ISACA · AAIR
ISACA Advanced in AI Risk (AAIR) Practice Tests
Validates expertise in managing AI-related risks across three practice areas: AI risk governance and framework integration, AI risk program management, and AI lifecycle risk management, covering AI vulnerability evaluation, impact assessment, and risk lifecycle navigation.
Exam Details
Practice Questions
598
≈ 3 practice exams
Duration
150 minutes
Passing Score
450/800
Difficulty
AssociateLast Updated
Feb 2026
ISACA Advanced in AI Risk (AAIR) Practice Exam Preparation
Use this AAIR practice exam to prepare for ISACA Advanced in AI Risk (AAIR) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 598 questions for ISACA AAIR, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The ISACA Advanced in AI Risk (AAIR™) certification is an AI-focused IT risk management credential designed to validate advanced expertise in identifying, evaluating, and managing risks that arise from artificial intelligence adoption within organizations. It covers three core practice areas: AI Risk Governance and Framework Integration, AI Risk Program Management, and AI Life Cycle Risk Management. Together, these domains address the full spectrum of AI risk—from establishing governance structures and embedding AI risk into enterprise frameworks, to executing risk programs, evaluating AI-specific vulnerabilities, conducting impact assessments, and navigating risk throughout the AI development and deployment lifecycle.
The AAIR credential is part of ISACA's suite of Advanced AI certifications, alongside the Advanced in AI Audit (AAIA) and Advanced in AI Security Management (AAISM). Unlike these related credentials, AAIR specifically equips professionals to work cross-functionally, recommend risk responses, and guide senior management in safeguarding organizations from financial, reputational, and operational harms associated with AI integration. The certification is currently in beta, with a full launch anticipated for Q2 2026.
Who Should Take This Exam
AAIR is intended for experienced IT risk and advisory professionals who already hold a recognized risk or security certification and are seeking to extend their expertise into AI-specific risk management. Eligible professionals must hold at least one active credential from the following: CISA, CISM, CRISC, CGEIT, CDPSE (ISACA credentials), or CRMP, CRMA, CGRC, CISSP, CERP, CRCM, or PMI-RMP (global designations). Because the program does not cover foundational IT risk concepts, it is best suited for mid-to-senior-level practitioners who already operate in risk management, compliance, governance, or advisory roles and need structured knowledge to address AI's unique risk profile.
Typical candidates include IT Risk Managers, Enterprise Risk Officers, AI Governance Leads, Chief Risk Officers, and Compliance Managers working in industries where AI adoption is accelerating—such as financial services, healthcare, technology, and government. It is also relevant for consultants who advise organizations on responsible AI adoption and integration strategies.
Prerequisites
Candidates must hold at least one active qualifying credential at the time of application. Accepted ISACA credentials include CISA, CISM, CRISC, CGEIT, and CDPSE. Globally recognized designations that also qualify include CRMP, CRMA, CGRC, CISSP, CERP, CRCM, and PMI-RMP. These prerequisites are non-negotiable, as the AAIR program is explicitly designed to build on existing foundational IT risk knowledge rather than introduce it.
Beyond holding a qualifying credential, candidates should have practical professional experience working in IT risk management, AI governance, compliance, or a closely related advisory function. Familiarity with enterprise risk frameworks (such as COBIT, NIST, or ISO 31000), AI concepts including machine learning and generative AI models, and cross-functional risk communication will help candidates engage effectively with the curriculum and exam content.
Exam Format
The AAIR exam consists of scenario-based multiple-choice questions delivered in a proctored setting. The exam duration is 150 minutes. Scoring uses a scaled scoring model with a maximum score of 800 points, and the passing score is 450 out of 800—consistent with the scoring methodology used across ISACA's Advanced AI certification suite. The exact number of scored questions has not been published by ISACA as of the time of writing, as the certification is currently completing its beta phase ahead of a full Q2 2026 launch.
ISACA's Advanced AI exams are delivered online with remote proctoring available. Exam fees are estimated at approximately USD 575 for ISACA members and USD 760 for non-members, with an additional USD 50 application fee and annual maintenance fees of USD 45 (members) and USD 85 (non-members). Candidates are advised to check the official ISACA credentialing page for confirmed question counts, delivery options, and final pricing once the exam officially launches.
Skills Measured
- 1.Domain 1 – AI Risk Governance and Framework Integration: Covers the establishment and integration of AI risk governance structures within enterprise risk frameworks. Candidates are expected to understand how to align AI risk policies with organizational strategy, embed AI considerations into existing risk management frameworks (such as COBIT, NIST AI RMF, ISO 31000), and ensure board and executive-level accountability for AI risk. Exact weighting has not yet been published by ISACA.
