AAIA vs AAISM: Which ISACA AI Credential Is Yours?

For most people reading this, the comparison is already settled and not by preference. AAISM admits you on an active CISM or CISSP, and on nothing else. AAIA's eligibility list is much wider, built around audit and accountancy credentials, and it has widened more than once since launch. So a CISA holder cannot sit AAISM at all, however much AI security work is on their desk, and a CIA or a US CPA is in the same position. Check which door is open before you spend another minute comparing syllabi.

If you hold a CISM you are the one reader with a genuine choice, because you qualify for both. Decide it on what you produce at work. AAIA certifies assurance over AI systems: you test controls somebody else designed and give an opinion on whether they hold. AAISM certifies the person who designed those controls and runs the program they sit in. And if the honest answer is that you do both, the cost objection is weaker than it looks, because ISACA caps total annual maintenance across all of its Advanced certifications at US$20 for members and US$35 for nonmembers combined, not per credential. That makes this a question of sequence rather than a fork in the road.

The gate, in full, for both

AAISM's prerequisite is one active credential from a list of two: CISM or CISSP. There is no third option, no experience substitute, and no waiver. It is also a standing condition rather than a one-time ticket, since ISACA's maintenance process asks for proof that the qualifying credential is still active. Let the CISM lapse and the AAISM goes with it.

The short list looks deliberate. The third member of the family, AAIR, carries a roster of 25 qualifying designations with a public lookup page attached, so ISACA knows how to write a wide gate when it wants one. AAISM has nothing of the kind on its pages. Do not plan around it widening.

AAIA went the other way. It opened with three qualifying credentials, CISA, CIA and the US CPA. A July 2025 announcement added six more, and the live list now carries a further seven accountancy designations that were not in that announcement, including ICAEW's ACA and FCA, HKICPA's CPA and FCPA, CA ANZ's CA and FCA, and ANAN's CNA. CISA qualifies on its own terms. The other credentials on the list also require you to be working in an IT audit or advisory role. Neither exam will let you in on experience alone, which is the one thing the two gates have in common. AAISM requirements and eligibility and AAIA requirements and eligibility each set out their own rules in detail. If you hold neither prerequisite yet, the question is not AAIA or AAISM, it is which underlying credential to earn first, and what the CISM exam is is the place to start on the security side.

Two different jobs, not two difficulty tiers

People treat this pair as a ladder, with one supposedly the serious version of the other. They are not ranked. They describe different work.

AAIA is written for the person outside the system. The work is scoping an engagement, testing whether controls over models and data operate as described, collecting evidence that would survive review, and reaching a defensible opinion. The verb running through its published task list is evaluate. The auditor does not have to fix the pipeline, only to say whether it can be relied on, and to show why.

AAISM is written for the person inside it. The work is deciding what the control should be, funding it, getting engineering to implement it, and owning what happens when a model behaves in a way nobody specified. The exam expects you to pick a treatment, defend a threshold, and specify monitoring for a system whose output is not deterministic. Nobody hands you a control set to test against, because writing it is the job.

That difference is why the CISM holder's decision is usually easier than it feels. If your name is on the AI security program, AAISM is describing your seat. If your name is on a report about somebody else's AI security program, AAIA is.

The blueprints, side by side

Both exams are three domains and both score as a single result, so the weights are a map of where the questions live rather than a set of hurdles to clear individually.

The shapes are different in a way that matches the two jobs. AAIA loads almost half its paper into AI Operations, which is the model life cycle, testing, threats and incident response looked at from the outside and asked to produce evidence. AAISM puts its largest block at the technical end, with AI Technologies and Controls at 38 percent, covering security architecture for AI, data controls, and monitoring you have to specify yourself. The governance blocks at the top of each are the closest the two get to overlapping, and even there AAIA asks whether governance is working while AAISM asks you to build it.

One wrinkle before you compare anything to a vendor's chart. ISACA names AAISM's Domain 2 two ways in two of its own sources: the web exam content outline calls it AI Risk Management, and the official AAISM candidate guide calls it AI Risk and Opportunity Management. It is one domain, not two. The three sub-areas underneath are identical in both, covering risk assessment, thresholds and treatment, threat and vulnerability management, and vendor and supply chain risk. Treat the titles as interchangeable and do not go hunting for missing content. The three AAISM domains explained and the three AAIA domains explained take each blueprint apart properly.

Where the two exams are effectively the same paper

Strip out the subject matter and the mechanics line up almost exactly. Both are 90 multiple-choice questions in 150 minutes. Both are scored on a scale of 200 to 800 with 450 required to pass. Both cost US$459 for ISACA members and US$599 for nonmembers, plus a US$50 application processing fee. Both give you a six-month eligibility window to sit after you register, and five years from passing to apply for certification. Both ask for 10 CPE hours a year and 30 across a three-year reporting period.

Both also carry the same regional restriction, which catches people out. Residents of India, Mainland China and Hong Kong must sit either exam at a testing center, because live remote proctoring is not offered for these exams in those regions. Everywhere else you can choose a PSI test center or a remote proctor.

The one logistical difference worth noting is language. AAIA is offered in English, Simplified Chinese and Spanish. AAISM is offered in English, Spanish and Japanese. If you need a language other than English, that may decide more than any argument about content. AAISM exam cost and fees has the full money picture, including what a retake costs.

