Is the AAIA Worth It? An Honest Answer for Auditors

Is the AAIA worth it? Yes, on one condition, and it is a condition ISACA enforces at the door. If you already hold an active CISA or another qualifying credential, and AI systems are already in your audit scope or heading there, the AAIA is the cheapest and fastest way to put that specialization on paper. Under those circumstances it is an easy recommendation.

If you do not hold a qualifying credential, the answer is no, and not because the credential is weak. You are simply not eligible. AAIA is an advanced certification layered on an existing audit qualification, so experience alone will not get you in, however much of it you have. That single rule sorts nearly everyone who searches this question into one of two piles, so the rest of this post works through both: the case for sitting it, the cases for doing something else first, and the two honest arguments against it that most write-ups leave out.

Is the AAIA worth it if you already hold the CISA?

Yes, and here is the reasoning rather than the assertion.

Start with the price, which is lower than people expect for an advanced credential. Certifying as a member costs USD 509: USD 459 to sit the exam and USD 50 to apply once you pass. Nonmembers pay USD 599 for the sitting. Set the member rate against a single registration for the CISA, CISM, or CRISC, each USD 575, and this is the cheaper thing to add. Keeping it runs USD 20 a year for members or USD 35 for nonmembers, plus 10 CPE hours a year and 30 across a three-year reporting period, with ISACA dues on top if you take the member rate. The full AAIA cost breakdown has every line, dues included.

The time commitment is proportionate to that. Ninety multiple-choice questions in 150 minutes, three domains weighted 33/46/21, scored on a 200 to 800 scale with 450 to pass, against 150 questions in four hours for the ISACA flagship exams. Smaller exam, less ground, and the audit method underneath it is method you already own. For a working CISA holder this is a supplement to a quarter rather than a rebuild of a year.

The third argument is about demand. Organizations are deploying models faster than they are building controls over them, and boards and regulators have started asking who provides assurance over systems nobody in the room fully understands. If that question has already landed on your audit plan, the AAIA gives you a structured answer and a vocabulary your stakeholders will accept. If it has not landed yet, see the timing section below.

Does the eligibility gate make the AAIA more valuable or less?

More, and this is the part worth arguing.

Every AAIA holder had to arrive holding something. All CISA holders qualify unconditionally, and a defined list of internal audit and accountancy designations qualifies people working in IT audit or IT advisory roles. That means the credential cannot be collected by someone who watched a few videos on machine learning, which is exactly the failure mode of open AI certifications. When a hiring manager sees AAIA, the floor underneath it is known.

It also means the population stays small, and a small population is only an advantage while the credential is recognized. That is the trade. You are buying scarcity and a verified floor, and paying for it in reach. The full rules, including the requirement to keep your prerequisite credential active for as long as you hold the AAIA, are set out in AAIA requirements and eligibility. Read that before you budget, because a second annual maintenance obligation stacked on your first is the cost people forget.

What does the AAIA cost against what it replaces?

Nothing, is the short answer, and that is the point. AAIA does not replace a credential. It sits on top of one.

Two lines in that table are doing real work. The annual maintenance fee is capped across all of your ISACA advanced certifications, so adding a second or a third advanced credential later does not multiply it. And 10 CPE hours a year is half what a flagship credential asks, though those hours have to sit in the AI specialty rather than counting general audit training, which takes more deliberate sourcing than the number suggests.

The honest cost is not on this table. It is study time, and the exam does not hand it to you for free. How hard the AAIA exam is covers where the difficulty actually sits, which is not where most auditors expect.

Who should not take the AAIA?

Three groups, and the first is the largest.

You do not hold a qualifying credential. Get the CISA. That is the recommendation and it is not close. CISA is the only credential on the list that qualifies you unconditionally, with no role test attached, it is open to anyone at the exam stage, and it is directly relevant rather than adjacent to AI audit work. Start with what the CISA exam is and treat AAIA as the exam after that one. Do not pursue a chartered accountancy qualification as a route to an AI audit exam. The effort is out of proportion to the destination.

You want a general AI credential. AAIA is an audit exam that happens to be about AI, not an AI exam that happens to mention audit. Almost every supporting task in ISACA's published list begins with the verb "evaluate," and the credited answer nearly always evaluates and evidences where a builder would fix. If your goal is to understand how models work rather than how to assure them, this is the wrong purchase. The three AAIA domains explained shows you exactly what the questions are about before you spend anything.

You need an accredited credential. AAIA does not carry ISO/IEC 17024 or ANSI accreditation, and ISACA makes no accreditation claim for it. CISA, CISM, and CRISC are accredited. For most hiring this changes nothing, because employers look at content and at ISACA's name. But some government roles, defense contracts, and regulated positions specify accredited certifications in writing, occasionally citing ISO/IEC 17024 directly. If you are certifying to satisfy that kind of wording rather than to demonstrate capability, check the wording first. AAIA may not answer it however well it fits the work.

