AAIA Domains Explained: 3 Areas and Weightings

The short version

AAIA has three domains: AI Governance and Risk (33%), AI Operations (46%) and AI Auditing Tools and Techniques (21%). The weightings come from ISACA’s exam content outline dated June 2025. The topic names below are ISACA’s; the explanations and traps are our own general commentary.

Domain	Weighting	Roughly, out of 90 questions
AI Governance and Risk	33%	about 30
AI Operations	46%	about 41
AI Auditing Tools and Techniques	21%	about 19

The question counts are our arithmetic from the percentages. Some items are unscored, so the real split can differ slightly.

Domain 1: AI Governance and Risk (33%)

ISACA lists five areas: AI models, considerations and requirements; AI governance and program management; AI risk management; privacy and data governance programs; and leading practices, ethics, regulations and standards for AI.

In practice. This domain asks whether the organization controls its AI on purpose. Who approves a new use case? Who owns the risk? Which policies apply, and does anyone check? You should know the difference between kinds of models and learning, because the right control depends on what the system does. You should also be able to separate inherent from residual risk, and know what privacy and data governance programs need to cover, such as purpose, minimization, retention and special categories of data.

Typical traps.

Choosing a technical fix when the problem is ownership or policy.
Treating regulation as one rule. Questions test principles such as transparency and accountability, not memorized legal articles.
Picking the most thorough governance answer when the scenario has a stated constraint, such as limited resources. The best answer fits the constraint.

Practice. Write a one-page governance map for a made-up model: owner, approver, policy, risk register entry, review frequency. Then ask what evidence would prove each item.

Domain 2: AI Operations (46%)

This is the biggest domain. ISACA lists seven areas: data management specific to AI; AI solution development methodologies and lifecycle; change management; supervision of AI solutions (outputs, impacts and decisions); testing techniques; threats and vulnerabilities; and incident response.

In practice.

Data management: where training data comes from, its quality, bias, lineage and versioning.
Lifecycle: from design and development to deployment, monitoring and retirement, with controls at each gate.
Change management: a retrained model is a change. It needs a request, testing, approval and a rollback path.
Supervision: monitoring accuracy, drift, fairness and decisions made, and deciding when a human must step in.
Testing: validation, performance, bias and robustness testing, and what a good test needs to be repeatable.
Threats: attacks that target AI, such as poisoned training data, prompt manipulation, model extraction and inference about training data, as well as ordinary access control and supply chain issues.
Incident response: detecting, containing, investigating and learning from AI failures.

Typical traps.

Mixing up similar terms: data drift versus concept drift, a test of design versus a test of operating effectiveness.
Choosing a detective control when the scenario needs a preventive one.
Forgetting that a decision threshold is a value judgment. The best setting depends on which error costs more.
Ignoring third parties. Many AI services come from vendors, and the audit question is what assurance you can get.

Practice. Take any AI use case and walk it through the lifecycle, noting one control, one piece of evidence and one failure for each stage. This domain rewards that kind of end-to-end thinking.

Domain 3: AI Auditing Tools and Techniques (21%)

ISACA lists five areas: audit planning and design; audit testing and sampling methodologies; audit evidence collection techniques; audit data quality and data analytics; and AI audit outputs and reports. The outline’s supporting tasks also include using AI to improve the audit itself and weighing the risks of doing so.

In practice. This is the classic audit toolkit pointed at AI systems. Scope and objectives, risk-based planning, choosing between statistical and judgmental sampling, ranking evidence by reliability, testing the completeness of data extracts, and writing findings, ratings and management action plans.

Typical traps.

Confusing sufficient evidence (enough) with appropriate evidence (relevant and reliable).
Accepting data supplied by the auditee without checking completeness.
Using a judgmental sample when the scenario demands a projectable rate.
Reporting conclusions on areas that were not tested. An interim report states what remains.

Practice. For three sample scenarios, decide the objective, the population, the sample method and the best evidence. Then draft the finding in three sentences: condition, risk, recommendation.

How the domains connect

The domains overlap more than the outline suggests. A question about a biased model can be a governance question (who owns fairness?), an operations question (how is it monitored?) or an audit question (how do you test it?). Read what the question asks you to decide, then pick the answer that fits that role.

More guides for AAIA

Next step

Test yourself domain by domain with the sample questions, or move on to the study plan. Our AAIA practice tests report your score per domain so you can see where to focus.

Frequently asked questions

Is domain 2 the one to start with?

It is the largest, but domain 1 supplies the vocabulary. Many candidates find it easier to start with governance and risk.

Do I need to memorize regulations?

The outline names regulations and standards as an area, but the style is applied. Know what the main ones are for and what auditors look for.

Where can I see the full list of tasks?

ISACA publishes the exam content outline on its AAIA pages.

Try these practice exams