Last updated:
AAIA preparation guide
AAIA Domain 3: AI auditing tools and techniques
Direct answer
Domain 3, AI Auditing Tools and Techniques, is 21% of the AAIA exam. Its five subareas follow the audit itself: planning, testing and sampling, evidence, data quality and analytics, and reporting, applied to AI systems. It also covers auditors using AI tools in their own work, which two of ISACA's tasks name directly. The question is always what the auditor can rely on and conclude.
ISACA describes the domain as optimizing audit outcomes through innovation, with knowledge of audit techniques tailored to AI systems and the use of AI-enabled tools to streamline audit efficiency.
The two tasks are “Evaluate impacts, opportunities, and risk when integrating AI solutions within the audit process” and “Utilize AI solutions to enhance audit processes, including planning, execution, and reporting.”
The audit process will be familiar from CISA. What this domain adds is the AI object: a model, a dataset, AI-generated evidence or an AI tool the audit relies on.
Start AAIA baselineDomain 3 subareas (21% of the exam)
| Subarea | What the auditor judges | AI evidence to ask for (examples) |
|---|---|---|
| 3A Audit Planning and Design | Whether the audit understands the AI system, its inventory and its risks before scoping tests | AI inventory, model documentation, past AI incidents and risk assessments used to set scope |
| 3B Audit Testing and Sampling Methodologies | Whether tests and samples cover the right model versions, periods, populations and decisions | The full population of model decisions or releases, the sampling rationale, re-performance of outputs |
| 3C Audit Evidence Collection Techniques | Whether evidence is sufficient, reliable and relevant for an AI control | System-generated logs and monitoring and override records for the period, not only design documents |
| 3D Audit Data Quality and Data Analytics | Whether data the audit uses, including AI-processed data, is complete and accurate | Reconciliations to source, completeness checks, a record of the analytics or AI tool used |
| 3E AI Audit Outputs and Reports | Whether AI findings are clear, supported and reach the right audience | Working papers linking each finding to evidence, management responses, follow-up records |
Original teaching example
An internal audit team uses a large language model to sort thousands of call-centre complaints and find those about a lending chatbot. The tool reports a small number of complaints about wrong loan terms, and the team plans to put that figure straight into the audit report.
The tool's output is AI-processed audit evidence, so it needs testing before reliance (3D). Re-classify a sample of complaints by hand, including some the tool did not flag, to estimate what it missed. Record the tool, the instructions given to it and the checks done. The audit team, not the tool, stays accountable for the figure and the conclusion.
Planning and design (3A)
Understand the AI system before you test it.
Start with the AI inventory, the model's documentation, its intended use and its known incidents. A scope set before you know which model versions and data are in production may test the wrong thing.
Testing, sampling and evidence (3B–3C)
Test operation over the period, not only the design.
The population for an AI test is often new: model decisions, retraining events, prompts or overrides. Check the population is complete before sampling from it.
A model card, policy or vendor report describes design. Operating effectiveness needs records from the period, such as monitoring alerts with follow-up, override logs and change tickets, or your own re-performance.
Data quality and analytics (3D)
Data the audit relies on must be complete and accurate, whatever produced it.
That applies to extracts from an AI system and to outputs from an AI tool the auditor uses. Reconcile to source where you can, and test a sample where you cannot.
Reporting AI findings (3E)
Report the condition, the evidence and the risk; management owns the response.
AI findings need plain language for the audience: what the model does, what failed, and the effect on customers, decisions or compliance. Recommend; do not prescribe a design management must adopt.
Using AI inside the audit
ISACA's outline includes using AI tools in the audit; the auditor stays accountable for the result.
As examples of the risks, an AI tool can miss items, invent detail, or expose confidential audit data to a supplier. Your audit function's methodology sets what is allowed; the exam's tasks ask you to evaluate the impact, opportunities and risk.
Worked examples by subarea
One original scenario per subarea, with the stronger audit answer.
- 3A: You are asked to audit “the AI controls” of a firm with dozens of models. Stronger: use the AI inventory and risk assessments to scope the audit to the highest-risk models first.
- 3B: The sample for a model-approval test was drawn only from the current model version, but three versions ran during the audit period. Stronger: sample across every version that ran in the period.
- 3C: The model owner gives you screenshots of a drift dashboard. Stronger: obtain the system's alert history for the period and the tickets showing who acted on each alert.
- 3D: An extract of model decisions for testing came from the model team's own spreadsheet. Stronger: reconcile it to the production system's records before relying on it.
- 3E: A draft report says “the AI is biased” with no detail. Stronger: state which outcomes differed, for which group, on what evidence, and the business effect.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
How is AAIA Domain 3 weighted?
21% of the exam, by ISACA's June 2025 outline.
How many subareas does Domain 3 have?
Five, 3A to 3E, in ISACA's outline.
Can auditors use AI tools in fieldwork?
ISACA's outline includes the task “Utilize AI solutions to enhance audit processes, including planning, execution, and reporting.” Your audit function's own methodology sets the rules.
Who is accountable for AI-assisted audit findings?
The auditor and the audit function. An AI tool can help produce evidence or drafts; it cannot own the conclusion.
Is Domain 3 the CISA audit process again?
It uses the same audit process, applied to AI systems and AI-processed evidence. A question with no AI object would not test what this domain adds.
Is sampling different for AI systems?
The method is familiar; the population changes. It may be model decisions, model versions, retraining events or prompts.
How can I practise Domain 3?
Take the free CertArc baseline to see your result by domain, then work through that domain's study sprints. Each review shows Your answer, Compare the answers and the CertArc AAIA Lens, so you see why the tempting option is weaker.
