AAIA study guide and review manual: what's free

There is no single free AAIA study guide that teaches the content, but there is more free material than most candidates use. ISACA gives away its candidate guide, its exam content outline, a 12-question practice quiz and the fifth edition of ITAF, its IT audit framework. It sells the AAIA Official Review Manual, in print and as a browser-based eBook, in four languages. And the frameworks and laws an AI audit draws its criteria from, from NIST's AI Risk Management Framework to the EU AI Act, are free from their publishers. This guide sets out what each is, what it covers and what it does not, from ISACA's own pages and store, and says why a free PDF of the review manual is a warning sign rather than a bargain.

The short answer

ISACA's free documents: the AAIA Exam Candidate Guide (a PDF covering registration, exam day, scoring and the rules, with the outline in its appendix), the exam content outline, and a free practice quiz of 12 questions.
ISACA's book: the AAIA Official Review Manual, which ISACA's store calls "a comprehensive reference guide designed to help individuals prepare for the AAIA exam". It comes in print and as an eBook in English, Spanish and Japanese, and as an eBook in Chinese, at US$89 for members and US$105 for nonmembers.
The eBook is not a download. ISACA: "This is an electronic book designed to be accessible anytime through your browser without the need for downloads or printing".
The free sources an AI audit draws on: ISACA's ITAF, NIST's AI Risk Management Framework and its generative AI profile, OWASP's Top 10 for LLM Applications and the EU AI Act are all free from their publishers. ISO/IEC 42001 is sold, though ISO's page describing it is free.
A free PDF of the review manual is not ISACA's. ISACA sells the manual and serves its eBook in a browser; ISACA's own advice is to "avoid unauthorized training materials".

What is the AAIA Review Manual?

It is ISACA's own book for the exam. ISACA's store describes it as "a comprehensive reference guide designed to help individuals prepare for the AAIA exam", and adds that "This edition is organized to supplement understanding of the essential concepts in-line with the exam", covering the three domains of ISACA's outline: AI Governance and Risk, AI Operations, and AI Auditing Tools and Techniques.

On who wrote it, the store says: "ISACA has developed this AAIA certification training material in cooperation with its global network of experts in the field of IT audit and AI." On how to use it: "This manual is an excellent stand-alone document for individual study and can be used as a guide or reference for study groups and chapters conducting local review courses."

The store's one-line summary of AI Operations names four of the domain's seven topics: data management, solution development, threats and vulnerabilities, and change management. The outline's list also has supervision, testing techniques and incident response. Check any book against the outline, not against its own blurb.

Formats and languages. ISACA's store lists seven versions: print and eBook in English, Spanish and Japanese, and an eBook in Simplified Chinese. The English print edition carries ISBN 9798892270472, and the English eBook ISBN 9798892270489, which is a simple way to check that a copy you are offered is ISACA's. One thing to check before you buy in another language: the candidate guide lists the exam itself in English, Simplified Chinese and Spanish, so if you plan to study in Japanese, confirm the exam languages offered when you register.

Price. When we checked on October 26, 2026, ISACA's store data listed each version at US$89 for members and US$105 for nonmembers, with the Chinese eBook at US$95 for members. The candidate guide says membership brings "savings on ISACA products like Certification Exams, Conferences and Exam Prep materials". Check the store for the current figure; every AAIA fee puts the manual beside ISACA's other products.

The eBook. It is "accessible anytime through your browser without the need for downloads or printing", and ISACA adds a warning worth taking: "Please review the FAQs to ensure you understand the requirements prior to purchase, as all sales are final." If you want to annotate a printed page, buy the print edition; the eBook will not give you one.

Is there an AAIA study guide PDF?

Yes, but it is not a content book. ISACA publishes the AAIA Exam Candidate Guide as a free PDF, and its overview says what it is for: it "contains important details ISACA Exam Candidates need to know before exam day administration, including scheduling information, exam eligibility and exam day rules." It has four sections, an introduction, registration and scheduling, exam preparation and after the exam, and it prints the exam content outline in its appendix. ISACA's candidate-guides page links it in English, Simplified Chinese, Japanese and Spanish.

What the guide does not do is teach the 17 topics. For that you need a content source: the review manual, a course, or your own reading of the frameworks below.

As for the review manual itself, ISACA does not sell it as a downloadable PDF: the eBook reads in a browser "without the need for downloads or printing". A file presented as a free AAIA review manual PDF did not come from ISACA's store. ISACA's article on exam integrity is direct about material like that: "it is essential for test-takers to avoid unauthorized training materials". Beyond the rules, such a file may be an old draft, a different exam's book or someone's notes under ISACA's title, and you cannot tell which.

What ISACA gives away free

Five things, all from ISACA:

The AAIA Exam Candidate Guide, the edition ISACA's candidate-guides page links. Read it once early, for the rules, and once in the last week, for exam day.
The AAIA exam content outline, on its own page and in the guide's appendix: three domains with their shares, 17 topics and 23 tasks. It is the closest thing to a syllabus ISACA publishes, and the best checklist you will have.
A practice quiz. ISACA's AAIA page: "Test your knowledge with these 12 free questions."
Study groups, for members. "This member-exclusive online forum acts as a global virtual study group for those preparing to take the AAIA certification exam."
ITAF, 5th Edition. ISACA's IT audit framework, revised in February 2026, is free from ISACA's store; its release invites readers "To access the complimentary ITAF". ISACA's ITAF for the AAIA explains where it meets the exam.

ISACA's paid preparation is the review manual, the questions database ("a comprehensive 200+ question database"), the online review course and a virtual workshop, which ISACA calls an "in-depth virtual training event that covers key concepts and content included in the AAIA certification exam". None of them is required to take the exam.

