AAISM exam format, scoring and passing score

The AAISM exam is 90 multiple-choice questions in 2.5 hours, taken at a PSI test center or at home with a remote proctor. Every question has four options and one best answer, many turn on a qualifier such as MOST or BEST, and the one break you may take does not stop the clock. ISACA reports the result on a scale from 200 to 800, and 450 passes. This guide sets out the format and the scoring as ISACA's own candidate guide describes them, what that means for how you spend the 150 minutes, and what ISACA does not publish, so you know which numbers you will find elsewhere are guesses.

The short answer

• 90 questions, all multiple choice. The guide's summary gives the exam length as "2.5 hours (150 minutes); 90 multiple-choice questions".
• Four options, one best answer. "Every question has a stem (question) and four options (answer choices)", and "All questions are designed with one best answer."
• Watch the qualifier. "A question may require you to choose the answer based on a qualifier, such as MOST likely or BEST."
• One break, and the clock keeps running. One break of up to 10 minutes is allowed with the proctor's permission; the exam is paused, "but the timer will not stop."
• A scaled score, 450 to pass. Scores are reported "on a common scale from 200 to 800", and a candidate "must receive a score of 450 or higher to pass the exam".
• Not every question counts. The exam mixes scored items with pretest items that are "not used to calculate exam scores"; ISACA does not say how many of the 90 are pretest items.
• No penalty for guessing. "There are no penalties for incorrect answers."
• Three domains. AI Governance and Program Management (31%), AI Risk and Opportunity Management (31%) and AI Technologies and Controls (38%).
• In English, Spanish or Japanese, at a PSI test center or remotely proctored, except for residents of India, mainland China and Hong Kong, who must test at a center.

Who can take the AAISM

The AAISM is an advanced credential, and the guide says who it is for: "IT security professionals with a CISM or CISSP certification looking to gain recognition for their expertise in securing enterprise AI solutions and leveraging AI to improve security operations." ISACA's AAISM page puts the condition plainly: "AAISM candidates must hold an active CISM or CISSP certification."

That shapes the exam. ISACA's launch announcement says the credential "builds upon existing security management best practices found in CISM and CISSP and focuses on the associated threat landscape", and the guide describes its questions as "developed with the intent of measuring practical knowledge and the application of general concepts and standards". Expect to apply what a security manager already knows to AI, more than to recall definitions. AAISM certification requirements takes every step, from the prerequisite to renewal.

90 questions, and not all of them count

The exam is 90 questions long. The guide's scoring section adds that "ISACA exams are comprised of scored items as well as pretest items. Pretest items are not used to calculate exam scores." Nothing in the guide says how many there are or how to recognize them, so treat every question as if it counts.

What an AAISM question looks like

The guide describes the shape in three short lines:

• "Every question has a stem (question) and four options (answer choices)."
• "Choose the correct or best answer from the options."
• "The stem may be in the form of a question or incomplete statement."

The phrase that matters is "best answer". When a question turns on a qualifier, more than one option can be partly right, and the qualifier in the stem, a word such as MOST or BEST, decides which one is the answer. The guide's own tip is "Read each question carefully", and its second is to "Eliminate known incorrect answers and then make the best choice possible."

Reading the stem for the qualifier first, then judging each option against it, is the habit the format rewards. Our practice questions mark the qualifier in every stem that has one, so the habit forms before the exam does.

150 minutes on one clock

The guide gives "2.5 hours (150 minutes)" for the 90 questions. That works out at 100 seconds a question, and the guide's advice is blunt: "Budget your time. Pace yourself to complete the entire exam."

Before the first question, "A tutorial of the exam taking experience will be provided after logging onto the testing station before the start of the exam." The guide asks you to pay close attention to it, so you do not miss anything about how the screens work.

The break that does not stop the timer

The AAISM allows one break, and the guide is specific about what it costs: "One break, no longer than ten minutes, is permitted with permission from your proctor. During an approved break, the exam will be paused, but the timer will not stop." The table of reasons for leaving adds, for a trip to the facilities, that "The exam time will not stop, and no extra time will be permitted."

So a full 10-minute break leaves 140 minutes for 90 questions, about 93 seconds each. A simple way to keep pace is to check the clock at fixed points: with no break, about 50 minutes should be gone at question 30 and 100 minutes at question 60. If you plan to take the break, take it early enough that the rest of the pacing still works.

Because a wrong answer costs nothing, never leave a question blank. The guide says so directly: "All questions should be answered. There are no penalties for incorrect answers. Grades are based solely on the total number of questions answered correctly, so do not leave any questions blank."

How the AAISM is scored

ISACA reports a scaled score, not a percentage. In the guide's words, "A scaled score is a conversion of a candidate's raw score on an exam to a common scale", and its purpose is that "different versions are comparable and fair". ISACA uses "a common scale from 200 to 800" and gives three fixed points:

• "A score of 800 represents a perfect score with all questions answered correctly."
• "A score of 200 represents the lowest score possible and signifies only a small number of questions were answered correctly."
• "Candidates must receive a score of 450 or higher to pass the exam, which represents the minimum standard of knowledge."

