Is the AAIR Exam Hard? An Honest Look

The short version

AAIR is a demanding exam for people without risk experience and a moderate one for people who already work in risk or audit. The difficulty is not in memorizing facts. It is in choosing the best answer among several reasonable ones, in 90 questions and 150 minutes. ISACA does not publish a pass rate, and we do not know of a reliable source for one, so treat any number you see online with caution.

What makes it hard

It is a judgment exam. ISACA says its questions are written to test practical knowledge and the application of concepts, with one best answer among four. The stem often contains a qualifier such as BEST or MOST likely, and often a constraint such as a deadline, a budget, or a legal duty. Two options may be technically true. The constraint decides which one wins.

It is new. The credential was introduced in 2026. There is no long trail of past candidates writing up their experience, and a lot of material online is unchecked. Rely on ISACA’s content outline and candidate guide for what is in scope.

It mixes three fields. You need risk management vocabulary (appetite, tolerance, inherent and residual risk, controls, indicators), enough AI knowledge to follow a scenario (training, drift, bias, supplier models, attacks), and awareness of regulation and standards. Few people are strong in all three.

The clock is steady, not tight. You have about 100 seconds per question. That is enough if you read well, but scenario questions take longer than definition questions.

The score is scaled. You need 450 on a scale from 200 to 800. You cannot work out how many questions that is, because ISACA converts raw scores. Do not plan around a percentage.

Who usually finds it easier

  • Professionals who work in IT risk, operational risk, or audit and have written risk scenarios and chosen treatments.
  • People who already hold a risk-oriented credential and remember its core terms.
  • Candidates with some hands-on exposure to AI projects, even as a reviewer.
  • Readers who are comfortable with questions that ask for the BEST or FIRST action.

Who usually finds it harder

  • Technical people with strong AI knowledge but little risk or governance background. They often know how a model fails but not how a risk register, a tolerance, or a three lines model works.
  • Risk people who have never worked on AI. Terms such as concept drift, data poisoning, or retrieval-augmented generation can slow them down.
  • Candidates who lean on memorized definitions. The exam rewards applying a concept to a situation.

Common reasons people fall short

These are general patterns for exams of this type, not data from ISACA.

  1. Choosing a true answer instead of the best one. An option can be correct in general and still wrong for the scenario in the stem.
  2. Ignoring the constraint. A tight budget, an irreversible loss, or a legal ban changes the answer.
  3. Confusing neighboring terms. Indicator versus control, appetite versus tolerance, inherent versus residual risk, accountability versus responsibility.
  4. Spending too little time on Domain 3. It is 42% of the exam, so it is the most expensive place to be weak.
  5. Reading too fast. Many scenarios hide the deciding detail in the last sentence.
  6. Skipping review. Taking many practice sets without studying the explanations teaches little.

How to judge your readiness

There is no perfect test, but these signals help.

  • You can explain each of the 16 sub-areas in the content outline in your own words.
  • You score consistently above your target on full-length practice exams, and not just once. Set that target well above what you think the pass line might be, since the real score is scaled and the questions will differ.
  • Your results are balanced. A strong total can hide one weak domain.
  • When you miss a question, you can say why the right answer beat the closest wrong one.
  • You finish a 90-question timed set with a few minutes spare.

If you are close to those points, book the exam. If not, give yourself another week or two on the weak areas first. Registration gives you a six-month window, so you have room to schedule a date that fits.

Practice exams and honesty

Practice exams measure readiness. They do not replace ISACA’s learning material or real work experience, and a good score is a sign, not a promise. Our AAIR practice exams are original questions that start with definitions and build to full scenario sets, which is a gentle way to find your gaps.

Frequently asked questions

Do I need AI engineering experience?

No. The exam is about risk judgment. You do need to understand AI concepts well enough to follow a scenario.

Is there a penalty for guessing?

No. ISACA says that grades depend on the number of questions answered correctly, so answer every question.

How long should I study?

It varies. See the study plan for 4-week and 8-week schedules, then adjust after a baseline practice test.

More guides for AAIR

Next step

Check what you need before you start on the prerequisites page. When you want a realistic read on where you stand, take a timed set from the practice exams.

Try these practice exams