ISACA Advanced in AI Risk (AAIR)

Learning plan

About 40 hours of focused study, split into 4 phases. Pick your weekly pace and the timeline adjusts.

Estimated finish: 4 weeks

What the exam covers

Source: official exam guide. Weights can change, so check before you start.

Before you start

• Eligibility: you must hold a qualifying designation such as CRISC, CISA, CISM, CGEIT or CDPSE, or one of the other global designations ISACA lists, before you can earn AAIR
• Working knowledge of enterprise risk management (risk appetite, registers, control taxonomies, BIA). AAIR builds on this and does not teach it
• No coding is needed, but you should understand how ML models are trained, validated and monitored

1. Weeks 1–2 · 12 h

   AI governance, frameworks and regulation

   • Map AI use cases to organisational strategy, and assign ownership, oversight and accountability (RACI) for AI systems
   • Compare NIST AI RMF (Govern, Map, Measure, Manage), ISO/IEC 42001 and ISO/IEC 23894, and explain how each fits into existing ERM
   • Apply the EU AI Act risk tiers (prohibited, high-risk, limited, minimal) and GPAI obligations to example use cases
   • Write AI policy and training requirements that cover trustworthiness, ethics, bias, privacy, safety and ESG impacts

   Use: AAIR exam content outline · NIST AI Risk Management Framework · NIST AI RMF Playbook · EU AI Act explorer · ISO/IEC 42001 AI management system

2. Week 2 · 8 h

   AI life cycle risk

   • Identify risk at each life cycle stage, from design or procurement and documentation through training, testing, validation, deployment, maintenance and decommissioning
   • Evaluate data and asset risk (lineage, consent, data poisoning, model inventory) and model risk (suitability, drift, explainability)
   • Assess human-oversight controls at critical decision points

   Use: MIT AI Risk Repository

3. Weeks 3–4 · 15 h

   AI risk program management (largest domain, 42%)

   • Build AI risk scenarios from threats and vulnerabilities (prompt injection, model theft, poisoning, hallucination) using MITRE ATLAS and the OWASP Top 10 for LLMs
   • Choose a treatment (avoid, mitigate, transfer, accept) and test that controls keep residual risk within tolerance
   • Define KRIs and board-level reporting for AI risk, and add AI to risk registers and control taxonomies
   • Manage third-party and supply-chain AI risk, including contract clauses on data use and IP
   • Add AI scenarios to incident response, BIA, business continuity and disaster recovery plans

   Use: MITRE ATLAS · OWASP Top 10 for LLM Applications

4. Week 4 · 5 h

   Practice questions and review

   • Take ISACA's free practice quiz, then work through the official QAE database until you are consistently above 75%
   • For every miss, write which task statement it tests and the "most appropriate first action" logic ISACA expects
   • Re-read Domain 3 (42%) and Domain 1 (37%), which together are almost 80% of the exam

   Use: AAIR free practice quiz · AAIR Questions, Answers & Explanations Database · AAIR Review Manual · AAIR Online Review Course

You're ready to book when…

• You can place a described AI use case in an EU AI Act risk tier and a NIST AI RMF function without notes
• You can write a complete AI risk scenario (threat, vulnerability, impact, KRI, treatment, owner) in under five minutes
• You score 75% or higher on fresh QAE questions in timed sets

Exam tips

• The outline lists 90 questions. ISACA questions ask for the BEST or MOST appropriate action, so choose the answer a risk practitioner would give: governance and assessment before technical fixes.
• Registration gives you a six-month window to sit the exam. After you pass, you have five years to apply for the credential, which costs a $50 processing fee.