AAIA exam format, scoring and passing score

ISACA's Advanced in AI Audit (AAIA) exam gives you 150 minutes for 90 multiple-choice questions. Each question has four options and one best answer, many of them hinge on a qualifier such as MOST or BEST, and the one break you are allowed comes out of those 150 minutes. Your result is a scaled score between 200 and 800, and 450 passes. This guide sets out the format and the scoring as ISACA's own candidate guide describes them, what they mean for how an auditor should spend the time, and which figures ISACA does not publish, so you can tell a fact from a guess when you meet one elsewhere.

The short answer

• 90 questions, all multiple choice. The guide's program summary gives the exam length as "2.5 hours (150 minutes), 90 multiple choice questions".
• Four options, one best answer. "Every question has a stem (question) and four options (answer choices)", and "All questions are designed with one best answer."
• The qualifier decides close calls. A question "may require you to choose the appropriate answer based on a qualifier, such as MOST likely or BEST."
• One break, and the clock keeps running. You may take one break of up to ten minutes with your proctor's permission. The exam is paused, "but the timer will not stop during your approved break."
• A scaled score, with 450 to pass. ISACA reports scores "on a common scale from 200 to 800", and you "must receive a score of 450 or higher to pass the exam".
• Not every question counts. The exam mixes scored items with pre-test items, which "are not used to calculate your exam score". ISACA does not say how many there are.
• No penalty for a wrong answer. "There are no penalties for incorrect answers."
• Three domains. AI Governance and Risk (33%), AI Operations (46%) and AI Auditing Tools and Techniques (21%).
• Three languages and two ways to take it. English, Simplified Chinese or Spanish, at a PSI test center or with a remote proctor, except for residents of India, mainland China and Hong Kong, who must test at a center.

Who the exam is written for

The AAIA is an advanced credential, so it assumes you are already an auditor. ISACA's AAIA page opens it to every holder of an active CISA, and to holders of 15 other designations, among them the CIA and the US CPA, who work in an IT audit or IT advisory role. AAIA certification requirements lists all of them, with the steps to certify. The exam is written for that reader. ISACA's outline page says its questions test "your ability to address real-world AI related opportunities and challenges", and the guide says questions "are developed with the intent of measuring practical knowledge and the application of general concepts and standards."

The outline's 23 supporting tasks show the angle. Twenty-one of them begin with "Evaluate", from evaluating "the organization's AI policies and procedures" to evaluating "the design and effectiveness of controls specific to AI". The other two are about using AI in your own audit work and advising on its effect on the workforce. Most questions, in other words, put you in the auditor's chair and ask you to judge what an organization has done with AI, not to build the AI yourself.

What an AAIA question looks like

The guide describes the shape in three lines:

• "Every question has a stem (question) and four options (answer choices)."
• "Choose the correct or best answer from the options."
• "The stem may be in the form of a question or incomplete statement."

The word to notice is "best". On an exam about judgment, two or three options are often things a sensible auditor might do at some point, and the qualifier in the stem decides which one is the answer: what you do FIRST, what is MOST important, what gives the BEST evidence. The guide's advice is to "Read the question carefully, eliminate known incorrect answers and then make the best choice possible."

That habit, reading the qualifier first and then testing each option against it, is what the format rewards more than any single fact.

150 minutes on one clock

The guide is plain about time: "Budget your time. Pace yourself to complete the entire exam. You have 2.5 hours to complete the AAIA exam." Ninety questions in 150 minutes is 100 seconds a question.

Before the first question there is a tutorial: "A tutorial of the exam taking experience will be provided after logging onto the testing station and prior to the start of the exam." The guide asks you to pay close attention to it, so that nothing about the screens surprises you later.

The break does not stop the timer

The rules allow exactly one break. In the guide's list of exam-day rules: "One break no longer than ten minutes is permitted with the permission of your proctor. Your exam will be paused, but the timer will not stop during your approved break." The table on leaving the testing area adds, for a trip to the facilities, that "The exam time will not stop, and no extra time will be permitted," and that "Your break must be 10 minutes or less."

A full ten-minute break therefore leaves 140 minutes for 90 questions, about 93 seconds each. A simple way to hold the pace is to check the clock at two points: without a break, about 50 minutes should have gone by question 30 and about 100 minutes by question 60. If you know you will take the break, decide in advance where it goes, so the checkpoints still work after it.

Answer everything

Because a wrong answer costs nothing, a blank answer is a point given away. The guide says it directly: "All questions should be answered. There are no penalties for incorrect answers. Grades are based solely on the total number of questions answered correctly, so do not leave any questions blank."

How the AAIA is scored

ISACA does not report a percentage. "Candidate scores are reported as a scaled score. A scaled score is a conversion of a candidate's raw score on an exam to a common scale." The point of the conversion, the guide says, is that "different versions are comparable and fair". "ISACA uses and reports scores on a common scale from 200 to 800", and the guide fixes three points on it:

• "A score of 800 represents a perfect score with all questions answered correctly."
• "A score of 200 represents the lowest score possible and signifies only a small number of questions were answered correctly."
• "You must receive a score of 450 or higher to pass the exam which represents the minimum standard of knowledge."

