What Is the ISACA AAIA Certification? Domains, Cost, Eligibility

The ISACA AAIA certification, short for Advanced in AI Audit, is for auditors and assurance professionals who have to evaluate AI systems and say something credible about whether they are controlled. The exam is 90 multiple-choice questions in 150 minutes, covering three domains, scored on a scale of 200 to 800 with 450 required to pass. It costs USD 459 for ISACA members and USD 599 for nonmembers, with a further USD 50 application processing fee once you pass and apply.

The thing to settle before you plan around it is the eligibility gate. You cannot sit the AAIA on experience alone. ISACA requires you to already hold an active qualifying credential, and CISA is the anchor: every CISA holder qualifies. A short list of internal audit and accountancy designations also qualifies, but only if your role has an IT audit or IT advisory focus. If you hold none of them, the AAIA is the exam after your next one. What follows is the eligibility list, the three domains and their weights, the format and fees, where you sit it, and an honest read on whether the credential earns its place in your year.

What is the ISACA AAIA certification?

ISACA launched the AAIA in 2025 as the audit-side entry in a new family of AI credentials, alongside AAISM on the security management side and AAIR on the risk side. The framing matters: ISACA layered it on top of an existing audit qualification. That tells you who it was built for, namely people who already audit for a living and now have AI in scope.

The candidate guide describes it as designed for IT audit professionals holding a CISA, CIA, or CPA who want recognition for assuring AI-driven processes. In practice that means IT auditors, audit managers, and assurance professionals in regulated industries where a model now sits between a customer and a decision. If you are still working toward the underlying audit credential, start with what the CISA exam is and come back later.

Who can sit the AAIA exam?

Every CISA holder qualifies, full stop. If you do not hold a CISA, you qualify by holding one of the following, provided you work in an IT audit or IT advisory role:

• CIA, the Certified Internal Auditor from the IIA
• US CPA, from a US state board of accountancy
• ACCA Chartered Certified Accountant, or FCCA
• Australian CPA or FCPA, from CPA Australia
• Japanese CPA, from the Japan Financial Services Agency
• Canadian CPA, from the Canadian provincial accounting bodies
• ICAEW ACA or FCA
• CNA, from the Association of National Accountants of Nigeria
• CA or FCA from Chartered Accountants Australia and New Zealand
• Hong Kong CPA or FCPA, from HKICPA

Two details in that list catch people out. The first is that experience does not substitute. Ten years of model validation work with no qualifying credential still leaves you outside the gate. The second is that the prerequisite is not a one-time ticket. ISACA requires you to keep the prerequisite certification you applied with in active status for as long as you hold the AAIA, so a lapsed CISA takes the AAIA down with it. Budget for two sets of maintenance requirements, not one.

Becoming certified is a four-step sequence: hold the active prerequisite, pass the exam, pay the USD 50 application processing fee, and submit the application. You also agree to ISACA's Code of Professional Ethics and its CPE policy.

What are the three AAIA domains?

Every question maps to one of three domains, and the weights are published, so you know where the marks live before you open a book.

Domain 2 is the one to respect. At 46% it is close to half the exam on its own, and it is the domain furthest from what a classically trained auditor already knows.

Domain 1, AI Governance and Risk (33%) covers AI models and their requirements, AI governance and program management, AI risk management, privacy and data governance programs, and the leading practices, ethics, regulations, and standards that apply to AI. This is the domain that reads most like familiar governance work wearing new vocabulary. Ownership, policy, risk appetite, and third-party oversight all behave the way you expect, applied to models instead of applications.

Domain 2, AI Operations (46%) covers data management specific to AI, development methodologies and the AI solution lifecycle, change management, supervision of AI outputs and decisions, testing techniques, threats and vulnerabilities specific to AI, and AI incident response. This is where the real study time goes. Training data lineage, model drift, retraining as a change event, adversarial inputs, and the question of what human oversight of a model output actually looks like as a control are all new surface area for most candidates.

Domain 3, AI Auditing Tools and Techniques (21%) covers audit planning and design, testing and sampling methodologies, evidence collection, audit data quality and data analytics, and AI audit outputs and reports. If you already audit, this is the domain you will find most familiar, because it is your existing method pointed at a new object. That familiarity is a trap: 21% is the smallest slice, and the wrong place to spend your first three weeks. The same audit discipline underpins ISACA's flagship exam, broken down in CISA domains explained.

ISACA also publishes 23 supporting tasks in the candidate guide appendix. Almost every one begins with the verb "evaluate." That is the posture of the whole credential in a single word.

What is the AAIA exam format and pass score?

The exam is 90 multiple-choice questions with a 150-minute limit, which works out to roughly 100 seconds per question. It is offered in English, Simplified Chinese, and Spanish, with no simulations and no written component.

Scoring is scaled. Your raw score is converted to a common 200 to 800 scale, and you need 450 or higher to pass. Because the scale is not a percentage, there is no published conversion between questions answered correctly and a scaled result. ISACA reports domain-level results for information only; your score is based on total items answered correctly regardless of domain. Some items on the exam are unscored pre-test questions, which you will not be able to identify while sitting it. ISACA does not publish pass rates for the AAIA, so treat any specific figure you see quoted online as invention.

If it goes badly, the retake policy allows four attempts in a rolling twelve-month period, with a 30-day wait after the first attempt and 90 days between later ones. Each attempt costs a full registration fee.

