How to study for the AAISM: a plan by domain

The best way to study for the AAISM is to let ISACA's exam content outline set the order and its domain shares set the hours: AI Governance and Program Management and AI Risk and Opportunity Management at 31% each, and AI Technologies and Controls at 38%. Learn each domain's topics, then practice the exam's format, one best answer out of four, until reading for the qualifier is a habit, and finish with timed mocks of 90 questions on one 150-minute clock. ISACA publishes no recommended number of study hours, so this guide works from our course's own estimate of about 76 hours and lays it out as an 8-week plan, with ways to compress or stretch it. It also lists ISACA's own preparation products, what the free candidate guide is and is not, and what to do in the week of the exam.

The short answer

• Study by the outline. Three domains and 13 topics, in ISACA's order, with the hours split by the shares: 31%, 31% and 38%.
• Plan on about 76 hours. That is our course's estimate: 14 hours of reading, 57 of practice and 5 for two timed mocks. At about 9.5 hours a week, that is 8 weeks.
• Practice the format, not just the content. Every question has four options and one best answer, and many turn on a qualifier such as MOST or BEST.
• End with timed mocks: 90 questions in 150 minutes, with a break that does not stop the clock.
• Mind the window. Registering gives you six months to take the exam, so plan the study before you register, or register when you are ready to book.

Start with the outline, not a book

ISACA's outline is the only list of what the exam covers, and it is short: three domains, each with a share of the exam, and 13 topics under them. Domain 1 has five topics, Domain 2 three and Domain 3 five. The guide is clear that the shares describe the exam's content, not its scoring: "Domain-specific percentages indicate the portion of the exam that reflects that domain content and are not used to calculate exam scores."

Two things follow for your study plan. First, the shares are the best guide to proportion you have, because ISACA gives the topics no weights of their own. Second, the score is one total, "based on the total number of exam items answered correctly, regardless of domain", so there is no domain you can afford to skip and none you have to pass separately. The AAISM exam content outline explained goes through every domain and topic.

The outline names no framework or law; topic 1A speaks only of "Industry Frameworks" and "Regulatory Requirements". Any study material has to decide what to teach under those words. Ours covers the documents AI security work leans on most, such as the EU AI Act and the NIST AI Risk Management Framework; ISACA's outline does not name them.

How many hours, and how to split them

ISACA's candidate guide gives no figure for study time. Our course's estimate for the AAISM is about 76 hours: about 14 hours of reading across 63 lessons, 57 of practice with the questions and flashcards that go with them, and 5 for two timed mocks. Your own number depends on how much of the AI side you already know. Every AAISM candidate holds a CISM or CISSP, so much of the security management thinking will be familiar; the AI-specific risks, controls and rules are usually where the hours go.

Split the 71 hours of reading and practice by the domain shares:

Then add the 5 hours of mocks, for about 76 in all. Notice that Domain 2 gets as many hours as Domain 1 with fewer topics, so each Domain 2 topic gets more time. That matches the outline: three topics hold the same share of the exam as five.

An 8-week AAISM study plan

At about 9.5 hours a week, the 76 hours fit into 8 weeks. The plan follows ISACA's order, because the governance and risk vocabulary of Domains 1 and 2 is what Domain 3's controls are chosen against.

Each week, read the lessons first, answer the topic's questions the same week while they are fresh, and keep up with your flashcards every day. Carry what you get wrong into the next week's mixed practice.

Fewer weeks, or more

• Short on time? At about 15 hours a week, the same plan fits in about 5 weeks. Keep the order and the split; cut nothing from Domain 3.
• Studying around a full-time job? At about 5 hours a week, it takes about 15 weeks.
• The six-month window from registration is about 26 weeks, so even 3 hours a week fits, if you register when your plan says you are close.

Practice the format, not only the content

Knowing the material is half of the AAISM; the other half is choosing one best answer out of four, 90 times, on one clock. The guide describes the format plainly: "Every question has a stem (question) and four options (answer choices)", "All questions are designed with one best answer", and "A question may require you to choose the answer based on a qualifier, such as MOST likely or BEST."

