The three AAIA domains are not evenly sized, and the gap between them is wide enough to decide how you study. AI Governance and Risk is 33%, AI Operations is 46%, and AI Auditing Tools and Techniques is 21%. Those weights come from ISACA's AAIA Exam Content Outline, published when the credential launched in 2025, and they are the closest thing to a contract about what the exam will ask you.
Turn the percentages into questions and the picture sharpens. The exam is 90 multiple-choice items in 150 minutes, so AI Operations is worth roughly 41 questions, close to half the paper on its own. AI Governance and Risk is worth about 30, and AI Auditing Tools and Techniques about 19. What follows is what each domain contains, what the exam asks inside it, and the trap that costs candidates points there.
What are the three AAIA domains?
| Domain | Weight | Approx. questions of 90 |
|---|---|---|
| 1. AI Governance and Risk | 33% | 30 |
| 2. AI Operations | 46% | 41 |
| 3. AI Auditing Tools and Techniques | 21% | 19 |
There is no per-domain pass mark. The exam is scored as a single scaled result from 200 to 800, with 450 to pass, and ISACA reports domain-level performance for information only. Points are points wherever they come from, so let the weights drive your plan rather than your interest.
One framing point before the tour. The AAIA is an audit credential with AI as its subject matter, not an AI credential with some audit attached. You can read that off the 23 supporting tasks ISACA publishes in the candidate guide appendix, where the working verb is nearly always "evaluate." Hold that word through all three domains. For the format, fees, and eligibility gate, start with what the AAIA certification is.
Domain 1: AI Governance and Risk (33%)
Domain 1 has five sub-areas: AI models, considerations, and requirements; AI governance and program management; AI risk management; privacy and data governance programs; and leading practices, ethics, regulations, and standards for AI. About 30 questions live here.
The first sub-area is the one people misjudge. It asks you to know model classes well enough to scope the right work: supervised, unsupervised, and reinforcement learning, deep learning, and generative models including large language models. You are not asked to train anything. You are asked which audit decision follows from which model type, because a nondeterministic language model has to be evidenced through logs while a deterministic supervised model can be tested by reproducing its output. Classify the model first, then choose the test.
The governance sub-area is where a career auditor is most at home. Roles and accountability, policy, risk appetite, and third-party oversight all keep their usual shape here, and only the object they point at has changed. The central artifact is the AI inventory, or model register: every model in production with its owner, risk tier, intended use, and lifecycle status. The trap is specific. An AI inventory is not an IT asset list, and when an organization offers its configuration management database as evidence of AI governance, the exam expects you to see the gap rather than the document.
Risk management brings a taxonomy worth learning fluently: bias, model drift, hallucination, opacity, automation bias, and third-party or supply-chain model risk. Privacy and data governance adds training-data provenance, lawful basis and consent, purpose limitation, and the awkward fact that a model trained on data you should not have used cannot have that data deleted out of it.
The standards sub-area is where candidates most often lose easy marks. Learn the four reference points by their job rather than their contents. The NIST AI Risk Management Framework is voluntary and organizes AI risk into four functions, Govern, Map, Measure, and Manage. ISO/IEC 42001 defines requirements for an AI management system and is certifiable by a third party. ISO/IEC 23894 is risk-management guidance, not requirements. The EU AI Act is binding law with a risk-tier structure. If a scenario mentions certification of an AI management system, the answer points to ISO/IEC 42001, never to the NIST AI RMF. Regulatory detail also moves faster than exam outlines, so re-check EU AI Act specifics rather than memorizing them.
Domain 2: AI Operations (46%)
Domain 2 is the heavyweight, and at roughly 41 of 90 questions it is close to half your exam. It has seven sub-areas: data management specific to AI; AI solution development methodologies and lifecycle; change management; supervision of AI solutions covering outputs, impacts, and decisions; testing techniques; threats and vulnerabilities specific to AI; and AI incident response management.
Data management is the foundation. Data lineage, labeling controls, training, validation and test splits, feature stores, and data leakage all show up as control questions. If an auditor cannot trace a production model back to the exact dataset version that produced it, the model's behavior cannot be attributed to its inputs, and that is a high-severity gap rather than a documentation nitpick.
The lifecycle sub-area walks a model from problem framing through data preparation, model selection, training, validation, deployment, and monitoring, with a control and an evidence artifact expected at each stage. The model card is the artifact to know by name. When a question asks what documents a model's intended use, subgroup performance, and known limitations, the model card is the answer, not the registry and not the training log.
Change management carries the most reliable trap in the domain. In AI, a change is not only new code. Retraining a model on new data can materially alter its behavior in production without a single commit, a ticket, or a release note. The exam expects the versioning, approval, and rollback discipline of a code deployment applied to retraining events and model promotions too. An organization that says its existing software change process already covers AI has usually described the gap rather than closed it.
Supervision covers human-in-the-loop and human-on-the-loop oversight, output and impact monitoring, drift detection, escalation, and override paths. Testing covers validation, performance metrics, bias and fairness testing across groups, and adversarial testing under manipulated inputs. Two rules pay for themselves. Match the metric to the cost of the error: weight recall when missing a positive case is the expensive failure, weight precision when false alarms are. And treat headline accuracy with suspicion, because a model can score well across the whole population while performing badly for one protected subgroup.
