AAIA certification requirements and eligibility

The AAIA is not open to everyone who passes its exam. It is an advanced certification for people who already hold a qualifying audit or accounting designation: every holder of an active CISA qualifies, and so do holders of 15 other designations, from the CIA and the US CPA to accountancy designations from the UK, Canada, Australia, New Zealand, Nigeria, Japan and Hong Kong, as long as they work in an IT audit or IT advisory role. This guide sets out who qualifies, how the list has grown since the AAIA's launch, the six steps from exam to certificate, and what it takes to keep the AAIA once you have it.

The short answer

• Every active CISA holder qualifies. ISACA's list begins "All holders qualify" and names the CISA.
• So do 15 other designations, with a role condition. Holders of the CIA, the US CPA and 13 accountancy designations qualify "as long as you have an IT audit or IT advisory role".
• The designation must be active, when you apply and for as long as you hold the AAIA.
• Pass the exam, then apply within five years, with a one-time US$50 application processing fee.
• Agree to ISACA's rules: its Code of Professional Ethics, its continuing education policy and its Information Systems Auditing Standards.
• Keep it with continuing education: at least 10 hours a year in AI, 30 over three years, and an annual fee.
• No years-of-experience rule is stated. Neither the guide nor ISACA's AAIA pages set a number of years; the qualifying designation is the entry condition.

Who qualifies

The guide's "How to become Certified" section puts the condition first: "Have an active credential from the" qualified prerequisite list, which it then gives in two parts. The CISA stands alone: under "All holders qualify" the guide lists "CISA (Certified Information Systems Auditor from ISACA)". For everyone else there is a role condition: "If you do not have a CISA but hold one of the following credentials, you are qualified as long as you have an IT audit or IT advisory role".

ISACA's AAIA page gives the same 15 under "Holders with an IT audit or IT advisory role focus", and it applies the condition from registration: in its section on registering, the page says "AAIA candidates must hold an active CISA certification or a qualified designation from the list above."

What counts as an IT audit or IT advisory role

ISACA does not define the phrase in the guide or on its AAIA pages. If your role is close to the line, for example an internal auditor who reviews IT controls part of the time, or an accountant advising clients on technology risk, ask ISACA before you register rather than after you pass.

If you hold none of these

The AAIA page has a short answer for candidates without a qualifying designation: "Don't yet qualify for AAIA? EXPLORE CISA". The CISA is the route ISACA itself points to, and once you hold it, the AAIA has no role condition.

How the list has grown

The list was much shorter at launch. ISACA's May 2025 announcement said that "Those with an active CISA from ISACA, CIA from IIA, and CPA from AICPA are eligible to pursue the AAIA." The page now carries a note at the top: "The AAIA prerequisites have been updated."

In July 2025 ISACA announced "Six additional global credentials now included among prerequisites": the ACCA and FCCA, the Canadian CPA, CPA Australia's CPA and FCPA, and the Japanese CPA. The current list adds seven more: ICAEW's ACA and FCA, ANAN's CNA, CA ANZ's CA and FCA, and HKICPA's CPA and FCPA, for 15 alongside the CISA.

Two traces of the older lists remain in ISACA's own documents. The program summary on page 4 of the candidate guide still describes the AAIA as "Designed for IT Audit professionals with a CISA, CIA (IIA) or CPA (AICPA) certification", and the summary sentence on the AAIA page names only eight of the designations before the full list below it. The full lists, on page 20 of the guide and on the AAIA page, are the ones to go by, and because ISACA has added designations twice already, check the AAIA page for the current list before you register.

From exam to certificate: six steps

The guide lists what becoming certified takes, after the qualifying credential:

1. "Pass the Examination: AAIA". The exam is 90 questions in 150 minutes, scored from 200 to 800, and 450 passes; AAIA exam format and scoring has the detail.
2. Pay the application processing fee, US$50, once. ISACA's certification page: "Once your official exam scores have been released, you may pay the application fee and then apply for certification."
3. Submit the application for certification. "Candidates must apply for certification within five years of having passed the exam."
4. "Adhere to ISACA's Code of Professional Ethics, Terms of Use, and Privacy Policy".
5. Adhere to the Continuing Professional Education (CPE) policy for the AAIA.
6. "Compliance with the Information Systems Auditing Standards".

