The short version
Most candidates already work in audit, so the new part is AI. A 4-week plan suits you if you audit IT systems daily and already follow how AI is used in your organization. An 8-week plan suits you if AI concepts are new. Both plans give AI Operations the most time, because it carries 46% of the exam.
Before you start
Plan on roughly 6 to 10 hours a week for the 4-week plan and 4 to 6 hours a week for the 8-week plan. These ranges are common-sense estimates, not ISACA figures, and your own pace will differ.
Do three things on day one:
- Download ISACA’s exam content outline and keep it open. It lists every domain area and the 23 supporting tasks.
- Read the exam format and note the pace: 90 questions in 150 minutes.
- Take one untimed set of practice questions. The result is a baseline, not a verdict. It tells you which domain to start with.
Mark each outline area as red, amber or green. Revisit that list each Sunday.
The 4-week plan
Week 1: Governance and risk (domain 1, 33%). Cover AI model types and their requirements, governance structures and program management, AI risk management, privacy and data governance, and ethics, regulations and standards. Write one line for each: who is accountable, what policy covers it, what evidence an auditor would ask for. Finish with 20 to 30 practice questions on this domain.
Week 2: Operations, part one (domain 2, 46%). Work through data management for AI, development methods and the AI lifecycle, change management, and supervision of outputs, impacts and decisions. Think in lifecycle order: data in, model built, change released, outputs watched.
Week 3: Operations, part two, then audit techniques. Cover testing techniques, threats and vulnerabilities specific to AI, and incident response. Spend the last two days on domain 3: audit planning, sampling, evidence, data quality and reporting. Do a mixed set of 45 questions at the end of the week.
Week 4: Consolidate and simulate. Take one full 90-question practice set in a single session, timed at 150 minutes. Review every wrong answer and every answer you guessed. Use the middle of the week to patch weak areas, and sit a second full set at the weekend if time allows.
The 8-week plan
| Week | Focus | Practice |
|---|---|---|
| 1 | Outline, baseline, AI basics: model types, learning types, terminology | Untimed baseline of 30 questions |
| 2 | Domain 1: governance, program management, roles and policies | 20 questions |
| 3 | Domain 1: risk management, privacy and data governance, ethics, regulations | 30 questions |
| 4 | Domain 2: data management, lifecycle, change management | 30 questions |
| 5 | Domain 2: supervision of AI, testing techniques | 30 questions |
| 6 | Domain 2: AI threats, vulnerabilities, incident response | 30 questions |
| 7 | Domain 3: planning, sampling, evidence, data analytics, reporting | 30 questions, then one mixed set of 45 |
| 8 | Full timed simulation, review, patching weak areas | Two full 90-question sessions, a few days apart |
Keep one rest day each week. If a domain stays red after its week, move 2 hours from a green domain instead of extending the plan.
How to use practice exams
- Early on, use them untimed. Read the explanation for every option, including the ones you answered correctly.
- Midway, work by domain and keep a log of why you missed each question: a knowledge gap, a misread qualifier, or two plausible options you could not separate.
- Late, use full timed sets in one sitting. The goal is stable scores, not one lucky score. A score that stays above your target over several sets says more than a single high result. Nothing can promise a result on the exam.
Many AAIA questions test choosing the best option under a constraint such as budget, time or a regulator’s demand. The log of why you missed items shows whether you need more content or more practice at weighing trade-offs.
Time for each domain
As a rule of thumb, split your content time roughly like the weightings: about a third on governance and risk, nearly half on operations and a fifth on audit techniques. If you already hold an audit credential, you may need less time on domain 3 and more on domain 2.
The last three days
- Three days out: one last timed practice set, then a focused review of only the questions you missed.
- Two days out: reread your own notes and the outline. Do not start new topics.
- The day before: light review for an hour at most. Check your ID, the exact name on your registration, your route or your remote-proctoring setup, and your start time.
- Exam day: eat beforehand, because food and drink are not allowed in the room. Arrive early or log in early, and use your first minutes to settle your pace.
More guides for AAIA
- AAIA Exam Format, Scoring and Retakes
- AAIA Domains Explained: 3 Areas and Weightings
- Is the AAIA Exam Hard? An Honest Look
- AAIA Prerequisites: Who Can Take the Exam
- AAIA Renewal and Retakes Explained
- Is AAIA Worth It? An Honest Look
- AAIA Cheat Sheet: Key Facts to Review
- AAIA vs AAIR: Which ISACA AI Exam First?
- AAIA vs AAISM: Which ISACA AI Exam First?
Next step
The sample questions give a quick feel for the style. When you want full timed sets, see our AAIA practice tests. For general method, read how to study for IT certification exams.
Frequently asked questions
Can I pass with only 2 weeks of study?
It depends on your background. Two weeks is tight for most people. Check your baseline score and the outline before you decide.
Should I study the 23 supporting tasks?
Yes. They describe what an auditor evaluates, such as vendors, change management and incident programs. Use them as a checklist.
Do I need to code?
No. You need to understand how AI systems are built and operated well enough to audit them.