ISACA's ITAF for AI auditors and the AAIA

Most of what an AI auditor reads is about the subject of an audit: laws, frameworks and threat lists that say what an AI system should do. ISACA's IT Audit Framework, ITAF, is about the auditor: the standards, terms and guidance ISACA sets for how IT audit and assurance work is done. Its 5th edition, published in February 2026, is the first update since 2020 and adds guidance for auditing AI. ISACA's AAIA exam content outline names no framework, but the AAIA's candidate guide lists "Compliance with the Information Systems Auditing Standards" among the steps to certification, and the outline's third domain is the audit itself. This guide covers what ITAF is, what the 5th edition changed, and where it meets the AAIA.

The short answer

• ITAF is ISACA's professional practices framework for IT audit. It sets standards for practitioners, defines the profession's terms, and gives guidance for planning, performing and reporting engagements.
• The 5th edition is current. ISACA published it in February 2026, replacing an edition last updated in 2020. It adds guidance for auditing AI and machine learning, and widens IT audit's scope to data analytics, agile auditing, continuous assurance and AI governance.
• It costs nothing. ISACA calls it "complimentary" and hands it out through its online store.
• The AAIA asks for compliance with ISACA's auditing standards. The candidate guide lists "Compliance with the Information Systems Auditing Standards" as a step to certification, and ITAF is where ISACA publishes its IT audit standards.
• The outline does not name it, but its subject, how an audit is planned, performed and reported, is the outline's third domain, 21% of the exam.

What ITAF is

ITAF's full title says what it is for: the "IT Audit Framework (ITAF): A Professional Practices Framework for IT Audit". ISACA describes it in three parts. It "establishes standards that address IT audit and assurance practitioners' roles and responsibilities, ethics, expected professional behavior, and required knowledge and skills"; it "defines terms and concepts specific to IT audit and assurance"; and it "provides guidance and techniques for the planning, performing and reporting of IT audit and assurance engagements".

The standards are the part that applies to the auditor personally. The press release's subtitle says that "The revised ITAF features ISACA's updated global IT audit standards and guidelines", and its March article is direct about who must follow them: "Adherence with ITAF is a requirement for CISA-certified professionals." The terms give auditors a shared vocabulary, and the guidance and techniques cover how engagements are carried out.

Criteria and conduct

It helps to be clear about what ITAF is not. It is not a framework for managing AI, like the NIST AI RMF; a law, like the EU AI Act; or a list of security risks, like OWASP's Top 10 for LLM Applications. Those are criteria: the yardsticks an auditor holds an AI system against, which an organization adopts or is bound by. ITAF governs the auditor's conduct instead: how the engagement is planned, how its evidence is gathered and judged, and how its conclusions are reported.

An AI audit needs both. Criteria without professional standards give a conclusion nobody can rely on; standards without criteria give a well-run engagement with nothing to measure against. Our guides to the NIST AI RMF, the EU AI Act and the OWASP LLM Top 10 cover the criteria side for AI auditors; this one covers the standards side.

What the 5th edition changed

"ITAF was last updated in 2020", ISACA says, and the technology an auditor examines has changed a great deal since then. ISACA describes the new edition as bringing "updated terminology, refreshed examples, and expanded scope", and groups the changes under four headings:

Taken together, ISACA says the edition "aims to support both traditional assurance functions and modern audit teams using data analytics, automation, agile methods, and AI".

The sampling guideline

The edition also comes with an updated "ITAF Companion Performance Guidelines 2208: Information Technology Audit Sampling". ISACA says it guides auditors "in the design, selection, and evaluation of audit samples to obtain sufficient and appropriate evidence supporting audit conclusions", and that the update better reflects "data-driven and technology-enabled audit sampling approaches". That matters to AI auditors, whose populations are often logs of model decisions far too large to read by hand.

Where ITAF meets the AAIA

The certification step

ISACA's candidate guide sets out six steps from exam to certificate. The last is "Compliance with the Information Systems Auditing Standards", after the exam, the application fee, the application, ISACA's Code of Professional Ethics and the continuing education policy. Our guide to AAIA certification requirements walks through all six.

The guide names the standards without saying where they are published. ITAF is where ISACA publishes its IT audit standards, so, in our reading, ITAF is where an AAIA holder finds the standards that step refers to. For candidates who qualify through the CISA, of which the guide says "All holders qualify", that is familiar ground, since ISACA already requires CISA holders to adhere to ITAF. Candidates who qualify through another credential, such as the CIA or a CPA, "as long as you have an IT audit or IT advisory role", may have worked under other auditing standards, and should read ITAF before applying for the certificate.

