The short version
Pick the 4-week plan if you already work in risk or audit and have touched AI governance. Pick the 8-week plan if the AI side is new to you. Both plans follow ISACA’s content outline and give most of the time to Domain 3 (42%) and Domain 1 (37%). The hours below are general guidance. They vary with your background, so adjust after your first practice test.
Before you start
Do three things on day one.
- Download ISACA’s AAIR exam content outline and candidate guide. The outline names every sub-area, so it is your checklist.
- Make a simple table with the 16 sub-areas (six in Domain 1, four in Domain 2, six in Domain 3) and rate yourself from 1 to 3 on each.
- Book a rough exam date. Registration gives you six months, but a date on the calendar keeps the plan honest.
AAIR is new, so check ISACA’s AAIR page for its current preparation resources. Beyond those, the outline’s wording points you to the kinds of public sources that risk professionals use: AI risk frameworks, international standards, AI regulation, and security guidance. Read the sections that match the sub-areas you rated 1 or 2.
The 4-week plan (about 8 to 10 hours a week)
Week 1: Domain 1, governance and frameworks (about 37% of the exam). Cover sub-areas A to F: AI models and use cases, organizational processes, ownership and accountability, policies and training, regulation, and trustworthiness and ethics. Make a one-page sheet of definitions: risk appetite, tolerance, capacity, inherent and residual risk, the three lines, and the roles of an AI provider and deployer. Finish with a short practice set on this domain.
Week 2: Domain 2, the AI life cycle (about 21%). Follow one imaginary system from design or procurement through training, testing, deployment, maintenance, and decommissioning. Add data and asset management: inventories, data quality, lineage. Write down one risk and one control for each stage. Take a first full-length practice test at the end of the week as a baseline, and do not worry about the score.
Week 3: Domain 3, the risk program (about 42%). This is the biggest block, so give it the whole week. Work through scenario identification, treatment options, control selection and validation, metrics and reporting, supply chain risk, and incident response with business continuity. Practice telling similar terms apart, such as a risk indicator and a control indicator.
Week 4: Mixed review. Sit two full practice tests under timed conditions, review every wrong answer and every lucky guess, and spend the remaining time on your weakest sub-areas. Keep the last two days light (see below).
The 8-week plan (about 5 to 6 hours a week)
| Weeks | Focus | Output |
|---|---|---|
| 1 | Orientation and risk vocabulary refresh | Self-rating table, definitions sheet |
| 2 to 3 | Domain 1: governance, ownership, policy, regulation, ethics | Notes per sub-area, short quiz on Domain 1 |
| 4 | Domain 2: life cycle and data | Stage-by-stage risk and control table |
| 5 to 6 | Domain 3: scenarios, treatments, controls, metrics | Three written risk scenarios with treatments and indicators |
| 7 | Domain 3 continued: supply chain, incidents, continuity; first full practice test | Gap list from the practice test |
| 8 | Two timed practice tests and targeted review | Final weak-spot list, exam logistics checked |
Use the weeks you gain over the 4-week plan to practice writing, not only reading. For example, take a scenario like a customer chatbot and write down its risks, an owner, a treatment, a control, and the metric you would report to the board. That is what the exam asks you to recognize.
Using practice exams in the plan
- Take a baseline early so that you know where you stand, then use the results by domain, not just the total.
- After every practice set, review each question you missed and each one you guessed. Write the reason the correct answer is best in one sentence of your own.
- Keep one full 90-question set for the end. Do it in one sitting with a timer of 150 minutes.
- Look for patterns. If you keep choosing the answer that is true but not the best, practice reading the qualifier and the constraint in the stem.
Our AAIR practice exams are five sets of 90 questions each, with explanations. We built them as a rehearsal. They sit alongside ISACA’s learning material and your own work experience.
The last 3 days
- Three days before: one final timed set, then review only the wrong answers. No new topics.
- Two days before: read your definitions sheet and your gap list. Skim the content outline once more.
- The day before: check your ID (name must match your ISACA account), the test center route or your device and room for remote proctoring, and your start time. Sleep early.
- Exam day: eat beforehand, because food and drink are not allowed during the exam. See the exam day guide for general tips, and the how to study guide for habits that work for any exam.
Pacing on exam day
You have about 100 seconds per question. If a question takes more than two minutes, pick your best answer and move on. There is no penalty for wrong answers, so never leave a blank.
More guides for AAIR
- AAIR Exam Format: Questions, Time, Scoring
- AAIR Sample Questions With Answers
- AAIR Prerequisites and Eligibility Explained
- AAIR Renewal and Retakes Explained
- Is AAIR Worth It? An Honest Look
- AAIR Cheat Sheet: Key Facts to Review
- AAIR vs AAISM: Which ISACA AI Exam First?
- AAIA vs AAIR: Which ISACA AI Exam First?
Next step
To see exactly what each domain asks, open domains explained. To judge how much time you personally need, read is AAIR hard.