The last two sub-areas are the AI attack surface and what to do after it is exploited. Data poisoning, model inversion, membership inference, prompt injection, model theft, evasion attacks, and supply-chain risk are each worth learning by mechanism rather than by name. Incident response then links back to change management: rollback to a known-good model version only works if the model, data, and environment were versioned beforehand. The trap is treating an AI incident as only a security event. Drift, biased outputs, and hallucination harms are incidents with no attacker involved, and a program that activates only on confirmed breaches will never see them.
Domain 3: AI Auditing Tools and Techniques (21%)
Domain 3 has five sub-areas: audit planning and design; audit testing and sampling methodologies; audit evidence collection techniques; audit data quality and data analytics; and AI audit outputs and reports. That is about 19 questions.
If you already audit for a living, this domain will feel most like home, because it is your existing method pointed at a new object. Planning starts from the model register as the population, prioritizes by consequence, opacity, volume, data sensitivity, and change frequency, and draws criteria from named sources: the NIST AI RMF, ISO/IEC 42001 where the organization claims conformance, the organization's own AI policy, and applicable regulation. The same craft underpins ISACA's flagship audit exam, laid out in CISA domains explained.
Familiarity is exactly what makes this domain risky. Two things genuinely change when the subject is AI. The first is nondeterminism: a model can legitimately return different outputs for the same input on different runs, so a sample test that expects identical results on resubmission will flag normal behavior as an exception. Define the expected variance before testing, and prefer production logs where the record already exists.
The second is the evidence hierarchy, which the exam tests directly. A management representation that the model performs as documented is the weakest evidence. Corroborated documentation such as model cards, lineage records, and monitoring logs sits in the middle. A result you reproduced yourself against versioned data and code is the strongest. Where a complete decision log exists, analytics over the full population beats a larger sample, because it removes sampling error rather than shrinking it.
Reporting closes the loop in audit language. Findings are structured as condition, criteria, cause, and effect, with a recommendation attached, written for a board with no machine learning background. The named trap: issuing an unqualified opinion when training data was inaccessible or lineage could not be traced. A scope limitation has to appear in the report and shape the opinion.
What all three AAIA domains have in common
Read the three domains side by side and the same skeleton shows through each. Every domain is classic audit method applied to AI subject matter. Domain 1 asks who owns the model and what the criteria are. Domain 2 asks what controls exist across the model's life and what evidence they leave behind. Domain 3 asks how you test, sample, evidence, and report on all of it.
That skeleton is worth carrying into the exam, because it makes unfamiliar questions answerable. When a stem describes a technique you have never used, work out which of the three questions it belongs to first. Do that and the plausible-sounding remediation option usually falls away on its own, because fixing the model answers none of the three.
How should you split your study time across the AAIA domains?
Follow the weights, then bias further toward Domain 2.
The arithmetic is only half the case. Domain 2 is 46% of the paper, and it is also the block with the least overlap with what a qualified auditor already knows, from data leakage and feature stores to prompt injection and drift-triggered retraining. Weight and unfamiliarity stack on the same pile there, which is true of no other domain. So give Domain 2 around half your hours, and reach it early rather than in a tired final fortnight. Drill Domain 1's standards sub-area until you can state each framework's job in one sentence. Domain 3 needs one proper pass, spent on nondeterminism, the evidence hierarchy, and scope limitations rather than on the sampling theory you already have.
For everything in one place, the ISACA AAIA: Simply Certified Study Guide allocates chapter space to the same 33/46/21 split the exam uses, with AI Operations split across three chapters for that reason.
Two closing notes. Where a practice question's credited answer contradicts what your last employer actually did, that is the gap you are being tested on rather than a badly written item. And confirm the current outline on ISACA's AAIA page before you book, because this credential is young and young credentials change. For the difficulty picture, read how hard the AAIA exam is; for the hours themselves, the AAIA study plan.
FAQ
How many domains does the AAIA exam have?
Three. AI Governance and Risk at 33%, AI Operations at 46%, and AI Auditing Tools and Techniques at 21%, under ISACA's AAIA Exam Content Outline. Over a 90-question exam that works out to roughly 30, 41, and 19 questions.
Which AAIA domain is the most important?
AI Operations, on both counts that matter. It is the heaviest at 46%, close to half the paper, and it holds the material a qualified auditor is least likely to have met before: data management, the model lifecycle, retraining as a change event, supervision, testing, AI threats, and AI incident response. Weakness there is the most expensive weakness available.
Do you have to pass each AAIA domain separately?
No. The AAIA is scored as a single scaled result from 200 to 800, with 450 to pass, and there is no per-domain minimum. ISACA reports domain-level results for information only, which is why weighting your study toward the 46% domain is the rational move.
Do I need to understand how AI models work to pass the AAIA?
You need to understand model classes well enough to scope the right audit work, not well enough to build one. The exam asks which control, which test, and which evidence follows from a given model type. The credited answer is usually about evidence, scope, independence, and reporting rather than architecture.
Do the AAIA domain weights change?
They have not since the credential launched in 2025, but the AAIA is new and ISACA has already broadened its eligibility list once. The outline is the exam's contract with you, so confirm the current weights on ISACA's AAIA page before you register rather than trusting a figure quoted secondhand.
Looking for a plain-English AAIA guide? ISACA AAIA: Simply Certified Study Guide covers all three domains from the AI auditor's lens, with two full-length practice exams, every answer explained.
Simply Certified is an independent publisher. AAIA and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.