The AAIA is hard in a particular way. It is not a beginner's exam: only auditors who already hold a CISA or one of a list of audit and accounting credentials may take it, and it assumes their audit judgment while testing whether they can apply it to AI. This guide sets out what makes it difficult, using only what ISACA publishes about it, and what that means for how you prepare.
The short answer
- No pass rate is published. The candidate guide gives none, and it says "Question-level results cannot be provided", so any figure for the exam's difficulty from outside ISACA is an estimate.
- It is an advanced exam with a gate. ISACA calls the AAIA a certification "designed for experienced auditors", and only holders of a CISA or a listed audit or accounting designation may take it.
- Every question asks for the best answer, not just a correct one. There are four options, "All questions are designed with one best answer", and a qualifier such as MOST or BEST often decides between options that are each partly right.
- The heaviest domain is the least like a traditional audit. AI Operations is 46% of the exam, against 33% for governance and risk and 21% for audit tools and techniques.
- 450 passes on a scale from 200 to 800, and 450 is not a percentage. ISACA publishes no conversion from questions answered correctly to the scaled score.
- No study hours are published. Our own plan for the AAIA comes to about 29 hours.
- A fail costs the full fee again. You have four attempts in a rolling 12 months, with a wait of 30 days before the second and 90 days before each after that.
Is the AAIA exam difficult?
ISACA's documents describe the exam; they do not rate it. What they describe is an exam for experienced people. ISACA's launch announcement introduced the AAIA as "the first advanced audit-specific artificial intelligence certification designed for experienced auditors". The candidate guide says it is "Designed for IT Audit professionals with a CISA, CIA (IIA) or CPA (AICPA) certification looking to gain recognition for their expertise". And ISACA's AAIA page sets the condition: "To qualify for AAIA, candidates must either hold a CISA certification or one of the following designations with an IT audit or IT advisory role focus".
That shapes the difficulty. The AAIA does not teach audit from the start. It takes for granted the thinking an experienced auditor already has, such as criteria before findings, evidence that is sufficient and appropriate, and independence, and asks you to apply it to AI systems. The guide says so in its description of the questions: "Exam questions are developed with the intent of measuring practical knowledge and the application of general concepts and standards." A candidate who knows the vocabulary of AI but has never weighed audit evidence will find the exam hard; so will an auditor who has never looked at how a model is trained, monitored or attacked.
ISACA gives one more clue. Its free practice quiz, it says, includes questions "that are the same level of difficulty you can expect on ISACA's official" AAIA exam. Taking it is a fair way to calibrate yourself before you plan your study. (We use it as a format reference only and never reproduce its questions.)
What is the AAIA pass rate?
Not published. The candidate guide, ISACA's AAIA page and its outline page contain no pass rate, and the guide adds that "Question-level results cannot be provided". Any site that states a pass rate for the AAIA is estimating from its own customers or inventing a number.
What ISACA does publish is how the result is expressed. "A scaled score is a conversion of a candidate's raw score on an exam to a common scale." ISACA uses a scale from 200 to 800, and "You must receive a score of 450 or higher to pass the exam which represents the minimum standard of knowledge." The number of correct answers that equals 450 is not published. A page that turns 450 into a percentage of 90 questions is guessing.
What makes the AAIA hard
Five features of the exam, each from ISACA's own description.
The best answer, not a correct one. The guide is plain about the format: "Every question has a stem (question) and four options (answer choices)", and "All questions are designed with one best answer." It warns that "An exam question may require you to choose the appropriate answer based on a qualifier, such as MOST likely or BEST." In an AAIA question, the wrong options are rarely absurd. Several will be things an auditor might well do; the qualifier asks which one comes first, or which one answers the question asked.
Three domains, one of them nearly half the exam. The outline gives AI Operations 46% of the exam, about 41 of the 90 questions, across seven topics from data management to incident response. ISACA's description of the domain is broad: "This domain confirms your skill in assessing an organization's risk profile and the rewards and consequences of AI implementations while ensuring the organization is operationally ready for successful adoption of this powerful technology." For most auditors this is the least familiar ground, because it is where the AI itself lives: training data, change control for models, supervision of outputs, testing, threats and incidents.