- 2.Domain 2 – AI Risk Program Management: Focuses on designing, implementing, and managing an end-to-end AI risk program. Topics include AI risk identification and classification, risk appetite and tolerance setting for AI initiatives, cross-functional collaboration with AI development and business teams, risk communication, and reporting to stakeholders. Exact weighting has not yet been published by ISACA.
- 3.Domain 3 – AI Life Cycle Risk Management: Addresses risk at each phase of the AI lifecycle—from data acquisition and model development through deployment, monitoring, and decommissioning. Candidates must demonstrate ability to evaluate AI-specific vulnerabilities (e.g., model bias, data poisoning, adversarial attacks), conduct AI impact assessments, and apply controls appropriate to each lifecycle stage. Exact weighting has not yet been published by ISACA.
Study Tips
- Review the ISACA AI Risk Management framework materials and the NIST AI Risk Management Framework (AI RMF 1.0), as these are foundational references for the governance and program management domains.
- Leverage your existing CRISC, CISM, or equivalent credential study materials to reinforce enterprise risk concepts, then map those concepts to AI-specific scenarios covered in AAIR's three domains.
- Enroll in ISACA's official AAIR Online Review Course once it launches—this on-demand course is purpose-built for the exam and developed by the same organization that writes the test.
- Practice with ISACA's official Questions, Answers & Explanations (QA&E) database, which will offer 200+ scenario-based items. Focus on understanding the reasoning behind correct answers, not just memorizing them.
- Study real-world AI governance frameworks and case studies—including the EU AI Act, OECD AI Principles, and published AI risk incidents—to develop the scenario-based reasoning skills that ISACA's advanced exams emphasize.
- Join the ISACA community forums and local chapter discussions focused on AI risk to connect with other AAIR candidates and stay current with evolving AI risk guidance and regulatory developments.
- Once ISACA publishes the official AAIR Exam Content Outline (expected ahead of the Q2 2026 launch), use it as a checklist to identify and close knowledge gaps across all three domains before scheduling your exam.
Career Benefits
As organizations across industries accelerate AI adoption, demand for professionals who can rigorously manage AI-related risks is growing rapidly. AAIR holders are positioned for roles such as AI Risk Manager, Enterprise AI Governance Lead, Chief Risk Officer, AI Compliance Manager, and senior risk consultant specializing in responsible AI. These roles are emerging in regulated industries—including financial services, healthcare, and government—where AI governance requirements are being codified through regulations such as the EU AI Act and U.S. executive orders on AI.
Salary data for AI risk professionals in the United States ranges from approximately USD 90,000 to over USD 210,000 annually, depending on role, industry, and geography. ISACA-certified professionals have historically commanded a salary premium of 10–20% over non-certified peers, according to the Robert Half Salary Guide and Global Knowledge IT Skills and Salary Report. AAIR complements existing ISACA credentials—particularly CRISC—by adding a specialized AI risk layer that distinguishes holders in a market where general IT risk expertise is common but AI-specific risk governance skills remain scarce.
Sample Questions
5 sample questions with answers and explanations. The full bank has 598 questions, enough for 3 full-length practice exams.
Preview — answers shown1. Apex Insurance discovers their claims processing AI exhibits demographic parity violations with approval rates of 75% for Group A and 55% for Group B, despite similar claim validity rates. The AI team proposes three mitigation approaches: re-sampling training data, applying fairness constraints during training, or adjusting decision thresholds post-processing. Which mitigation approach operates at the algorithm level during model training? (Select one!)
AAll three approaches operate at the algorithm level
BAdjusting decision thresholds separately for each demographic group
CApplying fairness constraints during optimization to penalize demographic parity violations
DRe-sampling training data by oversampling Group B examples
Explanation
Bias mitigation approaches operate at three stages: pre-processing at the data level, in-processing at the algorithm level, and post-processing at the output level. Applying fairness constraints during optimization is in-processing bias mitigation, directly modifying the learning algorithm to incorporate fairness objectives alongside accuracy. Re-sampling is pre-processing that modifies data before training. Threshold adjustment is post-processing that modifies outputs after training. Understanding which mitigation stage is being used is critical for AI risk management, as each approach has different trade-offs for accuracy, fairness, and computational cost.