The five years work in two directions. You have five years from passing to apply, and during the same period you cannot retake the exam: "Individuals who pass the exam are restricted from taking the same exam within the application time period of 5 years."

The Information Systems Auditing Standards

The last step marks the AAIA as an auditor's certification: ISACA requires compliance with its Information Systems Auditing Standards. The guide names the requirement without summarizing the standards, so read them on ISACA's site if you have not worked under them before. Our guide to ISACA's ITAF covers the framework in which ISACA publishes its IT audit standards, and how it connects to this step.

Keeping the AAIA

Certification starts a cycle of continuing education and fees. ISACA's maintenance page sets the rules:

• Continuing education. Maintaining the AAIA takes "a minimum of 10 CPEs annually and a total of 30 CPEs over a 3-year period", and the hours must be in AI: "These hours of CPE must be in the specialized domain (AI)". You start reporting "starting the calendar year after they receive the certification", in the words of ISACA's certification page.
• The prerequisite stays active. "Maintain active status on prerequisite certification used to apply for AAIA." If your CISA or other designation lapses, so does your eligibility to hold the AAIA.
• The annual fee. US$20 for members and US$35 for nonmembers, due by January 1, and one fee covers all of ISACA's Advanced certifications.
• The CPE audit. If you are selected, you must provide evidence of the hours you reported, so keep records for at least three years.
• The Code of Professional Ethics, which every member and certification holder agrees to.

Failing these has a cost: "Failure to comply with these certification requirements will result in the revocation of an individual's AAIA designation."

Using the title

Once certified, you can put the letters after your name, but not ISACA's logo on your materials. The maintenance page explains why individual use of the logo is not permitted: "because it can imply endorsement or affiliation on ISACA's behalf of that person's products or services." Instead, "Individuals can use the AAIA acronym after their name".

Questions about AAIA eligibility

Do I need a CISA?

No, if you hold one of the 15 other designations and work in an IT audit or IT advisory role. Yes, if you hold none of them, since the CISA is then the qualifying route ISACA points to. AAIA vs CISA compares the two credentials side by side.

Can I take the exam before I qualify?

ISACA's AAIA page states the requirement in the section on registering: "AAIA candidates must hold an active CISA certification or a qualified designation from the list above." Plan on holding the qualifying designation before you register, and if your situation is unusual, ask ISACA.

How long do I have after passing?

Five years. "Candidates have five years from passing the exam to apply for AAIA certification."

Do I need years of experience?

Neither the guide nor ISACA's AAIA pages sets a number of years. For the CISA route, the active CISA is the condition; for the other 15 designations, it is the designation together with an IT audit or IT advisory role.

A checklist before you register

Most eligibility problems are cheaper to solve before you pay than after you pass:

• Find your designation on ISACA's current list, on the AAIA page, and confirm it is active.
• If it is not a CISA, check your role. The other 15 designations qualify only with an IT audit or IT advisory role; ask ISACA if yours is borderline.
• Match your names. When you create an ISACA account, the guide asks you to "please ensure your name is the same as what appears on your government-issued identification that you will present on exam day."
• Check where you can test. Residents of India, mainland China and Hong Kong must take the AAIA at a test center; everyone else can choose a center or a remote proctor.
• Plan the six months. Registering starts a six-month window to take the exam, with one paid extension at most. AAIA exam dates and registration walks through every step, from registering to exam day.
• Budget for both fees. US$459 or US$599 for the exam, then US$50 to apply once you pass. What the AAIA costs lists every other fee.

What the exam expects of a qualified auditor

Because every candidate is already an auditor or accountant, the exam does not test audit basics for their own sake. It applies them to AI, and to the data and privacy questions AI raises:

Where to start

If you qualify, the exam is the next step, and the best way to judge your readiness is to answer questions in its format. A free account opens AI models and requirements in full, lessons, questions and flashcards, with your progress kept. Our AAIA practice questions cover all 17 topics of ISACA's outline, each with a rationale for every option, and the timed mock runs 90 questions on one 150-minute clock. Full access is a single payment with nothing to renew. For three worked questions with full rationales, see AAIA exam questions.