Skip to content

ISACA · Worldwide

Advanced in AI Audit (AAIA) exam

The AAIA shows that a certified auditor can advise on AI opportunities, assess and mitigate AI risk, and ensure compliance. Certifying takes a pass, an active CISA or other qualifying designation and a US$50 application fee; keeping it takes 10 CPE hours in AI a year, 30 over three years, an annual fee and an active qualifying designation.

Questions
90
Minutes
150
Format
Closed book

Passing score 450 on a scaled range of 200–800.

Free to start

AI models and requirements is open to every account in full.

Full access from US$39 for 30 days, one payment, nothing renews, and a full refund within 14 days. AI models and requirements is free to every account.

See AAIA pricing

Study plan

A study plan for your date.

The AAIA’s course week by week to your exam date, with the hours it takes.

By email, with no account needed.

We will email your study plan now, then 4 short follow-ups about preparing for the AAIA over the next two weeks. Unsubscribe any time.

Everything the AAIA tests, in one place

  • 18

    Lessons

  • 619

    Practice questions

  • 549

    Flashcards

  • Full length

    Timed mock exams

Blueprint

What the AAIA covers.

IT auditors and advisors who hold a CISA, or a qualifying audit or accounting designation such as the CIA or a CPA, and assure AI-driven processes or advise on them.

ISACA publishes the blueprint below. The domain shares are ISACA’s own; the area percentages split each domain’s share as evenly as whole numbers allow — not separate hurdles, since scoring is based on the total number of questions answered correctly. Every lesson sits under its area and reads in the app.

1. AI Governance and Risk

33% of the exam

  • AI models and requirements

    2 lessons · free to every account

    6%of the exam

    • AI Foundations for Auditors
    • AI Models, Considerations, and Requirements
  • AI governance and program management

    1 lesson

    7%of the exam

    • AI Governance and Program Management
  • AI risk management

    1 lesson

    7%of the exam

    • AI Risk Management
  • Privacy and data governance programs

    1 lesson

    7%of the exam

    • Privacy and Data Governance Programs
  • AI regulation and standards

    1 lesson

    6%of the exam

    • Leading Practices, Ethics, Regulations, and Standards for AI

2. AI Operations

46% of the exam

  • Data management for AI

    1 lesson

    7%of the exam

    • Data Management Specific to AI
  • AI solution development lifecycle

    1 lesson

    7%of the exam

    • AI Solution Development Methodologies and Lifecycle
  • Change management for AI

    1 lesson

    7%of the exam

    • Change Management Specific to AI
  • Supervision of AI solutions

    1 lesson

    7%of the exam

    • Supervision of AI Solutions
  • Testing techniques for AI solutions

    1 lesson

    6%of the exam

    • Testing Techniques for AI Solutions
  • AI threats and vulnerabilities

    1 lesson

    6%of the exam

    • Threats and Vulnerabilities Specific to AI
  • AI incident response

    1 lesson

    6%of the exam

    • Incident Response Management Specific to AI

3. AI Auditing Tools and Techniques

21% of the exam

  • Audit planning and design

    1 lesson

    5%of the exam

    • Audit Planning and Design
  • Audit testing and sampling

    1 lesson

    4%of the exam

    • Audit Testing and Sampling Methodologies
  • Audit evidence collection

    1 lesson

    4%of the exam

    • Audit Evidence Collection Techniques
  • Audit data quality and analytics

    1 lesson

    4%of the exam

    • Audit Data Quality and Data Analytics
  • AI audit outputs and reports

    1 lesson

    4%of the exam

    • AI Audit Outputs and Reports
Start free

AI models and requirements is free in full with a free account.

Practice

Practice in the app.

Every question comes with a rationale, and a free account opens AI models and requirements in full.

  • 619 questions in the exam’s format, written to the blueprint across its 17 content areas
  • A rationale for every answer
  • A timed mock in the exam’s own format: 90 questions in 150 minutes
  • AI models and requirements free in full with a free account: 60 questions with your progress kept, plus the diagnostic and your study plan

See what the questions look like

Create a free account

Inside the app

Everything the exam tests, and nothing it does not.

