AAIA is Advanced in AI Audit, an ISACA credential for auditors whose scope now includes AI systems. It is not an entry point. You need CISA or an equivalent audit designation before you can register.
AAIA tackles a question many audit teams are stuck on. How do you audit a system whose behaviour is probabilistic? You may not have its training data, and the vendor may treat the model as a trade secret.
Who Can Sit It
ISACA gates AAIA behind an existing qualification. You need an active CISA. Failing that, you need one of these designations, held in an IT audit or IT advisory role: CIA, US CPA, ACCA or FCCA, Canadian CPA, Australian CPA or FCPA, or Japanese CPA.
That list tells you who the credential is for. It is aimed at people already doing assurance work, not at security engineers who want to add AI to their skill set. If you are on the security side rather than the audit side, AAISM is the parallel credential built for you.
What Does It Cover?
Three practice areas:
AI Governance and Risk: How AI systems are governed, where accountability sits, and how AI-specific risk is identified and assessed against existing enterprise risk frameworks.
AI Operations: How AI systems are built, deployed, and monitored in practice. An auditor needs this before they can judge whether controls are working.
AI Auditing Tools and Techniques: The methods themselves. How to plan and execute an audit of an AI system, what evidence to gather, and what testing is possible when you cannot inspect the model directly.
ISACA has not published percentage weights for the three areas. CISA and CRISC both include weights in their exam outlines. Check the current exam content outline on ISACA’s site before planning study time by area.
Who Should Take AAIA?
IT auditors whose organisation has deployed AI and now has to give assurance over it. Internal audit leads writing the AI section of an audit plan. Consultants selling AI assurance work who need something on the proposal that isn’t just a CISA.
One caveat. AAIA is a new credential in a fast-moving field, and it doesn’t yet appear in job adverts the way CISA does. Take it because your current work needs the knowledge, not because it will open doors on its own. That may change, but it has not yet.
If your work is governance and privacy rather than audit, look at CDPSE. It covers data privacy engineering and sits closer to system design than to assurance.
Exam Details
- Full Name: Advanced in AI Audit (AAIA)
- Issuer: ISACA
- Practice Areas: AI Governance and Risk, AI Operations, AI Auditing Tools and Techniques
- Prerequisite: Active CISA, or CIA, US CPA, ACCA or FCCA, Canadian CPA, Australian CPA or FCPA, or Japanese CPA in an IT audit or IT advisory role
- Level: Advanced
ISACA prices exams differently for members and non-members and applies a separate application fee once you pass. Check current figures on ISACA’s registration page. ISACA adjusts them periodically, so don’t rely on a number quoted elsewhere.
What Comes After AAIA?
For auditors, the natural companions are the ISACA credentials you may already hold: CRISC for enterprise risk and CDPSE for privacy engineering. Together they cover most of what an AI assurance engagement touches.
If your remit is widening from audit into running the security programme, look at CISM. AAISM builds on it for the AI-specific part.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.