Should you hold both?

This is the question the maintenance rule actually changes. ISACA's AAISM maintenance page states that no matter how many ISACA Advanced certifications you hold, the total annual maintenance for all of them is US$20 for members or US$35 for nonmembers. AAIA and AAISM together cost the same to maintain as either one alone. Add AAIR and it still does not move.

So the usual objection to collecting credentials, that each one is a recurring bill forever, does not apply here. What still applies is everything else. Each exam is its own US$459 or US$599, and a failed attempt is charged again in full. Each one carries its own CPE reporting, and all 30 hours in the three-year period have to align with that credential's exam content outline, so two credentials means two sets of aligned hours rather than one set counted twice. And AAISM obliges you to keep the CISM or CISSP alive underneath it, with its own dues and its own CPE, which the Advanced cap does not touch.

The practical answer: take the one that matches your current work, get certified, and let the second follow only if your remit genuinely crosses into the other seat. Auditors who move into program ownership and security managers who get handed an assurance mandate are both real career patterns, and in those cases the second credential is cheap to keep and easy to justify. Collecting both in the same year because the upkeep is capped means paying two full exam fees for a credential your work does not use yet.

What neither one gives you

Honesty on this pair matters more than usual, because both are new enough that the marketing has run ahead of the evidence.

Neither AAIA nor AAISM is ISO/IEC 17024 or ANSI/ANAB accredited, and ISACA makes no accreditation claim for either. ISACA's accreditation statement covers its four long-standing certifications and names neither of these. For most private-sector hiring that changes nothing, because employers read the content and the ISACA name. For government contracting and some regulated roles where the written requirement specifies an accredited certification, it can be decisive. Check your own wording before you pay.

Both are also young. AAISM launched on 19 August 2025, and AAIA is not much older. Third-party study material for either is thin, and a good deal of what exists is question volume rather than teaching. Expect to lean on ISACA's own outline and on a small number of independent guides, and expect published figures to move faster than they do for the mature certifications.

ISACA publishes no holder count for either credential. It publishes them for its established certifications and the line is simply absent for these, so any number you see quoted for AAIA or AAISM did not come from ISACA. It publishes no pass rate for either, and ISACA's own guidance warns candidates about training providers who advertise one. If you want a view of how hard the security exam actually is, how hard the AAISM exam is works through it without inventing a statistic, and is the AAIA worth it does the same job on the audit side.

The verdict

If you hold a CISA, a CIA, or one of the accountancy credentials on ISACA's list, AAIA is your exam because AAISM is not available to you. If you hold a CISSP, AAISM is your exam for the same reason in reverse. If you hold a CISM, pick the one that matches the work you are accountable for now: the program, or the opinion on the program. If risk rather than either is your seat, look at AAIR before you commit to one of these two.

Once you have picked, the preparation problem is specific rather than general. For AAISM that means three domains taught at the real 31/31/38 weighting, with the largest block sitting in technical control design rather than governance theory you already know. ISACA AAISM: Simply Certified Study Guide covers all three from the security manager's side, with two full-length practice exams and every answer explained. What the AAISM certification is is the overview post if you want the whole credential in one place first, what the AAIA certification is does the same for the audit credential, and the AAISM study plan turns the decision into a calendar.

Both credentials are young and both are moving. Whichever you choose, confirm fees, eligibility and CPE rules on ISACA's own pages before you register.

FAQ

Can I take the AAISM exam if I hold a CISA?

No. AAISM's prerequisite is an active CISM or CISSP, and only those two credentials qualify. A CISA does qualify you for AAIA, on its own terms and with no additional role test attached, so CISA holders who want an ISACA AI credential are pointed at the audit one.

Is the AAIA easier than the AAISM?

There is no published data to answer that with, because ISACA releases no pass rate for either exam. The mechanics are identical: 90 questions, 150 minutes, and 450 on a 200 to 800 scale. What differs is where the weight sits. AAIA puts 46 percent into AI operations viewed from an assurance seat, while AAISM puts 38 percent into technical controls you have to specify rather than test.

Does holding both AAIA and AAISM double the annual maintenance fee?

No. ISACA caps total annual maintenance across all of its Advanced certifications at US$20 for members and US$35 for nonmembers, so holding two or three costs the same as holding one. The exam fees are separate and are charged per exam, and each credential carries its own CPE hours aligned to its own exam content outline.

Can I sit both exams in the same year?

Nothing in ISACA's rules prevents it. Each exam has its own registration, its own fee, and its own six-month eligibility window, and each allows four attempts in a rolling 12-month period. The more useful constraint is study time, since the two blueprints overlap only at the governance end.

What about AAIR, the third AI credential?

AAIR, Advanced in AI Risk, launched on 15 April 2026 and covers AI risk governance and framework integration, AI life cycle risk management, and AI risk program management. It has a much wider prerequisite list than AAISM. If risk is the chair you actually sit in, compare it against these two rather than assuming the choice is only between audit and security.

Moving into AI security leadership? ISACA AAISM: Simply Certified Study Guide teaches all three domains at the real 31/31/38 weighting, from the security manager's govern-and-control lens, with two full-length practice exams and every answer explained.

Simply Certified is an independent publisher. AAISM, AAIA, AAIR and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.