ISACA Advanced in AI Audit (AAIA)

Learning plan

About 40 hours of focused study, split into 4 phases. Pick your weekly pace and the timeline adjusts.

Estimated finish: 4 weeks

What the exam covers

Source: official exam guide. Weights can change, so check before you start.

Before you start

• Eligibility: you must hold an active CISA, or a qualifying audit/advisory designation such as CIA, US CPA, ACCA/FCCA or ICAEW ACA/FCA, before you can register
• Comfort with general audit methodology (risk-based planning, sampling, evidence, reporting). AAIA builds on it rather than teaching it

1. Week 1 · 10 h

   AI governance and risk for auditors (Domain 1)

   • Explain AI model types (supervised, unsupervised, generative, agentic) and the requirements and considerations an auditor must check for each
   • Evaluate an AI governance programme against NIST AI RMF, ISO/IEC 42001 and the EU AI Act, including the inventory, risk appetite, policies and accountable owners
   • Audit AI risk management (risk identification, rating, treatment, acceptance) and how privacy and data governance programmes cover AI
   • Map ethics principles and regulatory obligations to testable control objectives

   Hands-on: Pick a public AI policy (for example a company's published responsible-AI standard) and write five control objectives with test steps for it. For each, note whether you would test design, operating effectiveness or both.

   Use: AAIA exam content outline · ISACA AI resources · NIST AI Risk Management Framework

2. Weeks 2–3 · 16 h

   AI operations, the heaviest domain (Domain 2)

   • Audit data management for AI, including data sourcing, labelling quality, lineage, bias in training data and retention
   • Assess the AI development life cycle and change management (model versioning, retraining triggers, approval gates, rollback)
   • Evaluate how AI outputs, impacts and decisions are supervised, including human-in-the-loop design, drift monitoring and performance thresholds
   • Review AI testing techniques (validation sets, bias testing, robustness and adversarial testing, red teaming), AI-specific threats (prompt injection, data poisoning, model theft) and AI incident response

   Hands-on: Write an audit work program for a bank's credit-decisioning model. Cover change management, monitoring thresholds, retraining approval, bias testing and incident escalation, with at least 15 test steps and the evidence you would request for each.

   Use: OWASP Top 10 for LLM Applications · MITRE ATLAS adversarial threat matrix

3. Weeks 3–4 · 8 h

   AI auditing tools and techniques (Domain 3)

   • Plan and scope an AI audit, including risk-based selection of AI systems from the inventory and the audit criteria to use
   • Choose sampling methods for AI outputs and decisions, and explain the limits of sampling probabilistic systems
   • Collect and assess evidence such as model cards, evaluation logs, data lineage records and monitoring dashboards
   • Use data analytics to re-perform tests on model outputs, and write findings that rate risk and recommend remediation

   Hands-on: Download a public dataset with a protected attribute (for example the UCI Adult income data), train or reuse a simple classifier, and re-perform a fairness test (selection rate by group, four-fifths rule). Write the result up as a one-page audit finding with condition, criteria, cause, effect and recommendation.

   Use: ISACA IT audit resources

4. Week 4 · 6 h

   Practice questions and review

   • Complete the free 12-question AAIA practice quiz, then at least 150 questions from the ISACA QAE database
   • Track misses by domain and subtopic (1A–3E); re-study any subtopic below 70%
   • Practise picking the answer an auditor would choose (evidence and independence) over the one a developer would choose

   Use: Free AAIA practice quiz · ISACA exam candidate guides

You're ready to book when…

• You can explain why AI Operations is 46% of the exam and list its seven subtopics from memory
• You have written at least one complete AI audit work program with test steps and evidence requests
• You consistently score 75% or higher on unseen QAE questions

Exam tips

• After you register you have six months to sit the exam. Rescheduling is free if done at least 48 hours before the appointment.
• Passing the exam doesn't make you certified. You still have to apply within five years and pay the $50 application fee.