No videos to sit through and no cohort to keep up with: just the practice and the feedback the exam rewards. This is what it looks like.

Lessons mapped to the blueprint.

Always know what a lesson is worth

  • Each lesson sits under one content area of the published blueprint
  • Every lesson names its area’s weight in the blueprint
  • Every lesson lists its key takeaways
An AAIA lesson in the app: the course outline with the lessons already read, the lesson's title and objectives, and the page's sections beside it.

Flashcards for the terms and figures.

Turn repetition into recall

  • The terms and figures of each lesson, one card at a time
  • In the app, spaced repetition brings a card back just before you would forget it
An AAIA flashcard in the app, turned over: the answer, the four ratings, and the numbered map of the deck.

A plan, mock exams, and readiness you can read.

Paced to your exam date

  • A plan from your exam date that re-ranks as you answer
  • Timed mock exams with the exam’s own question count and time limit
  • Readiness is each area’s weight times your accuracy in it, summed

Format

Format and logistics.

Taken from ISACA’s published documents, pinned by hash so a revised edition shows up as a change.

Questions
90
Scored questions
Not published. Some of the 90 are unscored pre-test questions, and ISACA does not say how many.
Duration
150 minutes
Delivery
Computer-based, at a PSI test center or remotely proctored
Passing score
450 on a scaled range of 200–800
Open book
No
Retakes
Four attempts in a rolling 12 months: the first retake at least 30 days after the first attempt, each of the next two at least 90 days after the attempt before it, at the full registration fee each time.
Fees
US$459 (ISACA member) · US$599 (nonmember)
Jurisdiction
Worldwide

How the AAIA runs

  • One break of up to 10 minutes is allowed, with the proctor’s permission. The exam is paused, but the timer does not stop, so the break comes out of the 150 minutes.
  • Every question has a stem and four options, with one best answer. A question may turn on a qualifier, such as MOST likely or BEST. A wrong answer costs nothing, so no question should be left blank.
  • Results come on a scale from 200 to 800, where 450 or higher passes and 800 means every question answered correctly. Results by domain are for information only: the score rests on the total number of questions answered correctly.
  • ISACA gives each domain a share of the exam, 33%, 46% and 21%, and none to the topics within it. The weights on this page split each domain’s share between its topics as evenly as whole numbers allow.

Questions

AAIA questions, answered.

Each answer names the document it comes from.

What is the AAIA, and who is it for?

The AAIA (Advanced in AI Audit) is ISACA’s certification in auditing AI, for IT audit professionals who are, in ISACA’s words, “looking to gain recognition for their expertise, assuring AI-driven processes comply to the highest industry standards”. Every holder of an active CISA qualifies, and holders of 15 other designations, among them the CIA and the US CPA, qualify if they have an IT audit or IT advisory role.

Source: ISACA AAIA Exam Candidate Guide, pages 4 and 20; ISACA AAIA certification page

How is the AAIA exam structured?

90 multiple-choice questions in 2.5 hours (150 minutes), taken on a computer at a PSI test center or remotely proctored. Every question has a stem, which may be a question or an incomplete statement, and four options, and every question is designed with one best answer.

Source: ISACA AAIA Exam Candidate Guide, pages 4, 6 and 10

What does a qualifier such as MOST or BEST mean in an AAIA question?

ISACA’s guide tells candidates to read each question carefully, because a question may require choosing the answer based on a qualifier, such as MOST likely or BEST. You choose the correct or best answer from the four options, and the guide’s advice is to eliminate the answers you know are wrong and then make the best choice possible.

Source: ISACA AAIA Exam Candidate Guide, page 10

Is there a break during the AAIA exam?

One break of no longer than 10 minutes is permitted, with your proctor’s permission. The exam is paused during an approved break, but the timer does not stop and no extra time is given, so the break comes out of your 150 minutes.

Source: ISACA AAIA Exam Candidate Guide, pages 12 and 14

How is the AAIA scored, and what is the passing score?