Two consequences follow. First, 450 is not a percentage, and the guide publishes no conversion from the number of questions you answer correctly to the scaled score. Any figure you meet online that turns 450 into a percentage is a guess. Second, the score is a single total: "Exam scores are based on the total number of exam items answered correctly, regardless of domain."

Your result by domain

Your score report also shows how you did in each domain, but the guide says that "Domain level results are provided for informational purposes only." There is no separate passing score per domain. A weak domain lowers your total; it does not fail you on its own.

The three domains behind the questions

The exam content outline divides the AAISM into three domains, each with a share of the exam:

The guide is precise about what those percentages mean: "Domain-specific percentages indicate the portion of the exam that reflects that domain content and are not used to calculate exam scores." On a 90-question exam, 38% is about 34 questions and 31% about 28, though ISACA does not say how the pretest items fall across the domains. Under the three domains sit 13 topics: five, three and five. ISACA gives no weight to any topic, only to the domains. The AAISM exam content outline explained goes through each domain and topic.

Where and how you take it

The guide says that "ISACA certification exams are computer-based and administered at authorized PSI testing centers globally or as remotely proctored exams." Either way, the same rules apply: "The exam rules apply for tests administered at PSI test center locations and remotely proctored exams."

• Closed book. For remote testing the guide says "The exam is online, closed book, and remotely proctored." Wherever you test, the list of prohibited items includes "Reference materials, study materials, paper, notes, notepads, language dictionaries, or other aids" and "Calculators".
• No food or drink. Food and beverages are prohibited, and the guide adds that "this includes water, and applies to both on-site and remotely proctored exams".
• At home. "Before your online proctored exam begins, you must complete a room scan as part of the check-in process." During the exam, "Candidates can communicate with remote proctors in English using a live chat tool".
• Three regions test at centers only. ISACA's AAISM page says that for residents of India, mainland China and Hong Kong, "The AAISM exam is exclusively available at testing centers."
• Languages. The exam is offered in "English, Spanish, and Japanese". To change language, you reschedule the appointment.

Booking the exam

Registration is open all year: "Exam registration is continuous, meaning candidates can register at any time, no restrictions." Registering starts a six-month window: "from the date you register, you have six months to take your exam." You can book an appointment "as early as 48 hours after payment of exam registration fees", and appointments open 90 days ahead. You can reschedule without penalty up to 48 hours before the appointment. AAISM exam dates walks through registering, scheduling and rescheduling step by step.

Exam day, in brief

• Arrive early at a test center. The guide's checklist includes "Planning to arrive at least 30 minutes prior to the exam start time".
• Bring the right ID. It must be a "current, valid, and original government-issued ID" carrying your name, signature and photograph, and the first and last name must match the name you registered with. "Digital IDs and Military IDs are not accepted." Without an acceptable ID you are turned away and lose the fee.
• Do not be late. The fee is forfeited "if the testing appointment is missed, or if the candidate is more than 15 minutes late for a testing appointment."
• Testing at home? Run the compatibility check before exam day; on a company device you may need your IT department's approval "to download the secure browser".
• Need accommodations? Ask during registration, and no later than four weeks before your preferred date.

When you get your result

You will not wait long for the headline: "Candidates will be able to view your preliminary passing status on screen immediately following the completion of your exam." The official result follows: "The official score will be emailed and available online within 10 working days." The guide also says that "Question-level results cannot be provided", so the score report will not tell you which questions you missed.

If you do not pass, you can ask for a rescore within 30 days of the results, and "A fee of US$75 must accompany each request."

If you do not pass

"Individuals have four attempts within a rolling 12-month period to pass the exam." After a first attempt that does not pass, you wait 30 days before the second, then 90 days after the second before the third, and 90 days after the third before the fourth. ISACA adds that "candidates must pay the registration fee in full for each exam attempt", which is US$459 for ISACA members and US$599 for nonmembers. Every fee, retakes included, is in what the AAISM costs.

What ISACA does not publish

Prep pages for the AAISM print numbers that ISACA has not released. The candidate guide gives none of these:

• A pass rate. The guide gives no pass rate for the AAISM.
• The number of pretest items, or which questions they are.
• The raw score that equals 450. The scaled score has no published conversion to a percentage or a count of correct answers.
• Weights below the domains. The 13 topics carry no share of their own.
• A recommended number of study hours.

A page that states any of these as fact is guessing, however confident it sounds.

Practicing the format, not only the content

Knowing the domains is half of the preparation; the other half is answering one best answer out of four, 90 times, on one clock. Our AAISM practice questions are written in that shape, each with a rationale that explains the right answer and why each wrong one falls short, and the mock exam runs 90 questions on a single 150-minute clock that draws each domain at its share. A free account opens AI governance and regulation in full, lessons, questions and flashcards, so you can try the format before paying anything; full access is a single payment, with nothing to renew. For four original questions with full rationales, see AAISM exam questions, and for a week-by-week plan, how to study for the AAISM.