The short version
Take AAIA if your job is to audit or assure AI systems. Take AAIR if your job is to identify, assess and manage AI risk. The two exams share a format (90 multiple-choice questions, 150 minutes, 450 to pass), so the choice comes down to your role and the credentials you hold. Take both only if your work spans assurance and risk, and do them one at a time. This comparison was checked against ISACA’s pages on October 22, 2026.
Who should take which
| If you are mostly… | Lean toward |
|---|---|
| An IT auditor, internal auditor or assurance advisor | AAIA |
| An IT risk manager, GRC analyst or risk officer | AAIR |
| A CISA holder with audit plans that include AI | AAIA |
| A CRISC or CISM holder who owns AI risk registers | AAIR |
| Someone who owns both audit and risk work | Start with the one that matches your daily tasks |
Order matters less than fit. Nothing on ISACA’s pages says one must come before the other.
Side by side
| Item | AAIA | AAIR |
|---|---|---|
| Full name | Advanced in AI Audit | Advanced in AI Risk |
| Focus | Auditing AI systems and using AI in audits | Managing AI risk across governance, lifecycle and program |
| Audience (ISACA) | Experienced IT auditors and advisors | Risk professionals with IT risk or advisory experience |
| Domains | AI Governance and Risk 33%; AI Operations 46%; AI Auditing Tools and Techniques 21% | AI Risk Governance and Framework Integration 37%; AI Life Cycle Risk Management 21%; AI Risk Program Management 42% |
| Questions and time | 90 multiple choice, 150 minutes | 90 multiple choice, 150 minutes |
| Passing score | 450 on 200 to 800 | 450 on 200 to 800 |
| Languages (candidate guides) | English, Simplified Chinese, Spanish | English, Spanish, Chinese |
| Delivery | PSI test center or remote proctoring | PSI test center or remote proctoring |
| Prerequisite credential | Active CISA, or listed audit and accounting designations with an IT audit or advisory focus | A qualifying designation from ISACA’s list, such as CISA, CISM, CRISC, CGEIT, CDPSE, CISSP and others |
| Apply after passing | Within five years | Within five years |
| CPE upkeep | At least 10 hours a year, 30 over three years | At least 10 hours a year, 30 over three years |
Both exams use the same retake policy in their candidate guides: four attempts in a rolling 12 months, with waits of 30, 90 and 90 days.
Where they overlap
Both credentials expect you to understand how AI systems are built and run, so the vocabulary overlaps: model types, training data, bias, drift, testing, third-party AI, privacy, incidents and the rules and standards around AI. If you study for one, you will meet about half of the other.
The overlap is in knowledge, not in questions. Each exam asks you to act in a different role. Expect the same fact to appear in different clothes.
Where they differ
The verb. AAIA asks what an auditor should do: plan, sample, collect evidence, judge sufficiency, report. AAIR asks what a risk professional should do: define appetite, rate scenarios, choose treatments, set indicators, run the program.
Weight. AAIA puts 46% on AI operations, which is how systems run and fail. AAIR puts 42% on running the risk program and 37% on governance and frameworks, so it is heavier on management than on technical operation.
Audit craft. Only AAIA has a domain on audit tools and techniques, with sampling, evidence and reports. AAIR has no such domain; it has a lifecycle domain that follows a system from design to retirement.
Naming. ISACA’s AAIR web page names the first domain “AI Enterprise Governance”, while the candidate guide uses the longer name in the table above. We use the guide’s name.
How to choose
- Check your credentials. Both need a qualifying designation. CISA qualifies for both. A CRISC holder fits AAIR’s list; whether it fits AAIA depends on ISACA’s current AAIA list, so confirm it on the prerequisites page and ISACA’s site.
- Look at your next 12 months of work. Will you write audit programs or risk registers?
- Look at the verbs in your job description. Test, verify, report points to AAIA. Assess, treat, monitor, escalate points to AAIR.
- Pick one and finish it. Two advanced exams with overlapping vocabulary are easier to do back to back, but each has its own application, fee and CPE duties. Read renewal and retakes before you commit to both.
What about difficulty?
ISACA publishes no pass rates for either exam. Both use best-answer questions where two options look reasonable. If you come from audit, AAIA’s method feels familiar and the AI terms are the new part. If you come from risk, the reverse is true. Our Is AAIA hard? page goes deeper.
More guides for AAIA
- AAIA Exam Format, Scoring and Retakes
- AAIA Study Plan: 4-Week and 8-Week Schedules
- AAIA Domains Explained: 3 Areas and Weightings
- AAIA Sample Questions With Answers
- Is AAIA Worth It? An Honest Look
- AAIA Cheat Sheet: Key Facts to Review
- AAIA vs AAISM: Which ISACA AI Exam First?
Next step
Read the AAIA exam guide and the AAIR exam guide side by side, then confirm eligibility with ISACA’s AAIA page and AAIR page. When you are ready to practice, we have AAIA practice tests and AAIR practice tests. They measure readiness and do not replace ISACA’s learning material.
Frequently asked questions
Can I take AAIA and AAIR in either order?
ISACA’s pages state no required order, and we found no rule that one must come first.
Which one is harder?
ISACA does not rank them. Difficulty depends on whether audit or risk is your home ground.
Does one count toward the other?
We found nothing on ISACA’s pages saying so. Each has its own exam, application and CPE reporting.