AAIR Cheat Sheet: Key Facts to Review

How to use this sheet

This is a review sheet in our own words, for the last week or the last day. It does not cover everything on the exam, and it does not replace ISACA’s candidate guide or your study material. Facts about the exam come from ISACA’s pages checked on October 22, 2026.

Exam facts at a glance

ItemDetail
Questions90 multiple choice, four options, one best answer
Time150 minutes
Passing score450 on a scale of 200 to 800
DomainsGovernance and Framework Integration 37%, Life Cycle Risk Management 21%, Risk Program Management 42%
Wrong answersNo penalty, so answer every item
LanguagesEnglish, Spanish, Chinese
DeliveryPSI test center or remote proctoring
Eligibility windowSix months from registration
RetakesFour attempts in a rolling 12 months, waits of 30, 90, 90 days

Domain 1: Governance and Framework Integration (37%)

Key concepts

  • Risk appetite is how much risk the organization chooses to take. Risk tolerance is the acceptable variation around it. Risk capacity is the most it could absorb before it fails.
  • The three lines: management owns and runs risk, risk and compliance oversee and challenge, internal audit gives independent assurance.
  • Risk owners belong to the business, not to the team that built the model.
  • Policy sets the rule, a procedure explains how, and an exception needs a documented approval and an end date.
  • Trustworthiness themes: fairness, privacy, safety, transparency, accountability.

Easily confused

  • Appetite is for choices. Tolerance is for thresholds. Capacity is for limits.
  • Provider builds or places a system on the market. Deployer uses it. Duties differ.
  • Accountability stays with the organization. A contract can share tasks, not blame.

Decision rules

  • If the scenario says “who should be responsible”, think business owner first.
  • If a law forbids the use, think stop, not exception.
  • If AI is not in the risk register, think integrate it into the existing process before inventing a new one.

Domain 2: AI Life Cycle Risk Management (21%)

Key concepts

  • Stages: design or procurement, training and testing, deployment, monitoring, retirement.
  • Data lineage, inventories of models and datasets, and documentation of limits of use.
  • Independent validation means someone other than the builder.

Easily confused

  • Data drift is a change in the input data. Concept drift is a change in what the right answer means.
  • Overfitting means good on training data, poor on new data. Data leakage means test information slipped into training.
  • Testing checks the model before release. Monitoring checks it afterwards.

Decision rules

  • If results differ by group, think subgroup evaluation, not one overall accuracy figure.
  • If performance is falling in production, think monitoring and change control before retraining blindly.
  • If the model is no longer used, think decommissioning, with data and access cleanup.

Domain 3: Risk Program Management (42%)

Key concepts

  • A risk scenario has a threat, a weakness, and an impact.
  • Treatment options: mitigate, transfer, avoid, accept.
  • Controls: preventive stops, detective finds, corrective fixes.
  • Key risk indicators (KRIs) look ahead at exposure. Key control indicators (KCIs) show whether a control works.
  • AI-specific attacks include data poisoning and prompt injection.
  • Supply chain: due diligence, contract clauses, version change notices.

Easily confused

  • KRI is about risk level. KCI is about control performance.
  • Inherent risk is before controls. Residual risk is after them.
  • Business impact analysis sizes the impact of an outage. A continuity plan keeps things running. Disaster recovery restores systems.
  • Transfer moves the financial effect. It does not move accountability.

Decision rules

  • If harm cannot be undone, prefer preventive controls.
  • If the risk sits within appetite and the cost to treat is high, accept can be defensible.
  • If there is no reliable data, a qualitative method beats false precision.
  • If the audience is the board, report outcomes and exposure, not technical detail.

Common traps

  • Picking the true statement that does not answer the question.
  • Choosing the technical fix when the stem asks for a governance step.
  • Ignoring BEST, FIRST, or MOST in the stem.
  • Treating the first plausible option as the answer when two are defensible. Find the constraint in the stem.
  • Mixing up two similar terms because you read quickly.

Last-day checklist

  1. Re-read the term pairs above out loud.
  2. Do one timed set and review only the wrong answers.
  3. Check your ID matches your ISACA account name.
  4. Confirm the start time and your device or travel plan. Our exam day guide has the rest.
  5. Sleep. A tired reader misses qualifiers.

More guides for AAIR

Next step

For deeper explanations, read domains explained and the overview. To rehearse the question style, try the AAIR practice exams.

Try these practice exams