AAIA Prerequisites: Who Can Take the Exam

The short version

ISACA requires a qualifying credential for AAIA: its AAIA page says candidates must hold an active CISA or another qualified designation to register for the exam. CISA holders all qualify, and holders of certain other designations qualify if they work in IT audit or IT advisory. There is no separate experience requirement on the pages we read. Check ISACA’s AAIA page before you pay for the exam.

Required: a qualifying credential

ISACA’s AAIA candidate guide includes a “Qualified Prerequisite List”. It says:

  • CISA (from ISACA): all holders qualify.
  • Other designations: you qualify if you also have an IT audit or IT advisory role. The list in the guide includes CIA from the Institute of Internal Auditors, the US CPA, ACCA and FCCA, Australian CPA and FCPA, Japanese CPA, Canadian CPA, ICAEW ACA and FCA, Nigerian CNA, Chartered Accountants ANZ, and the Hong Kong CPA and FCPA.

The credential must be active. ISACA updates this list, and its page also says “another qualifying designation,” so read the current list rather than trusting this summary.

ISACA’s web page states this as a condition for registering for the exam. The candidate guide also lists it among the steps to become certified (pass the exam, pay an application processing fee, submit the application, follow the Code of Professional Ethics and the CPE policy). If you do not hold a qualifying credential yet, you cannot register for the exam.

Recommended: what to bring

ISACA does not publish a required number of years of experience for AAIA on the pages we read. The following background makes preparation easier:

  • Audit basics: scoping, risk-based planning, sampling, evidence, workpapers and reports.
  • IT general controls: access, change management, backup and incident handling.
  • Data basics: databases, data quality, extracts and simple analytics.
  • Familiarity with how your organization uses AI today, even if only as a user of an assistant or a vendor tool.

What you do not need

  • Programming or data science skills. You need to understand what a model is, how it is trained, tested and monitored, and what can go wrong. You do not build one.
  • Advanced math. Statistics at the level of sampling and rates is enough.
  • A specific AI vendor or tool. The outline is vendor-neutral.

Skills self-check

Answer yes or no. Three or more “no” answers in one group suggest where to start.

Audit skills

  • I can explain the difference between a test of design and a test of operating effectiveness.
  • I can say when statistical sampling is needed and when judgmental sampling is fine.
  • I can rank evidence by reliability and explain why.
  • I can write a finding with condition, risk and recommendation.

Governance and risk

  • I can describe inherent and residual risk with an example.
  • I know what a risk owner does and why ownership matters.
  • I can explain what privacy and data governance programs usually cover.

Technology

  • I can explain the difference between supervised and unsupervised learning, and between a classic model and a generative one.
  • I know what training data, a validation set and a decision threshold are.
  • I understand why a retrained model counts as a change.
  • I can name two ways an attacker can target an AI system.

If you struggle with the technology group, start with introductory material from your own organization or a vendor-neutral AI primer before working through the outline. If you struggle with the audit group, review your CISA or equivalent notes.

Suggested preparation order

  1. Confirm your prerequisite credential and the current rules on ISACA’s page.
  2. Read the exam content outline end to end.
  3. Fill gaps in AI vocabulary first, then governance, then operations and audit techniques. Our domains explained page follows that order.
  4. Follow the study plan.

More guides for AAIA

Next step

Next, read the exam format so you know the rules before you book. If you want a self-check with questions, our AAIA practice tests start with short concept-level items.

Frequently asked questions

Do I need AI experience?

ISACA does not state a requirement. In practice, some familiarity with how AI is built and used makes the content much easier.

Can I take AAIA without CISA?

Yes, if you hold another designation on ISACA’s list and have an IT audit or advisory role. Without CISA or a listed designation you cannot register.

How long is the credential valid?

Holders must follow ISACA’s CPE policy: 10 hours of CPE per year and 30 hours over three years, plus an annual maintenance fee. See renewal and retakes.

Try these practice exams