Three habits make the difference:

1. Read the stem for the qualifier before you read the options. The guide's first tip is to "Read each question carefully."
2. Eliminate, then choose. The guide's second is to "Eliminate known incorrect answers and then make the best choice possible." Usually two options fall away quickly; the work is between the last two.
3. Learn why the wrong answers are wrong. On a best-answer exam, the wrong options are often true statements that answer a different question. A rationale that explains each option teaches you more than a bare answer key. AAISM exam questions has four more original examples, each rationale covering every option.

Finish with timed mocks

The AAISM is "2.5 hours (150 minutes); 90 multiple-choice questions", 100 seconds a question, and the one break does not stop the clock: "During an approved break, the exam will be paused, but the timer will not stop." Your last week should include at least two full mocks under those conditions, so the pace is familiar before it counts.

Use each mock for more than a score. Review every wrong answer, note which domain and topic it came from, and spend your remaining days on the topics that cost you the most. ISACA's own score report gives domain-level results "for informational purposes only", so a mock is the place to find a weak domain while there is still time to fix it.

Five mistakes that cost AAISM candidates time

1. Memorizing instead of applying. ISACA says its questions are "developed with the intent of measuring practical knowledge and the application of general concepts and standards". Definitions are the start, not the finish: practice choosing what a security manager would do.
2. Skimping on Domain 2. It has three topics and the same 31% share as Domain 1's five.
3. Never practicing on the clock. 100 seconds a question feels different at question 70. Do at least two full timed mocks.
4. Taking the exam too early. A retake costs the full fee again and a wait of at least 30 days, so an extra week of study is cheap by comparison; every AAISM fee is listed separately.
5. Practicing from leaked questions. ISACA's rules forbid candidates to share or discuss "any exam content to any person or entity before, during, or after the exam", and the consequences listed in the guide include "Voiding of the exam" and "Banned from taking any ISACA exam". Practice with original questions written to the outline instead.

ISACA's own AAISM prep

ISACA sells preparation of its own, listed on its AAISM page:

• the AAISM Review Manual, in digital and print versions;
• the AAISM Questions, Answers & Explanations Database;
• the AAISM Online Review Course;
• a virtual training event, which ISACA says "covers key concepts and content included in the AAISM certification exam".

ISACA also runs AAISM study groups on its Engage community, described as a "member-exclusive online forum" where you can "Answer practice questions and get help from experts for free", open to ISACA members only. And it offers a free practice quiz on its site, a handful of questions with answer explanations; ISACA calls them "a small preview of what you can expect on exam day", and you submit a form to see your results.

These are ISACA's products, priced on its store and separate from the exam fee. Our course does not use them, and nothing in it is drawn from them. AAISM training and AAISM study guide and review manual describe each in detail.

Is there an AAISM study guide PDF?

ISACA publishes the exam candidate guide as a free PDF, and it is the document behind most of this page. It covers registration, exam day, scoring and the rules, and it prints the exam content outline in its appendix, but it does not teach the content. The review manual is a separate book that ISACA sells in digital and print versions. A file offered as a free download of a paid ISACA book did not come from ISACA.

The week of the exam

• Check your ID. It must be "current, valid, and original" and government-issued, with your name, signature and photograph, and the name must match your registration. "Digital IDs and Military IDs are not accepted."
• Plan the day. At a test center, plan "to arrive at least 30 minutes prior to the exam start time"; arriving more than 15 minutes late forfeits the fee. At home, run the compatibility check before exam day.
• Watch the tutorial. A tutorial runs before the exam starts, and the guide asks you to pay close attention to it.
• Answer everything. "There are no penalties for incorrect answers", so never leave a question blank.
• Decide about the break in advance. A 10-minute break leaves 140 minutes for 90 questions, about 93 seconds each.

Studying with QualExam

Our AAISM course is built for this plan: 63 lessons mapped to the outline's 13 topics, practice questions in the exam's format with a rationale that explains the right answer and why each wrong one falls short, 2,283 flashcards on a spaced schedule, and a mock of 90 questions on one 150-minute clock that draws each domain at its share. Give it your exam date and it paces the plan to your weeks; take the short diagnostic and it reorders the topics by what you already know.

A free account opens the first topic, AI governance and regulation, in full, with its lessons, questions and flashcards, so you can try the method before paying anything. The AAISM exam guide shows every topic and lesson, and full access is a single payment for 30 or 365 days, with nothing to renew.