Two things follow. First, 450 is not a percentage. The guide gives no conversion from the number of questions you answer correctly to a scaled score, so any page that turns 450 into a percentage is estimating. Second, there is one total and no hurdle per domain: "Exam scores are based on the total number of exam items answered correctly, regardless of domain."

Pre-test items

"ISACA exams are comprised of scored items as well as pre-test items. Pre-test items are not used to calculate your exam score." The guide does not say how many of the 90 are pre-test items or how to tell them apart, so every question deserves the same care.

Your result by domain

Your score report shows how you did in each domain, but "Domain level results are provided for informational purposes only." A weak domain lowers your total; it cannot fail you on its own. The domain breakdown is most useful after a result that did not pass, as a guide to where the next round of study should go.

The three domains behind the questions

The exam content outline splits the AAIA into three domains, each with a share of the exam:

The guide is careful about what the shares mean: "Domain percentages indicate the portion of the exam that reflects that domain content and are not used to calculate exam scores." The counts in the table are simply 33%, 46% and 21% of 90, rounded; ISACA does not say how the pre-test items fall across the domains.

AI Operations is the largest domain by a distance, nearly half the exam. ISACA's outline page describes it as confirming your skill in "assessing an organization's risk profile and the rewards and consequences of AI implementations while ensuring the organization is operationally ready". Under the three domains sit 17 topics: five in the first domain, seven in the second and five in the third. ISACA gives a share to each domain and none to the topics within it. The AAIA exam content outline explained goes through every domain, topic and task.

Where you take it, and the rules that come with it

The guide says that "ISACA certification exams are computer-based and administered at authorized PSI testing centers globally or as remotely proctored exams." The rules are the same in both places, and they are strict:

• Closed book. For a remote exam the guide says "The exam is online, closed book and remotely proctored." Wherever you test, the prohibited items include "Reference materials, study materials, paper, notes, notepads, language dictionaries, or other aids" and "Calculators".
• Nothing to eat or drink. Food and beverages are banned, and the guide spells out that "this includes water, and applies to both on-site and remotely proctored exams".
• At home. You complete a room scan at check-in, then a mirror check of your screen and keyboard. During the exam, "Candidates can communicate with remote proctors in English using a live chat tool during the exam."
• Three regions test at centers only. ISACA's AAIA page says that for residents of India, mainland China and Hong Kong, "The AAIA exam is exclusively available at testing centers."
• Language. The exam is offered in English, Simplified Chinese and Spanish. Changing the language of an appointment means rescheduling it.
• No screenshots. "You are not permitted to take screenshots or photos of any portion of the exam, including the exam results screen."

Booking and exam day

Registration never closes: "Exam registration is continuous, meaning candidates can register any time, no restrictions." From the day you register you have six months to take the exam. You can book an appointment "as early as 48 hours after payment of exam registration fees", appointments open 90 days ahead, and you can reschedule without penalty up to 48 hours before your appointment.

On the day, plan to reach a test center at least 30 minutes early, with a current, original government-issued ID that carries your name, signature and photograph. Arriving more than 15 minutes late forfeits the fee, as does missing the appointment.

Results, rescores and retakes

The headline comes at once: "You will be able to view your preliminary passing status on screen immediately following the completion of your exam." Then "Your official score will be emailed and available online within 10 working days." The report will not list the questions you missed, since "Question-level results cannot be provided."

If you do not pass, you can ask for a rescore within 30 days of the results' release. "Rescores are performed by PSI", and "A fee of US $75 must accompany each request."

You then have more attempts, within limits. "Individuals have 4 attempts within a rolling twelve-month period to pass the exam." After a first attempt that does not pass, you wait 30 days before the second, then 90 days after the second before the third, and 90 days after the third before the fourth. Each attempt costs the full registration fee, US$459 for ISACA members and US$599 for nonmembers, and every other fee is in what the AAIA costs. Once you pass, you cannot take the AAIA exam again within the five years you have to apply for certification, nor while you hold the certification.

What ISACA does not publish

The candidate guide is detailed, but some numbers are not in it:

• A pass rate for the AAIA.
• How many of the 90 questions are pre-test items, or which ones.
• The raw score that equals 450, or any conversion of the scaled score to a percentage.
• A weight for each topic. Only the three domains carry a share.
• How many hours to study.

If a page gives the AAIA a different number of questions, a different length or different domain shares, check it against the guide: ISACA's figures are 90 questions, 150 minutes, and 33%, 46% and 21%.

Where to start

Knowing the outline is half the preparation. The other half is choosing one best answer out of four, 90 times, on a single clock, with the qualifier doing the deciding. ISACA's AAIA page links a free practice quiz of 12 questions from ISACA itself, and it is worth taking. Our AAIA practice questions are written in the same shape, each with a rationale that explains why the right answer is right and why the others fall short, and the timed mock runs 90 questions on one 150-minute clock, drawing each domain at its share of the exam. A free account opens AI models and requirements in full, lessons, questions and flashcards, so you can try the format before paying anything, and full access is a single payment with nothing to renew. For three original questions with full rationales, see AAIA exam questions; for how to take and review a full mock, AAIA practice exam; and for what makes the exam demanding, how hard is the AAIA exam.