AAIA vs CISA: ISACA's two audit credentials

The AAIA and the CISA are not rivals. The CISA is ISACA's broad credential for IT auditors; the AAIA is an advanced credential for auditing AI, and one of the ways to qualify for it is to hold a CISA. Most people comparing them are really asking two questions: whether to add the AAIA to a CISA they already hold, and, if they hold neither, which comes first. This guide answers both from ISACA's own pages, side by side.

The short answer

• The CISA is broad; the AAIA is deep. The CISA covers IT audit across five domains; the AAIA covers the audit of AI across three.
• The AAIA requires a credential first. You must hold an active CISA, or one of a list of audit and accounting designations with an IT audit or IT advisory role, before you can register for the AAIA exam.
• The CISA asks for experience instead. To be certified, you need "five or more years of professional information systems auditing, control or security work experience", though ISACA's guide adds that "Experience waivers are available for a maximum of three (3) years."
• The CISA exam is longer: 150 questions in 4 hours, against the AAIA's 90 in 150 minutes. Both report on ISACA's scale of 200 to 800, with 450 to pass.
• The AAIA costs less to take and to keep, but it is held on top of another credential, so its upkeep adds to the CISA's rather than replacing it.

The two at a glance

The figures are ISACA's, from the pages listed in the sources. Our guides to every AAIA fee and AAIA certification requirements go further on the AAIA's side.

What the CISA covers

ISACA's CISA page calls the credential "world-renowned as the standard of achievement for auditing, monitoring, and assessing IT and business systems". Its exam content outline has five domains:

It is a general IT audit credential: the audit process, IT governance, the system life cycle, operations and resilience, and security. AI is not one of its domains, though the CISA page says the credential "also acknowledges the importance of emerging technologies".

What the AAIA adds

The AAIA's outline has three domains: AI Governance and Risk (33%), AI Operations (46%) and AI Auditing Tools and Techniques (21%). ISACA's launch announcement describes it as "the first advanced audit-specific artificial intelligence certification designed for experienced auditors", built on "the rigorous standards behind renowned credentials like Certified Information Systems Auditor (CISA)".

The overlap with the CISA is easiest to see in the audit itself. The CISA's first domain lists, among its subtopics, "Audit Testing and Sampling Methodology", "Audit Evidence Collection Techniques" and "Audit Data Analytics". The AAIA's third domain has topics with almost the same names: Audit Testing and Sampling Methodologies, Audit Evidence Collection Techniques, and Audit Data Quality and Data Analytics. The difference is the subject. In the AAIA, the population being sampled is a model's decisions, the evidence includes logs and model documentation, and the analytics include recomputing a model's fairness and drift. The method is familiar to a CISA; the system it is applied to is not.

The rest of the AAIA is new ground for most CISA holders: how models are built and fail, AI governance and risk, data management for AI, change control for models, supervision of AI outputs, testing techniques, AI-specific threats and incident response.

How the two exam days compare

The two exams are run the same way. Both candidate guides say ISACA's certification exams are "administered at authorized PSI testing centers globally or as remotely proctored exams", both give you "a six-month eligibility period" from registration, and both describe the same question: "Every question has a stem (question) and four options (answer choices)", and "All questions are designed with one best answer."

The differences are in length and weight. The CISA's 150 questions in 240 minutes come to about 96 seconds a question; the AAIA's 90 in 150 minutes, about 100 seconds. So the pace is almost the same, but the CISA asks you to hold it for four hours rather than two and a half. Both report the result on "a common scale from 200 to 800", and both pass at 450, "the minimum standard of knowledge".

Where the weight falls differs more. The CISA puts its heaviest shares, 26% each, on operations and resilience and on the protection of information assets. The AAIA puts 46% on AI Operations. A CISA holder who found security and operations the hard part of the CISA will meet their AI equivalents as the hard part of the AAIA: data management, change control for models, supervision, testing, threats and incidents, all for AI systems. Our guide to how hard the AAIA exam is goes through each.

If you hold neither credential

There are two roads to the AAIA, and which one you take depends on what you already hold.

• Through the CISA. Pass the CISA exam, build or document the five years of IS audit, control or security experience it asks for (ISACA can waive up to three of them), apply for the CISA, then register for the AAIA. It is the longer road, but it is the one most IT auditors are already on.
• Through an audit or accounting designation. If you hold a CIA, a US CPA or one of the other listed designations and work in an IT audit or IT advisory role, you can register for the AAIA directly. ISACA widened the list in July 2025, when "Six additional global credentials" were added, among them the ACCA and FCCA, the Canadian CPA, CPA Australia's CPA and FCPA, and the Japanese CPA; the current candidate guide names further accounting bodies again.

Either way, the AAIA comes second. It is built for people who already audit, and its questions assume that you do.

Which comes first?

For most people, the CISA. The AAIA is closed to anyone without a qualifying credential, and the CISA is the one that ISACA's AAIA page names first: "To qualify for AAIA, candidates must either hold a CISA certification or one of the following designations with an IT audit or IT advisory role focus". The launch announcement put it the same way: "Those with an active CISA from ISACA, CIA from IIA, and CPA from AICPA are eligible to pursue the AAIA". The list has since grown to further accounting designations.

The two prerequisites work differently, which matters for timing:

• The CISA lets you pass the exam before you have the experience: "Candidates have five years from passing the exam to apply for CISA certification", and the five years of work experience are needed when you apply.
• The AAIA needs the prerequisite before you register: ISACA's AAIA page says "AAIA candidates must hold an active CISA certification or a qualified designation from the list above."

So a CIA or a CPA in an IT audit or advisory role can go straight to the AAIA. Someone with neither has to earn a qualifying credential first, and for an IT auditor that is usually the CISA.

Should a CISA holder add the AAIA?

If AI systems are entering your audit plan, the AAIA is the natural next step, and the questions are the same ones any credential raises: will you use it, and will you keep it up? Three points are specific to a CISA holder.

The exam builds on what you know. The AAIA's audit domain is the CISA's audit process applied to AI, so a CISA holder starts with an advantage there. The new learning is AI Operations, which is 46% of the exam.

The upkeep adds up, but partly overlaps. Both maintenance pages allow hours to count toward more than one ISACA credential when they fit: the CISA's says that using hours "towards meeting the CPE requirements for multiple ISACA certifications is permissible when the professional activity is applicable to satisfying the job-related knowledge of each certification". AI audit training that meets the AAIA's 10 hours may also count toward the CISA's 20, if it fits both.

The same standards apply. The CISA's maintenance page asks holders to "Abide by ISACA's IT Auditing Standards", and the AAIA's candidate guide lists "Compliance with the Information Systems Auditing Standards" among its steps to certification. ISACA's ITAF explains where those standards are published.

How an AAIA question differs from a CISA one

A CISA would recognize the task in this question; the AI is what changes the answer:

Where to start

If you hold a CISA or another qualifying credential and AI is in your audit plan, start with the AAIA's AI content, since the audit method is the part you already have. A free account opens AI models and requirements in full, lessons, questions and flashcards; how to study for the AAIA sets out a plan of about 29 hours, and full access is a single payment with nothing to renew. For ISACA's other AI credentials, AAISM vs AAIA vs AAIR compares all three.