Last updated:
AAIA preparation guide
AI audit frameworks: NIST AI RMF, ISO/IEC 42001, EU AI Act, GAO
Direct answer
ISACA's AAIA outline names no specific AI framework, law or standard. Subarea 1E covers leading practices, ethics, regulations and standards for AI in general. Public sources that can serve as audit criteria include the NIST AI RMF, ISO/IEC 42001, the EU AI Act and GAO's AI Accountability Framework. Know what each is and how to test against it; do not treat any one as the syllabus.
Neither the AAIA Exam Content Outline nor the Exam Candidate Guide names an AI framework, law or standard as exam content. Claims that the exam tests a set list of frameworks are not supported by ISACA's documents.
A framework becomes audit criteria when the organization has adopted it or a law binds it. The auditor's first question is which criteria apply to this AI use.
Start AAIA baselinePublic AI frameworks at a glance
| Framework | What it is | How an auditor can use it |
|---|---|---|
| NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) | A voluntary US framework released on 26 January 2023, organised in four functions: Govern, Map, Measure and Manage | Criteria for an AI risk program; NIST's Generative AI Profile (NIST AI 600-1, July 2024) adds generative AI actions |
| ISO/IEC 42001:2023 | An international standard, published in December 2023, that sets requirements for an AI management system | Criteria for whether an AI management system is established, maintained and improved |
| EU AI Act (Regulation (EU) 2024/1689) | EU law of 13 June 2024 with a risk-based approach: prohibited practices, high-risk requirements and transparency duties | Legal criteria where it applies, such as risk management, logging and human oversight for high-risk systems |
| GAO AI Accountability Framework (GAO-21-519SP) | A US Government Accountability Office framework, published on 30 June 2021, built on governance, data, performance and monitoring | Key practices with questions and procedures written for auditors and third-party assessors |
Original teaching example
A retailer operating in the EU uses a supplier's AI tool to filter job applications. Its AI policy says it “follows ISO/IEC 42001”, and the supplier says the tool is “EU AI Act ready”. The chief audit executive asks you which framework the audit should use as criteria.
Start with applicability, not preference. The EU AI Act's Annex III lists AI systems used to analyse and filter job applications among high-risk uses, so check with legal which duties fall on the retailer as deployer, such as assigning human oversight. Use ISO/IEC 42001 as criteria for the management system only if the retailer has adopted it for this scope. The supplier's “ready” claim is something to test, not evidence.
What the AAIA outline says (1E)
One subarea covers leading practices, ethics, regulations and standards, without naming any.
Subarea 1E is Leading Practices, Ethics, Regulations, and Standards for AI. One of ISACA's tasks is to “evaluate the organization's AI policies and procedures, including compliance with legal and regulatory requirements.” The skill tested is evaluating compliance, not reciting a text.
What each framework is for
Each one answers a different audit question.
- NIST AI RMF: is AI risk governed, mapped, measured and managed across the lifecycle? NIST lists trustworthy-AI characteristics, such as valid and reliable, secure and resilient, and fair with harmful bias managed.
- ISO/IEC 42001: does the organization run an AI management system, with policies, objectives and processes, improved through Plan-Do-Check-Act? ISO sells the standard; its public page gives a summary.
- EU AI Act: what does the law require for this AI use? For high-risk systems it includes a risk management system (Article 9), automatic logs (Article 12) and human oversight (Article 14).
- GAO AI Accountability Framework: which accountability practices should exist, and how would an auditor test them? Each practice includes questions and audit procedures.
Turning a framework into audit criteria
Choose the criteria that apply, map each requirement to a control, then test evidence for each control.
For example, the EU AI Act requires deployers of high-risk systems to assign human oversight to people with the necessary competence, training and authority (Article 26). Audit evidence would include the assignment records, training records and review logs that show the oversight happened.
Report a gap against the criteria it breaches. Whether to adopt a framework, or how to close the gap, is management's decision.
What ISACA does not prescribe
No framework, no law and no topic list below the 17 subareas.
CertArc does not claim that the AAIA exam tests any named framework. Use the frameworks to understand what good AI governance and control look like, then practise judging evidence against them.
Other public references can help with specific subareas, for example NIST's adversarial machine learning taxonomy (NIST AI 100-2) for AI threats, and ISO/IEC 23894, which ISO describes as guidance on AI-related risk management.
Sources and fact check
Source checked: 2026-10-17
- ISACA AAIA Exam Content Outline
- ISACA AAIA Exam Candidate Guide
- NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1)
- ISO/IEC 42001:2023 AI management system (ISO page)
- Regulation (EU) 2024/1689, the Artificial Intelligence Act (EUR-Lex)
- GAO-21-519SP: AI Accountability Framework (U.S. GAO)
- NIST AI 100-2 E2025: Adversarial Machine Learning, a taxonomy of attacks and mitigations
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Does the AAIA exam test the EU AI Act?
ISACA's outline and candidate guide name no specific law. Subarea 1E covers regulations in general, so know how to judge which AI laws apply and what evidence shows compliance.
NIST AI RMF or ISO/IEC 42001: which should I learn?
They do different jobs. The NIST AI RMF is a voluntary risk framework with four functions; ISO/IEC 42001 sets requirements for an AI management system. CertArc suggests knowing the purpose and structure of both.
Is ISO/IEC 42001 free to read?
No. ISO sells the standard. Its public page summarises what it covers and who it is for.
Which AI framework was written for auditors?
GAO's AI Accountability Framework includes questions and procedures for auditors and third-party assessors, organised around governance, data, performance and monitoring.
Do I need to memorise framework clauses for AAIA?
ISACA's outline lists no framework, so CertArc's advice is to know each one's purpose and structure and how to test against it, not its clause numbers.
Can a supplier's compliance claim be audit evidence?
It is a claim to test. Ask what it covers, for which version and period, and check the controls your organization runs itself.