Is a new credential too risky to bet on?

It is a real risk and it deserves a straight answer rather than reassurance.

AAIA launched in 2025. There is no long track record to point at, no decade of job postings naming it, and no established salary data attached to it specifically. ISACA does not publish a pass rate for the AAIA and does not publish a holder count we can cite, so nobody can honestly tell you how many people hold it or what share of candidates pass. Anyone quoting you either figure is inventing it. The eligibility list has already been broadened more than once since launch, which tells you the rules are still settling.

Weigh that against the exposure. You are risking roughly the price of one flagship exam registration on a credential that costs USD 20 a year and 10 CPE hours to keep. If AAIA does not become the recognized marker for AI assurance, you are out a few hundred dollars and a quarter of study, and you keep the knowledge, which is the part your next audit actually uses. If it does become that marker, you were early. That asymmetry is why the newness argument, real as it is, does not carry the decision for someone already eligible.

The group that should take the newness risk seriously is anyone buying the credential purely for a job market that has not asked for it yet. If your organization talks about AI governance but has not put a model on the audit plan, waiting a year costs you almost nothing and lets the outline settle.

AAIA or AAISM?

Pick by the chair you sit in, not by which sounds more current.

AAIA is the audit-side credential in ISACA's AI family: evaluating AI systems and providing assurance over them. AAISM is the security management side. If your work is assurance, findings, evidence, and reports, AAIA is the one that describes it. If you run a security program and models are becoming part of your attack surface, AAISM is the closer fit and its own eligibility rules apply, so check them on ISACA's page rather than assuming they mirror these. ISACA has since added a third advanced AI credential, AAIR, on the risk side, so look at that one too if risk rather than audit or security is the chair you sit in.

Holding both is a reasonable ambition and a poor plan for this year. Pick the one your current role would let you use, then let the second follow if the work does. The capped maintenance fee across advanced certifications makes that sequencing cheap if it happens.

So what is the verdict on the AAIA?

Take it if all three of these are true: you hold an active qualifying credential, AI systems are in scope for your work now or within the next year, and you intend to keep the underlying credential current for the long run. Under those conditions it is a small exam, a low ongoing cost, and the clearest available signal that an auditor can handle AI in an audit setting.

Skip it, or defer it, if any of these are true: you have no qualifying credential, your organization is not auditing AI yet, or a written requirement in your field demands accreditation. In the first case the next step is the CISA, not this. In the second, wait. In the third, the accreditation gap is not going to be argued away by a good result.

If you land in the take-it group, the study problem is a fair one: three domains, unfamiliar technical material, read through an evaluate-and-assure lens you already own. The ISACA AAIA: Simply Certified Study Guide teaches all three at the published 33/46/21 weighting with two full-length practice exams and every answer explained, including why the wrong options are wrong. For the full picture of the credential before you commit, what the ISACA AAIA certification is is the place to start.

Whatever you decide, confirm the current fees, eligibility list, and CPE rules on ISACA's own AAIA pages before you pay. A young credential moves, and this post will age faster than the reasoning in it.

FAQ

Is the AAIA worth it without a CISA?

You cannot sit it without a qualifying credential at all, so the question usually resolves to eligibility rather than value. If you hold a CIA or one of the qualifying accountancy designations and work in an IT audit or IT advisory role, you are eligible and the same reasoning applies. If you hold none of them, get the CISA first.

How much does the AAIA cost in total?

USD 459 for members or USD 599 for nonmembers to sit the exam, a one-time USD 50 application processing fee after you pass, and an annual maintenance fee of USD 20 for members or USD 35 for nonmembers. Add study material and, if it comes to that, a full fee again for a retake. Confirm current amounts on ISACA's AAIA pages before you register.

Does the AAIA increase your salary?

We are not going to quote a figure. AAIA is new, and there is no salary data specific to it that we can source to ISACA or a named survey, so any number you see attached to it should be treated as invention. Judge it on whether the work is in front of you, not on a projected raise.

Is the AAIA accredited?

No. ISACA makes no ISO/IEC 17024 or ANSI accreditation claim for the AAIA, unlike CISA, CISM, and CRISC. It matters only if a job posting or contract specifies an accredited certification in its written requirements, in which case check the wording before you register.

Is it better to take the AAIA or wait a year?

Wait if your organization is not auditing AI systems yet. The credential is young, its eligibility rules have already been widened more than once, and an unexercised specialty credential earns nothing while you pay maintenance on it. Take it now if AI assurance is already on your audit plan, because that is when the vocabulary and the structure pay for themselves.

Looking for a plain-English AAIA guide? ISACA AAIA: Simply Certified Study Guide covers all three domains at their 33/46/21 weights, with two full-length practice exams, every answer explained.

Simply Certified is an independent publisher. AAIA and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.