The free sources an AI audit leans on

ISACA's outline gives topic 1E as "Leading Practices, Ethics, Regulations, and Standards for AI", but it names no law, framework or standard under it. The ones an AI audit most often takes its criteria from are free from their publishers, with one exception, and they are the primary sources behind any good book or course.

NIST AI 100-1, the AI Risk Management Framework (AI RMF 1.0). NIST says "The Framework is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic", and it organizes AI risk work into four functions. NIST's page adds that "The AI RMF 1.0 is being revised". The NIST AI RMF for AAIA candidates reads it from the auditor's side.
NIST AI 600-1, the generative AI profile, which applies the framework to generative AI.
OWASP's Top 10 for LLM Applications 2026, published August 4, 2026. OWASP says "This list is a consensus product", now weighed against incident data. The OWASP LLM Top 10 for the AAIA goes through the ten.
The EU AI Act, in the Official Journal, with the amending regulation published on July 24, 2026 and a consolidated text of July 27, 2026. The EU AI Act for the AAIA covers what an auditor needs.
ISO/IEC 42001:2023, the exception: ISO sells the standard, at CHF 225 on its page, but the page itself, which says what the standard specifies and who it is for, is free. ISO/IEC 42001 for the AAIA covers what an auditor can use without buying it.

These are long documents, and you do not need to read them end to end. Read each for its structure and purpose, then go deep only where the outline's tasks point: audit standards for ITAF, risk management for NIST, application risks and their controls for OWASP, obligations and dates for the Act, and the management system's requirements for ISO/IEC 42001.

A sample question: what each document is for

Knowing what each document is for is also how the exam tests governance. Here is a question in its shape, on the documents that make an AI program auditable:

How the exam asks it

At a logistics company, the data science team follows detailed, well-kept procedures for validating its models before release. The company has no AI policy, and no standard sets what a validation must cover. Which of the following is the MOST significant concern for the IS auditor?

A. The procedures are too detailed for every member of the data science team to apply them the same way.
B. The procedures should be recast as guidelines, so the team can adapt them to each model it releases.
C. No approved policy or standard sits above the procedures, so nothing governs what they must achieve.
D. The procedures stop at validation, so the team also needs procedures for monitoring models after release.

Answer: C. Each layer of the policy hierarchy takes its authority from the one above it: the policy states direction and assigns accountability, standards make it measurable, and procedures give the steps. Procedures with nothing above them are the team's own habit, however well kept: no one with the authority to set direction approved them, and no standard says what a validation must prove. The remedy starts at the top, with an approved policy and standards that set what validation must cover. Detail (A) is not a weakness in itself; recasting the steps as guidelines (B) would make the only control there is optional; and monitoring (D) may need procedures too, but that gap is narrower than having no policy or standard at all. Written for this guide in the exam's shape; it is not an ISACA question.

Is the review manual enough on its own?

ISACA's store calls it "an excellent stand-alone document for individual study", and as a reference to the outline's content it is the most direct source there is. Two things it cannot do by itself are worth planning for.

The first is practice. A reference book explains concepts; the exam asks you to choose between options that are each partly right, 90 times, on one clock. That skill comes from questions with rationales and from at least one timed mock, which is why ISACA also sells a questions database alongside the manual.

The second is currency. The criteria an AI auditor applies move faster than any printed book: ISACA published ITAF's fifth edition on February 26, 2026, the EU amended its AI Act by a regulation published on July 24, 2026, and OWASP published a new edition of its Top 10 for LLM Applications on August 4, 2026, all after ISACA launched the AAIA on May 19, 2025, and NIST is revising its framework. Whatever edition of the manual you buy, read the current versions of the free sources alongside it for anything that has changed.

How to use the review manual well

If you buy the manual, it works best as one part of a plan rather than the whole of it.

Start from the outline, not page one. Read the 23 tasks first, then use the manual's chapters to fill the gaps you find, spending the most time on AI Operations, at 46% the heaviest domain, and on the topics you know least.
Read actively. After each section, write two or three sentences in your own words on what an auditor would test or conclude, not just what the terms mean. The exam asks for judgments.
Pair it with questions. The manual explains; it does not rehearse the format. Questions with rationales for every option are what turn reading into the habit of choosing "one best answer", in the guide's phrase.
Use it as a reference late. In the last two weeks, go back to it only for the topics your practice results show are weak.

AAIA study notes and flashcards

Searches for AAIA notes usually mean one of two things: someone else's summary, or a way to keep what you have read. Someone else's notes have the PDF problem in miniature: you cannot tell what edition, what exam or what errors they carry. Your own notes are worth more. A good format is one page per outline task: what the task asks, the evidence or controls it involves, and one example of how a question might frame it. Twenty-three pages, written by you, are a better final-week review than any download.

Flashcards do the same job for terms and lists. Our course has 549 of them, mapped to the outline's topics and scheduled by spaced repetition, so the cards you find hard come back sooner.

Which materials do you need?

A sound minimum, for a CISA or other qualifying credential holder:

ISACA's free candidate guide and outline.
One structured content source: the review manual, ISACA's online review course, or a course mapped to the outline.
A practice bank with rationales, and at least one timed mock.
The free frameworks above, read for purpose and structure, with ITAF for the audit standards.

ISACA's questions database is a useful addition if you want ISACA's own phrasing, and a member study group if you learn by discussion. How to study for the AAIA puts these into a 4-week plan, and AAIA training compares ISACA's courses with self-study.

Where to start

The quickest test of any material is to try it. A free account opens AI models and requirements in full, lessons, questions and flashcards, plus a short diagnostic that asks about all 17 topics. The AAIA exam guide shows every topic and lesson. Full access to all 18 lessons, 619 questions and 549 flashcards is a single payment, with nothing to renew. For ISACA's security credential, AAISM study guide and review manual covers the same ground.

By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.