Audit, applied to AI and done with it. The third domain, AI Auditing Tools and Techniques, is the audit itself, but ISACA's description reaches beyond method: "This domain focuses on optimizing audit outcomes through innovation while highlighting your knowledge of audit techniques tailored to AI systems and your use of AI-enabled tools to streamline audit efficiency and provide faster, quality insight." Two of the outline's tasks ask you to "Evaluate impacts, opportunities, and risk when integrating AI solutions within the audit process" and to "Utilize AI solutions to enhance audit processes, including planning, execution, and reporting". An experienced auditor knows sampling and evidence; the exam asks how they change when the population is a model's decisions and when the auditor's own tools use AI.
Frameworks the outline does not name. Topic 1E is "Leading Practices, Ethics, Regulations, and Standards for AI", and the outline names no law, framework or standard under it. You have to decide which to learn, and the field keeps moving: the EU amended its AI Act by Regulation (EU) 2026/1744 in July 2026, NIST says "The AI RMF 1.0 is being revised", and OWASP published a 2026 edition of its Top 10 for LLM Applications in August 2026. Our guides to the EU AI Act, the NIST AI RMF and the OWASP list cover them from the auditor's side.
One clock for 90 questions. The guide gives "2.5 hours (150 minutes), 90 multiple choice questions", which is 100 seconds a question, and the one break you may take does not stop the timer. Its advice: "Budget your time. Pace yourself to complete the entire exam." Scenario questions take longer to read than definitions, so the time goes faster than the arithmetic suggests.
How the hard questions look
Most of the difficulty sits in questions like this one, where every option is something an organization might do and only one handles the risk properly:
How long does it take to prepare for the AAIA?
ISACA publishes no figure. Our course's estimate is about 29 hours: about 3 of reading, 21 of practice and 5 for two timed mocks, which is 4 weeks at about 7 hours a week. Your own figure depends on your background. An auditor new to AI should give AI Operations more than its share; a data scientist turned auditor may move faster there and slower on audit method. How to study for the AAIA sets out the plan week by week.
How is the AAIA exam scored?
The guide reports every result on one scale: "ISACA uses and reports scores on a common scale from 200 to 800." Three details matter for your strategy:
- One total decides. "Exam scores are based on the total number of exam items answered correctly, regardless of domain." There is no separate passing score per domain.
- Domain results are a guide only. "Domain level results are provided for informational purposes only."
- Wrong answers cost nothing extra. "There are no penalties for incorrect answers", so never leave a question blank.
Our guide to AAIA format and scoring explains the scale, the break and the exam-day rules in full.
How can I prepare for and pass the AAIA exam?
- Study by the outline's shares, spending most on AI Operations.
- Learn the AI, then apply your audit judgment to it. Know how a model is built, changed, monitored and attacked, then practice what an auditor concludes about each.
- Practice with questions that explain every option, so you learn why the near-misses are wrong.
- Take two timed mocks of 90 questions in 150 minutes, and spend the last days on the topics they show are weak.
- Book the exam when your mocks say you are ready, not before: registration gives you six months to take it.
What happens if you fail?
The guide's retake policy allows "4 attempts within a rolling twelve-month period to pass the exam", and "candidates must pay the registration fee in full for each exam attempt." After a first attempt, "Customers must wait 30 days from the date of the first attempt"; after the second and third, the wait is 90 days. Every AAIA fee is listed separately, and an extra week of preparation costs less than a retake.
Where to start
Our AAIA course is built around the hard parts: 18 lessons on the outline's 17 topics, 619 questions whose rationales explain the right answer and why each wrong one falls short, and a 90-question mock on one 150-minute clock that draws each domain at its share. A free account opens AI models and requirements in full, lessons, questions and flashcards, so you can judge the difficulty for yourself; full access is a single payment with nothing to renew. If you are still deciding whether to take it, is the AAIA worth it sets out what ISACA publishes on its value. For ISACA's other AI exams, how hard is the AAISM exam takes the same approach.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.