ISACA reports a scaled score from 200 to 800, a conversion of your raw score to a common scale so that different versions of the exam are comparable. A score of 450 or higher passes, and 800 means every question answered correctly. Scores rest on the total number of questions answered correctly, whatever the domain, and there are no penalties for incorrect answers, so no question should be left blank. The domain results in your report are for information only.

Source: ISACA AAIA Exam Candidate Guide, pages 10 and 18

Are all 90 AAIA questions scored?

No. ISACA exams contain scored items as well as pre-test items, and pre-test items are not used to calculate the exam score. The guide does not say how many of the 90 are pre-test items.

Source: ISACA AAIA Exam Candidate Guide, page 18

When do I get my AAIA result?

A preliminary pass status appears on screen as soon as you finish. The official score is emailed and posted online within 10 working days, with details on applying for certification if you passed; question-level results are not provided. If you do not pass, you can request a rescore in writing within 30 days of the results’ release, for a fee of US$75, and PSI performs it.

Source: ISACA AAIA Exam Candidate Guide, pages 17 and 18

How many times can I take the AAIA exam?

Four attempts within a rolling 12 months. After a first attempt that does not pass, you wait 30 days for the second, then 90 days after the second for the third and 90 days after the third for the fourth, paying the full registration fee each time. Once you pass, you cannot take the same exam again during the five years you have to apply, nor while you are certified.

Source: ISACA AAIA Exam Candidate Guide, page 19

How much does the AAIA exam cost, and how long do I have to take it?

US$459 for ISACA members and US$599 for nonmembers, nonrefundable and nontransferable. Registering opens a six-month eligibility period. The guide says one six-month extension can be bought for US$75, and on a later page that “No eligibility extensions are allowed”; the extension is the more specific rule. Appointments can be booked from 48 hours after payment and up to 90 days ahead, and moved without penalty up to 48 hours before.

Source: ISACA AAIA Exam Candidate Guide, pages 5, 6 and 9

Can I take the AAIA exam at home?

In most places, yes: the exam is given at PSI test centers or remotely proctored, closed book either way. Residents of India, mainland China and Hong Kong can take it only at a test center. At home you complete a room scan and a mirror check before the exam begins, and you can talk to the proctor only in English, by live chat.

Source: ISACA AAIA Exam Candidate Guide, pages 6, 12, 15 and 16; ISACA AAIA certification page

In which languages is the AAIA exam offered?

English, Simplified Chinese and Spanish. To change your exam language you reschedule your testing appointment, at least 48 hours before it. QualExam’s AAIA lessons, questions and mock exam are in English.

Source: ISACA AAIA Exam Candidate Guide, pages 4 and 8

Who qualifies for the AAIA?

Every holder of an active CISA. Without a CISA, one of 15 other designations qualifies you as long as you have an IT audit or IT advisory role: the CIA; the US CPA; the ACCA and FCCA; CPA Australia’s CPA and FCPA; the Japanese CPA; the Canadian CPA; ICAEW’s ACA and FCA; ANAN’s CNA; CA ANZ’s CA and FCA; and HKICPA’s CPA and FCPA. ISACA has added designations since the exam launched, so its AAIA page holds the current list.

Source: ISACA AAIA Exam Candidate Guide, page 20; ISACA AAIA certification page; ISACA Expands Eligibility of First-ever Advanced AI Audit Certification

What do I need to become AAIA certified after passing?

An active credential from ISACA’s list, a passing score, the US$50 application processing fee and an application, adherence to ISACA’s Code of Professional Ethics, Terms of Use and Privacy Policy and to the AAIA CPE policy, and compliance with the Information Systems Auditing Standards. You have five years from passing the exam to apply.

Source: ISACA AAIA Exam Candidate Guide, page 20; ISACA AAIA certification page

How do I keep the AAIA once I have it?

Earn and report at least 10 CPE hours a year, in the specialized domain of AI, and 30 over three years; keep the designation you applied with active; pay the annual maintenance fee (US$20 for ISACA members and US$35 for nonmembers, one fee however many ISACA Advanced certifications you hold); and comply with the annual CPE audit if you are selected.

