The short version
AAIA is ISACA’s advanced exam on auditing artificial intelligence. It is 90 multiple-choice questions in 150 minutes, and you pass with a scaled score of 450 or higher on a scale of 200 to 800. It is written for people who already audit IT systems, so expect audit judgment, not machine learning math.
What the exam is
The full name is ISACA Advanced in AI Audit. It sits on top of an existing audit credential rather than replacing one. The idea is that an auditor who already knows how to plan, test and report can also assess AI systems: how a model is governed, how it is run day to day, and how an audit team can examine it and even use AI in its own work.
The questions ask you to choose the best answer. Many describe a short situation at an organization and ask what the auditor should do first, what the biggest concern is, or what evidence is strongest. ISACA says the questions measure practical knowledge and the application of general concepts and standards, and that each has exactly one best answer.
This guide follows the exam content outline that ISACA dates June 2025. ISACA’s page does not show a newer date, so check it before you book.
Who it is for
ISACA describes the audience as experienced IT auditors and advisors, plus professionals who assess, implement, maintain or audit AI systems. The credential is tied to a prerequisite one. ISACA requires an active CISA, or one of a list of accounting and audit designations (for example CIA or a CPA-type qualification) together with an IT audit or IT advisory role, to register for the exam. Read the current list on ISACA’s page before paying for the exam. The prerequisites page goes through what helps.
Format at a glance
| Item | What ISACA says |
|---|---|
| Exam | ISACA Advanced in AI Audit (AAIA) |
| Questions | 90 multiple choice, four options, one best answer |
| Time | 2.5 hours (150 minutes) |
| Passing score | 450 or higher on a scaled 200 to 800 range |
| Languages | English, Simplified Chinese, Spanish (candidate guide of 2025) |
| Delivery | Computer-based, at a PSI testing center or remotely proctored |
| Scored items | Some items are unscored pre-test items you cannot identify |
More detail on scoring, breaks and retakes is on the exam format page.
The three domains and their weightings
| Domain | Weighting |
|---|---|
| AI Governance and Risk | 33% |
| AI Operations | 46% |
| AI Auditing Tools and Techniques | 21% |
AI Governance and Risk
The “why and who” of AI in an organization: kinds of models and what they need, governance and program management, AI risk management, privacy and data governance programs, and leading practices, ethics, regulations and standards.
AI Operations
The largest domain. It covers data management for AI, development methods and the AI lifecycle, change management, supervision of outputs, impacts and decisions, testing techniques, threats and vulnerabilities specific to AI, and incident response.
AI Auditing Tools and Techniques
The audit craft applied to AI: planning and design, testing and sampling methods, evidence collection, data quality and analytics, and audit outputs and reports.
ISACA’s outline also lists 23 supporting tasks, such as evaluating vendors and supply chain programs for AI, evaluating ownership of AI-related risk, and using AI solutions to improve audit planning, fieldwork and reporting. They cut across the three domains.
Official source
For the vendor’s own pages, see the ISACA AAIA page and the AAIA exam content outline. ISACA is the final authority if anything here differs.
More guides for AAIA
- AAIA Study Plan: 4-Week and 8-Week Schedules
- AAIA Domains Explained: 3 Areas and Weightings
- AAIA Sample Questions With Answers
- Is the AAIA Exam Hard? An Honest Look
- AAIA Renewal and Retakes Explained
- Is AAIA Worth It? An Honest Look
- AAIA Cheat Sheet: Key Facts to Review
- AAIA vs AAIR: Which ISACA AI Exam First?
- AAIA vs AAISM: Which ISACA AI Exam First?
Next step
When you are ready to test yourself, our AAIA practice tests offer five original practice sets across the three domains. They help you measure readiness; they do not replace ISACA’s own material.
Frequently asked questions
Does AAIA test hands-on AI skills?
No. It tests audit judgment about AI: governance, controls, evidence and reporting. You do not build or train models.
Is there a case study or lab?
ISACA’s candidate guide describes the exam as 90 multiple-choice questions with four options each. It does not mention labs or case studies.
Which domain matters most?
AI Operations carries 46% of the exam, so it is the largest. All three count toward one total score.