Last updated:
AAIA preparation guide
AAIA Domain 1: AI governance and risk
Direct answer
Domain 1, AI Governance and Risk, is 33% of the AAIA exam in ISACA's outline. It asks whether you can evaluate how an organization decides to use AI: who owns each AI risk, whether policy covers the use, whether privacy and data governance reach AI data, and which laws and standards apply. The auditor tests and reports on those arrangements; management sets them up.
ISACA describes the domain as the ability to advise stakeholders on implementing AI to meet strategic goals, create ethical and responsible AI policy and governance practices, and mitigate implementation risks, including data governance, privacy and security.
ISACA lists five subareas and publishes no topic list below them. The evidence and scenarios on this page are CertArc's examples, not an official syllabus.
Two subarea names, AI Governance and Program Management and AI Risk Management, match the names of AAISM's first two domains. AAIA asks the auditor's question: is this governance designed well, is it working, and what should be reported?
Start AAIA baselineDomain 1 subareas (33% of the exam)
| Subarea | What the auditor judges | AI evidence to ask for (examples) |
|---|---|---|
| 1A AI Models, Considerations, and Requirements | Whether the model type and its business, technical and legal requirements were defined and fit the intended use | Model card or model documentation, intended-use statement, requirements sign-off |
| 1B AI Governance and Program Management | Whether AI use has owners, policy, an inventory and oversight that work in practice | AI policy, AI inventory, AI committee minutes and decisions, awareness and training records |
| 1C AI Risk Management | Whether AI risks are identified, assessed against appetite, treated and accepted by the right person | AI risk register entries, risk assessments for each use case, risk acceptance sign-offs, AI risk indicators |
| 1D Privacy and Data Governance Programs | Whether privacy and data governance reach training, input and output data | Data lineage, privacy impact assessments that name the AI use, data-use terms with AI suppliers |
| 1E Leading Practices, Ethics, Regulations, and Standards for AI | Whether the organization knows which laws, standards and ethics commitments apply, and can show it meets them | Applicability assessment, compliance mapping, ethics review records, evidence for each obligation |
Original teaching example
An insurer uses a supplier's model to flag claims for fraud review. The AI committee approved it a year ago. You find that the business owner has left, the supplier has retrained the model twice, and the risk register still describes the first version. The claims director asks you to update the register and suggest a new owner.
Updating the register would make the auditor part of the risk process being audited. Report three gaps: an AI risk with no accountable owner, a risk assessment that predates two retrained versions, and no evidence the committee heard about the changes. Recommend that management name an owner, reassess the current version and require change notice from the supplier. Management decides and fixes; the auditor follows up.
What Domain 1 tests
Whether AI governance is designed and operating, judged on evidence.
Questions usually give you a governance arrangement, such as a policy, a committee or a risk register, and a fact that tests it: a new use case, a retrained model, a supplier change or a new law.
The best answer evaluates that arrangement against the fact. It rarely writes the policy or chooses the control, because those are management's decisions.
Evaluating ownership and policy
Look for a named owner for each AI use, and a policy that actually covers it.
One of ISACA's 23 tasks is to “evaluate whether the organization has defined ownership of AI-related risk, controls, procedures, decisions, and standards.” ISACA does not map tasks to domains; reading this one as Domain 1 work is CertArc's.
Policy gaps in AI are often about scope. A policy written for one approved tool may say nothing about generative AI services staff find for themselves, or about models a supplier changes without notice.
Privacy and data governance for AI (1D)
Check that the existing privacy and data programs reach AI data, not only the source systems.
ISACA's tasks include evaluating the organization's data governance program and its privacy program “specific to AI”. Typical gaps, as examples: personal data collected for one purpose reused to train a model, or prompts containing personal data sent to a supplier whose terms allow reuse.
Laws, standards and ethics (1E)
The outline names regulations and standards as a subarea without listing any.
CertArc does not claim that any named law or framework is tested. Know how an auditor decides which obligations apply, and what evidence shows they are met. Public frameworks such as the NIST AI RMF, ISO/IEC 42001 and the EU AI Act are useful references; CertArc's AI audit frameworks guide summarises each.
Worked examples by subarea
One original scenario per subarea, with the stronger audit answer.
- 1A: A bank plans to use a general-purpose language model to draft replies about loan terms. No one has written down what the model must not do. Stronger: report that requirements and limits for the intended use are undefined, and recommend they are set and approved before testing.
- 1B: The AI inventory lists four models, but expense claims show teams paying for several AI services not on it. Stronger: report that the inventory is incomplete and test how new AI use is meant to reach it, rather than adding the services yourself.
- 1C: A model that sets delivery prices was accepted as low risk by a project manager with no risk authority. Stronger: report that the acceptance was made by the wrong person, and recommend that the accountable risk owner reassess it.
- 1D: A retailer trains a recommendation model on loyalty-card data collected under a notice that never mentions AI. Stronger: report the gap between the stated purpose and the training use, and recommend a privacy review before the next retraining.
- 1E: A company hiring across several countries uses an AI tool to filter applications, and nobody has checked which AI or employment laws apply. Stronger: recommend an applicability assessment owned by legal and compliance, then test the controls that each applicable duty requires.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
How is AAIA Domain 1 weighted?
33% of the exam, by ISACA's June 2025 outline.
How many subareas does Domain 1 have?
Five, 1A to 1E, in ISACA's outline.
How is AAIA Domain 1 different from AAISM's governance domain?
Some subarea names overlap, but AAIA asks whether governance is designed and working and what to report. AAISM asks the AI security manager to decide on and build it.
Is privacy in scope for Domain 1?
Yes. Subarea 1D is Privacy and Data Governance Programs, and one of ISACA's tasks is to evaluate the organization's privacy program specific to AI.
Do I need to memorise AI laws for Domain 1?
ISACA's outline names no specific law or standard. Know how to judge which obligations apply to an AI use and what evidence shows they are met.
Does ISACA publish topics below the subareas?
No. ISACA publishes three domains, 17 subareas and 23 tasks, with no topic list below the subareas and no map from tasks to domains.
How can I practise Domain 1?
Take the free CertArc baseline to see your result by domain, then work through that domain's study sprints. Each review shows Your answer, Compare the answers and the CertArc AAIA Lens, so you see why the tempting option is weaker.