Source: ISACA Maintain AAIA Certification page

What are the AAIA’s 23 tasks?

ISACA’s exam content outline has three domains and 17 topics, and lists 23 supporting tasks apart from them, from evaluating impacts, opportunities and risk when integrating AI solutions within the audit process to evaluating that awareness programs align to the organization’s AI-related policies and procedures. The tasks are not tied to topics, and the outline gives the domains their shares of the exam and the tasks none. QualExam’s lessons follow the 17 topics.

Source: ISACA AAIA Exam Candidate Guide, pages 22 and 23

What does QualExam offer for the AAIA, and what doesn’t it?

Lessons mapped to the exam content outline’s 17 topics, practice questions in the exam’s format of four options with one best answer, flashcards, and a timed mock exam of 90 questions on one 150-minute clock that draws each domain at its share. Every question here is original; none is AAIA exam content, which ISACA’s Terms of Use forbid candidates to copy, recreate or share. QualExam is an independent study resource, not one of ISACA’s Accredited Training Organizations, and is not affiliated with, endorsed by, or sponsored by ISACA.

Source: ISACA AAIA Exam Candidate Guide, pages 4, 10, 12 and 22

Articles

Articles.

All 18 articles

Sources

Where this comes from.

Every figure above is taken from the documents below, pinned by hash so a revised edition shows up as a change. Where ISACA’s own sources disagree with each other, the controlled document wins and the disagreement is recorded.

ISACA gives each of its three domains a share of the exam and gives the 17 topics within them no weight of their own. The weights here split each domain’s share evenly between its topics, so each domain keeps ISACA’s share: 33%, 46% and 21%. Where a share does not divide evenly, a few topics take one point more than the others.
Some of the 90 questions are unscored pre-test items, which do not count toward the score. ISACA does not say how many.
ISACA reports a scaled score from 200 to 800, with 450 or higher to pass. A scaled score converts the number of questions answered correctly to a common scale, and ISACA publishes no percentage for 450.
ISACA allows one break of up to 10 minutes, but its timer keeps running, so the mock here runs the 150 minutes on one clock, as the exam does.
Every holder of an active CISA qualifies for the AAIA. Holders of 15 other designations qualify with an IT audit or IT advisory role, among them the CIA, the US CPA, the ACCA and FCCA, the Canadian CPA, and CPA Australia’s CPA and FCPA. ISACA has added designations since the launch, so its AAIA page has the current list.
Certifying takes a pass, the US$50 application fee, an application within five years of passing, and compliance with ISACA’s Information Systems Auditing Standards. To keep the certification, the qualifying designation must stay active.
Residents of India, mainland China and Hong Kong can take the AAIA only at a test center; remote proctoring is not offered to them. Remote proctors communicate in English only.
ISACA offers the AAIA exam in English, Simplified Chinese and Spanish. This course is in English.
ISACA’s candidate guide says that one six-month extension of the eligibility period can be bought for US$75, and on a later page that “No eligibility extensions are allowed.” QualExam follows the specific rule: one extension, for US$75.
ISACA sells a review manual, an online review course and a question database for the AAIA. None of them is used here; every lesson and question is original.
The lessons were written in July and August 2026. Where a law they cover has changed since, as the EU AI Act has, the lesson gives the rule in force and names the act that changed it.

The AAIA™ is a certification of ISACA®. QualExam is an independent study resource, not one of ISACA’s Accredited Training Organizations, and is not affiliated with, endorsed by, or sponsored by ISACA. Every question here is original; none is AAIA exam content.

By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.

Source: ISACA AAIA Exam Candidate Guide

Last checked against the source: October 25, 2026

A full refund within 14 days.

No reason needed.

If paid access is not working for you, write to us within 14 days of the payment and we refund it in full, to the way you paid.

Start the AAIA free.

A free account opens AI models and requirements in full, plus the diagnostic and your plan. Every public page stays free to read.