The outline's third domain

The AAIA's outline gives its third domain, "AI Auditing Tools and Techniques", 21% of the exam, across five topics:

• Audit Planning and Design
• Audit Testing and Sampling Methodologies
• Audit Evidence Collection Techniques
• Audit Data Quality and Data Analytics
• AI Audit Outputs and Reports

Read in order, they follow an engagement from plan to report, which is the ground ITAF's guidance covers: "the planning, performing and reporting of IT audit and assurance engagements". ISACA does not say the domain is built on ITAF, and the mapping is ours, but a candidate who knows how ITAF frames an engagement will recognize the domain's shape.

Two of the outline's supporting tasks go further, asking the auditor to "Evaluate impacts, opportunities, and risk when integrating AI solutions within the audit process" and to "Utilize AI solutions to enhance audit processes, including planning, execution, and reporting". That is the direction the 5th edition takes too, toward audit teams that use analytics, automation and AI themselves. Mary Carmichael, the lead developer for the 5th edition, writes that the work already means "auditing cloud environments, evaluating AI, using analytics, and advising the business earlier and more often".

The 5th edition's themes in an AI audit

ISACA's public pages describe the themes, not the standards' text, so this section pairs each theme with what our lessons teach about the same stage of an AI audit. The pairing is ours.

• Planning: the skills an engagement needs. The standards address "required knowledge and skills", and an AI engagement often needs data science, statistics or model-validation skill a general audit team lacks. Our planning lesson's rule is that a specialist can fill the gap, but the engagement lead still directs, supervises and reviews the specialist's work and owns the conclusion. A specialist seconded from the team that built the model brings a self-review threat along with the expertise.
• Sampling: enough of the right evidence. The sampling guideline aims at evidence that is "sufficient and appropriate". Our evidence lesson keeps the two apart: appropriate means relevant to the assertion and reliable given its source; sufficient means enough to persuade, given the risk, and never a raw count. Our sampling lesson adds the AI strata: model version, time window (a retrain is a boundary) and cohort, so a failure in one group is not averaged away.
• Data analytics and continuous assurance. The new scope names both. Our analytics lesson teaches reconciling an extract to its source before analyzing it, and recomputing fairness and drift metrics independently rather than trusting the auditee's dashboard; our reporting lesson adds that continuous auditing should stay independent of management's own monitoring.
• Oversight of automated systems. ISACA lists it among the edition's expectations. On the AAIA's outline, oversight of AI outputs, impacts and decisions is topic 2D, Supervision of AI Solutions.
• Reporting. ITAF's guidance runs through reporting, and our reporting lesson teaches the complete finding: condition, criteria, cause, effect and recommendation, with the cause traced to data, model or process.

How to get ITAF

ISACA's press release links the free download from its online store, at ISACA's store page for ITAF, and points to more of ISACA's IT audit resources. Two practical points:

• Check the edition. Study notes and older copies may describe the edition last updated in 2020; the 5th edition replaces it.
• Read the standards first, the guidance second. The standards are what the certification step asks you to comply with; the guidelines, such as the sampling guideline above, show how to meet them.

Common questions about ITAF and the AAIA

Is ITAF on the AAIA exam? The outline names no framework, ITAF included, so we cannot say the exam asks about it by name. What the outline does cover, in its third domain, is the audit itself: planning, testing and sampling, evidence, analytics and reporting.

Do I have to buy ITAF? No. ISACA calls the 5th edition "complimentary", and its March article says the same in plainer words: the framework is free.

I qualify through the CIA, not the CISA. Does ITAF apply to me? The guide's last step applies to every AAIA holder, whatever credential they qualified with. In our reading, that makes ISACA's standards, which ITAF contains, part of the certification for you too.

Is the 2020 edition still usable? For background, perhaps, but it is no longer current. If you are reading ITAF to understand the standards the certification asks for, read the 5th edition.

How the auditor's standards show up in a question

AAIA questions about the audit itself test the auditor's own responsibilities more than any document's name:

Where to start

Our AAIA lessons on audit planning, testing and sampling, evidence, data analytics and reporting teach the methods the outline's third domain covers, with questions that test the judgment rather than the vocabulary. A free account opens AI models and requirements in full, lessons, questions and flashcards; full access is a single payment with nothing to renew. For the steps from exam to certificate, see AAIA certification requirements.