How much does the AAIA certification cost?

The exam fee is nonrefundable and nontransferable, and the member discount of USD 140 is large enough to be worth checking against current ISACA membership and chapter dues before you register. Two other numbers are worth knowing in advance: a six-month exam extension and a rescore request each cost USD 75.

Maintenance is where an advanced credential differs from a flagship one. AAIA requires a minimum of 10 CPE hours annually and 30 over a three-year reporting period, and those hours must be in the AI specialty rather than general audit CPE. The annual maintenance fee covers all of your ISACA advanced certifications at the same rate, so a second or third AI credential does not multiply that particular line item.

Where and when can you take the AAIA exam?

Delivery is through PSI, either at an authorized test center or online with a remote proctor. Residents of India, Mainland China, and Hong Kong are the exception: for those candidates the AAIA is available at test centers only.

Registration is continuous, so there is no exam window to wait for. Once you register, you have a six-month eligibility period in which to sit the exam, and you can book an appointment as early as 48 hours after your fee clears. Miss that window and both the eligibility and the fee are forfeited, which is the most avoidable way to lose USD 459. The online option carries strict proctoring conditions: a 360-degree room scan, a mirror check of your screen and keyboard, and a closed-book desk with no notes, no food, and no leaving your seat.

Which standards does the AAIA exam build on?

Domain 1 includes a sub-area for leading practices, ethics, regulations, and standards for AI. ISACA's published outline names the sub-area without listing the specific frameworks, so check ISACA's current AAIA page and preparation materials for any named source list. In practice the three reference points that dominate AI assurance work, and that any credible AAIA preparation covers, are the NIST AI Risk Management Framework, ISO/IEC 42001 for AI management systems, and the EU AI Act with its risk-tier approach to obligations.

You are not being asked to recite clause numbers. You are being asked to recognize what each one expects an organization to be able to show, and then to think about what evidence would demonstrate it. That translation, from framework language into control, sample, evidence, and finding, is the part most candidates find hardest and the part general AI training does not teach. The ISACA AAIA: Simply Certified Study Guide is written from that angle throughout, with all three domains taught at the real 33/46/21 weighting and two full-length practice exams where every answer is explained, including why the wrong options are wrong.

Regulatory detail moves faster than exam outlines. Treat any specific date, threshold, or article number you read about the EU AI Act as something to re-check rather than memorize.

Is the AAIA certification worth it?

Here is the honest version. The AAIA is a narrow credential for people already doing assurance work, and its value depends almost entirely on one question: is your organization actually auditing AI systems yet, or does it just talk about doing so? If AI assurance is already on your audit plan, or your regulator or board has started asking who signs off on model risk, the AAIA gives you a defensible, structured answer and a vocabulary your stakeholders will accept. If AI is still a pilot in one business unit, you will spend real money and real study hours on a credential you cannot exercise, and the outline will likely have moved by the time you can.

Be clear about what it is not: an entry point, into either AI or audit. The eligibility gate makes the second half of that argument for ISACA. And because audit method is assumed as a starting condition, the exam spends its weight on AI content instead of teaching you how to plan an engagement. Someone with a strong machine learning background and no audit training would find the questions harder than expected, because the credited answer nearly always evaluates and evidences where a builder would fix.

It also does not replace anything. AAIA sits alongside CISA in an audit career, a specialty layered on the general credential, and the prerequisite rule makes that literal: let the CISA lapse and the AAIA goes with it. If you are still deciding whether the underlying audit credential is worth the investment, read is the CISA worth it first, and if your ambitions lean toward security management rather than assurance, CISA vs CISM is the more useful comparison.

One last practical note. The AAIA is young, and young credentials change. The eligibility list has already been broadened once since launch, beyond the original three designations. Confirm the current figures on ISACA's AAIA page before you pay anything.

FAQ

How many questions is the AAIA exam?

90 multiple-choice questions in a single 150-minute session, which is about 100 seconds per question. There are no simulations or written components. The exam is available in English, Simplified Chinese, and Spanish.

Do I need a CISA to take the AAIA?

Not necessarily, but you need something. All CISA holders qualify automatically. Otherwise you must hold an active CIA, or one of a defined list of accountancy designations including US, Canadian, Australian, and Japanese CPA, ACCA or FCCA, ICAEW ACA or FCA, ANAN CNA, CA ANZ, or HKICPA, and work in an IT audit or IT advisory role. Experience on its own does not qualify.

What score do you need to pass the AAIA?

450 on a scaled range of 200 to 800. Because the score is scaled, there is no official percentage equivalent, and ISACA does not publish AAIA pass rates.

What does it cost to keep the AAIA?

An annual maintenance fee of USD 20 for members or USD 35 for nonmembers, plus a minimum of 10 CPE hours each year and 30 over a three-year cycle. Those hours must be in the AI specialty. You also have to keep the prerequisite credential you applied with in active status.

Can I take the AAIA exam online?

Yes, through PSI with a remote proctor, or at a PSI test center. Residents of India, Mainland China, and Hong Kong must test at a center.

Moving into AI assurance? ISACA AAIA: Simply Certified Study Guide teaches all three domains at the real 33/46/21 weighting, from the auditor's evaluate-and-assure lens, with two full-length practice exams and every answer explained.

Simply Certified is an independent publisher. AAIA, CISA and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.