The short version
Take AAIA if you audit or assure AI systems and hold CISA or another qualifying audit credential. Take AAISM if you manage security for AI systems and hold an active CISM or CISSP. The exams have the same length and scoring, but they sit on different prerequisite credentials, so for most people the credential you already hold decides the answer. Take both only if you hold credentials for both paths. This comparison was checked against ISACA’s pages on October 22, 2026.
Who should take which
| If you are mostly… | Lean toward |
|---|---|
| An IT auditor or assurance advisor with CISA | AAIA |
| A security manager or architect with CISM or CISSP | AAISM |
| A GRC lead who holds CISM and also audits | Either; pick the one matching your tasks |
| An accountant or internal auditor with an IT audit role | AAIA, if your designation is on ISACA’s list |
Side by side
| Item | AAIA | AAISM |
|---|---|---|
| Full name | Advanced in AI Audit | Advanced in AI Security Management |
| Focus | Auditing AI and using AI in audits | Securing and governing AI in the organization |
| Audience (ISACA) | Experienced IT auditors and advisors | IT security professionals with proven security or advisory experience |
| Domains | AI Governance and Risk 33%; AI Operations 46%; AI Auditing Tools and Techniques 21% | AI Governance and Program Management 31%; AI Risk Management 31%; AI Technologies and Controls 38% |
| Questions and time | 90 multiple choice, 150 minutes | 90 multiple choice, 150 minutes |
| Passing score | 450 on 200 to 800 | 450 on 200 to 800 |
| Languages (candidate guides) | English, Simplified Chinese, Spanish | English, Spanish, Japanese |
| Delivery | PSI test center or remote proctoring | PSI test center or remote proctoring |
| Prerequisite credential | Active CISA, or listed audit and accounting designations with an IT audit or advisory focus | Active CISM or CISSP |
| Apply after passing | Within five years | Within five years |
| CPE upkeep | At least 10 hours a year, 30 over three years | At least 10 hours a year, 30 over three years |
| Prerequisite must stay active | Yes, per the maintenance page | Yes, per the maintenance page |
Both candidate guides give the same retake policy: four attempts in a rolling 12 months, with waits of 30, 90 and 90 days.
Where they overlap
Both exams assume you know what makes AI systems different from ordinary software: training data, model behavior that drifts, supplier-provided models, and new attack types such as poisoned data and prompt manipulation. Governance, risk, privacy, ethics, regulation and incident response show up in both, so the vocabulary overlaps a lot.
Where they differ
The role in the question. AAIA asks what an auditor should do: scope, test, collect evidence, judge it and report. AAISM asks what a security manager should do: set strategy and policy, run the program, pick controls, handle suppliers, respond to incidents.
Technical depth. AAISM’s heaviest domain (38%) is AI technologies and controls: security architecture, the model lifecycle, data controls, privacy and safety controls, and monitoring. It tests those as a manager judging a design. AAIA’s heaviest domain (46%) is AI operations, which also covers data, lifecycle, testing and threats, but through the lens of what can be audited.
Audit craft versus security program. Only AAIA has a domain on audit planning, sampling, evidence and reports. Only AAISM has a domain on AI risk with thresholds, threat and vulnerability management and vendor management.
Domain naming. ISACA’s AAISM web outline names its second domain “AI Risk Management”, while the candidate guide uses a longer name. The weighting is the same.
How to choose
- Start with the credential you hold. CISA points to AAIA. CISM or CISSP points to AAISM. If you hold only a CPA-type designation, AAIA is the likelier fit, and only with an IT audit or advisory focus. Check prerequisites and ISACA’s lists.
- Look at your daily work. Write audit programs or secure and govern AI platforms?
- Think about the next job. Auditor titles map to AAIA, security leadership to AAISM.
- Do one first. Each credential has its own application and CPE reporting, plus an annual maintenance fee. Read renewal and retakes before you stack two.
If you hold CISA and CISM, the question is only which one fits your next year.
What about difficulty?
ISACA publishes no pass rates. Both exams use best-answer questions. Security managers often find AAIA’s audit method new; auditors often find AAISM’s technical-controls domain new. Our Is AAIA hard? page covers the AAIA side.
More guides for AAIA
- AAIA Exam Format, Scoring and Retakes
- AAIA Study Plan: 4-Week and 8-Week Schedules
- AAIA Domains Explained: 3 Areas and Weightings
- AAIA Sample Questions With Answers
- Is AAIA Worth It? An Honest Look
- AAIA Cheat Sheet: Key Facts to Review
- AAIA vs AAIR: Which ISACA AI Exam First?
Next step
Read the AAIA exam guide and the AAISM exam guide, then confirm eligibility on ISACA’s AAIA page and AAISM page. To practice, we offer AAIA practice tests and AAISM practice tests. They measure readiness and do not replace ISACA’s own material.
Frequently asked questions
Can I take AAIA with CISM only?
ISACA’s AAIA list names CISA and several audit and accounting designations. CISM is not in the list we read, so confirm on ISACA’s page.
Can I take AAISM with CISA only?
ISACA says AAISM candidates must hold an active CISM or CISSP.
Do the two overlap enough to study together?
The vocabulary overlaps, but the roles differ, so practice with questions written for each exam.