2. A multinational corporation implements NIST AI RMF GOVERN 6.1 policies to address third-party AI risks. The policy must cover intellectual property concerns when using third-party foundation models. Which risk should be prioritized in the policy documentation? (Select one!)
ALatency issues when accessing third-party API endpoints
BCopyright infringement from training data used by the third-party model provider
CUser interface incompatibility with existing enterprise systems
DVersion control conflicts between different model releases
Explanation
NIST AI RMF GOVERN 6.1 specifically requires policies to address third-party AI risks including intellectual property infringement. Copyright infringement from training data represents a significant legal and reputational risk as many foundation models may have been trained on copyrighted materials without proper licensing. Latency issues are operational concerns not related to intellectual property. Version control conflicts are technical management issues. User interface incompatibility is an integration challenge unrelated to the intellectual property risks that GOVERN 6.1 explicitly addresses.
3. Under EU AI Act Article 12 record-keeping requirements, Titan Logistics deploys a high-risk AI system for warehouse workforce allocation. The system must enable automatic logging to trace functioning throughout the lifecycle. Their logging captures model inputs, outputs, and timestamps but not intermediate processing steps or confidence scores. Does this logging approach meet Article 12 requirements? (Select one!)
ANo, Article 12 requires video recording of all AI system operations
BNo, logging must enable tracing of functioning, which requires intermediate processing and confidence information for meaningful investigation
CYes, as long as logs are retained for the system's expected lifetime
DYes, logging inputs, outputs, and timestamps satisfies traceability requirements
Explanation
EU AI Act Article 12 requires automatic logging that enables tracing of AI system functioning throughout its lifecycle. Logging only inputs, outputs, and timestamps provides limited traceability—it shows what happened but not how or why. Intermediate processing steps and confidence scores are necessary to investigate issues, identify risks, and understand system behavior. For workforce allocation, understanding confidence levels and decision factors is essential for detecting potential bias or errors. Article 12 does not prescribe specific logged elements but requires sufficient detail to trace functioning. Video recording is not required—system event logs are appropriate. Retention duration is important but does not compensate for insufficient logging detail.
4. Apex Manufacturing conducts an AI system impact assessment under ISO/IEC 42001 Annex A.5 for their employee performance evaluation AI. The assessment identifies potential psychological impacts on employees from continuous AI monitoring. Which ISO 42001 requirement must they document in the impact assessment? (Select one!)
AFinancial return on investment from the AI system deployment
BOnly technical performance metrics of the AI system
CImpact on individuals including psychological effects and societal impacts evaluation
DComparison with competitor AI performance evaluation systems
Explanation
ISO/IEC 42001 Annex A.5 requires AI system impact assessments to evaluate impact on individuals and groups as well as societal impacts. Psychological impacts from continuous monitoring directly affect individuals and must be documented in the assessment. The impact assessment goes beyond technical performance to address human and societal consequences, which is fundamental to responsible AI management. Technical performance metrics alone are insufficient for Annex A.5 compliance. Financial ROI and competitive comparisons are business considerations but not part of the impact assessment requirements which focus on effects on people and society. Impact assessments must comprehensively evaluate how the AI system affects human wellbeing, rights, and social dynamics.
5. Under NIST AI RMF GOVERN 2.1, Vanguard Healthcare must document roles, responsibilities, and communication lines for their diagnostic AI system. Which two elements are explicitly required to be clearly documented throughout the organization? (Select two!)
Multiple correct answersARoles and responsibilities for AI risk management
BIndividual performance metrics for AI team members
CCommunication lines between AI actors
DSalary bands for AI personnel
EVacation policies for data scientists
Explanation
GOVERN 2.1 explicitly requires that roles, responsibilities, and communication lines be documented and clear throughout the organization. These two elements ensure accountability structures are transparent and effective. Individual performance metrics, salary information, and vacation policies are human resources concerns not addressed by GOVERN 2.1 accountability structures. The focus is on who does what and how they communicate about AI risk management, not compensation or benefits.
More ISACA Practice Exams
IT Audit Fundamentals Certificate
IT-Audit-Fund · 627 questions
IT Risk Fundamentals Certificate
Risk-Fund · 616 questions
ISACA Advanced in AI Audit (AAIA)
AAIA · 600 questions
ISACA Advanced in AI Security Management (AAISM)
AAISM · 600 questions
Artificial Intelligence Fundamentals Certificate
AI-Fundamentals · 600 questions
Blockchain Fundamentals Certificate
Blockchain-Fund · 599 questions
$17.99
One-time access to this exam
598 questions (3 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available