training and online storage for real-time inference. During an audit, the auditor discovers that the offline feature store uses daily batch updates from the data warehouse, while the online feature store receives real-time streaming updates from transactional systems. The feature transformation logic differs slightly between the two stores due to different engineering teams implementing them. What is the PRIMARY risk this architecture introduces? (Select one!)
AData privacy violations due to lack of access controls between online and offline feature stores
BIncreased latency in real-time inference due to synchronization overhead between feature stores
CFeature drift will go undetected because separate monitoring systems are required for each store
DTraining-serving skew where models trained on offline features produce different results than expected when served with online features
Explanation
The primary risk is training-serving skew, a critical MLOps antipattern where models trained on features from one source produce unexpected results when served with features from another source. The architecture has created this risk by implementing different transformation logic in offline versus online stores and using different update frequencies. During training, the model learns relationships based on daily-batched warehouse data with one set of transformations, but during inference, it receives real-time streaming data with different transformations. Even small differences in transformation logic can significantly impact predictions. Feature stores are specifically designed to solve this problem by providing a unified transformation engine ensuring feature consistency across training and serving. The lack of unified transformation logic defeats this core purpose. While data privacy controls are important, they are not the primary architectural risk created by inconsistent transformation logic. Latency concerns from synchronization are secondary to correctness concerns from skew. Feature drift detection is important but is not the immediate risk introduced by having inconsistent transformation implementations - the drift detection challenge exists regardless, but skew is specifically caused by the architectural inconsistency described.
2. An auditor evaluates third-party AI vendor controls using SOC 2 Type II reports for a sentiment analysis API service. The audit scope includes data segregation controls for multi-tenant architecture. Which SOC 2 Trust Services Criteria is most relevant for evaluating tenant data isolation controls? (Select one!)
AAvailability criteria for system processing reliability
BSecurity criteria for protecting against unauthorized access
CConfidentiality criteria for sensitive data protection
DProcessing Integrity criteria for output accuracy
Explanation
Confidentiality Trust Services Criteria specifically addresses protection of sensitive information designated as confidential, including multi-tenant data segregation and isolation controls to prevent unauthorized disclosure between tenants. Security criteria focuses broadly on protecting systems from unauthorized access but is less specific to data segregation. Availability criteria addresses system operational reliability and uptime. Processing Integrity criteria evaluates whether system processing is complete, valid, accurate, timely, and authorized, not data isolation. Tenant data isolation is fundamentally a confidentiality concern requiring controls to ensure one tenant cannot access another tenant's data.
3. An auditor is evaluating model performance metrics for an AI-powered resume screening system used by a large employer. The system processes 50,000 applications annually with a 2% interview selection rate. The model achieves 96% accuracy overall. Upon deeper analysis, the auditor discovers the model predicts reject for 98% of applicants and accept for 2%, with precision of 40% and recall of 32% for the accept class. What should the auditor conclude? (Select one!)
AThe model exhibits concept drift requiring retraining with more recent applicant data
BThe 32% recall indicates the model misses 68% of qualified candidates requiring immediate remediation
CThe model performs well with 96% accuracy and should be approved for continued use
DThe high accuracy metric is misleading due to class imbalance and the model performs poorly with only 40% precision for acceptance decisions
Explanation
The 96% accuracy metric is highly misleading due to severe class imbalance, and the model actually performs poorly. With only 2% positive class prevalence, a naive model that predicts reject for all applicants would achieve 98% accuracy while being completely useless. The actual model at 96% accuracy performs worse than random guessing. The critical metrics are precision at 40% and recall at 32% for the accept class. The 40% precision means when the model recommends interviewing a candidate, it is wrong 60% of the time, wasting significant recruiter time on unqualified candidates. The 32% recall means the model misses 68% of actually qualified candidates, creating severe adverse impact. This is a classic example of why accuracy is inappropriate for imbalanced datasets and why F1 score or class-specific precision and recall must be evaluated. While the 68% miss rate is concerning, the question asks what the auditor should conclude about the metrics, not necessarily demand immediate action. Concept drift is not evidenced by the data provided. The fundamental audit finding is that management is likely relying on the misleading 96% accuracy figure without understanding the model's actual poor performance on the minority class that matters most for business value.
4. An auditor evaluates an organization's AI system decommissioning procedures aligned with NIST AI RMF GOVERN 1.7. The organization decommissioned a customer churn prediction model after replacing it with a newer version. The organization deleted all model artifacts including source code, trained model weights, and configuration files to reduce storage costs. Training data was preserved. The auditor learns that six months after decommissioning, a regulatory investigation requested documentation of historical model decisions. Which GOVERN 1.7 requirement did the organization violate? (Select one!)
ALack of gradual decommissioning process, as models should be transitioned through shadow mode before complete termination
BInadequate preservation of decommissioned system artifacts needed for future investigations and regulatory compliance
CInsufficient documentation of business continuity impacts and reputational risks in decommissioning policy
DFailure to conduct stakeholder consultation before decommissioning the model to address user and community concerns
Explanation
NIST AI RMF GOVERN 1.7 requires organizations to consider regulatory requirements and future investigations when decommissioning AI systems, including defining storage location and duration for decommissioned systems and preserving ancillary data for full system understanding. The organization violated this by deleting all model artifacts, preventing the ability to respond to regulatory investigation requests. Decommissioned systems should be archived with sufficient documentation to reconstruct historical decisions and demonstrate compliance. While stakeholder consultation may be appropriate for customer-facing systems, the primary violation is failure to preserve artifacts for regulatory investigation. Shadow mode transitioning applies when deploying new models, not decommissioning replaced models, and is not a universal GOVERN 1.7 requirement. Business continuity and reputational risk documentation is part of decommissioning policy development, but the specific violation is the premature deletion of artifacts needed for regulatory compliance.
5. An auditor evaluates NIST AI RMF MAP 5 impact characterization for a facial recognition system used in building access control. The risk assessment documents technical failure modes and likelihood estimates but does not include stakeholder engagement activities, impact magnitude assessments for affected individuals, or evaluation of disproportionate impacts on demographic subgroups. Which MAP 5 element is deficient? (Select one!)
AStakeholder engagement is a GOVERN function requirement and not part of MAP 5 impact characterization
BMAP 5 is adequately addressed because technical failure modes and likelihood estimates satisfy impact characterization requirements
CDemographic impact assessment is only required for high-risk AI systems under EU AI Act and not NIST AI RMF
DImpact characterization lacks stakeholder engagement and assessment of disproportionate impacts on affected populations as required by MAP 5
Explanation
NIST AI RMF MAP 5 requires impact characterization to assess both likelihood and magnitude of impacts, engage stakeholders to understand consequences, and evaluate disproportionate impacts on different populations. The scenario shows technical risk assessment without stakeholder engagement or demographic impact analysis, which is insufficient for MAP 5. Facial recognition for access control can disproportionately impact certain demographic groups due to documented accuracy disparities across skin tones, genders, and ages. MAP 5 explicitly requires understanding impacts on affected individuals and communities, not just technical failure probabilities. Stakeholder engagement appears in both MAP and GOVERN functions with different emphases. While EU AI Act has specific demographic assessment requirements, NIST AI RMF independently requires evaluating disproportionate impacts as part of trustworthy AI risk management. Complete MAP 5 implementation requires qualitative stakeholder input alongside quantitative technical assessments.
$7
One-time access to this exam
Full access to all 600 questions
Or $15/mo for all 201 exams
Detailed explanations
Free preview stays available