Last updated:
AAIA preparation guide
AAIA Domain 2: AI operations
Direct answer
Domain 2, AI Operations, is the largest AAIA domain at 46% of the exam, with seven subareas. It covers how AI is run day to day: data, development and lifecycle, change, supervision of outputs, testing, threats and incidents. The auditor judges whether those controls are designed for AI and work in practice, using the records each AI process leaves behind.
ISACA describes the domain as assessing an organization's risk profile and the rewards and consequences of AI implementations, while ensuring the organization is operationally ready to adopt AI.
Seven subareas share the largest weight, and ISACA publishes no split of that weight between them. Plan study time for all seven, and expect familiar IT general controls, such as change and incident management, to be asked about AI specifically.
Start AAIA baselineDomain 2 subareas (46% of the exam)
| Subarea | What the auditor judges | AI evidence to ask for (examples) |
|---|---|---|
| 2A Data Management Specific to AI | Whether training, validation and input data are fit for use, lawful, traceable and protected | Data lineage, dataset versions, data quality checks, bias analysis of training data, access logs for datasets |
| 2B AI Solution Development Methodologies and Lifecycle | Whether the lifecycle has gates from design to decommissioning, with requirements, approvals and documentation | Lifecycle procedure, stage-gate approvals, model cards, validation reports, decommissioning records |
| 2C Change Management Specific to AI | Whether retraining, new data, threshold changes and prompt or configuration changes go through change control | Change tickets linked to model versions, revalidation results before release, model registry history |
| 2D Supervision of AI Solutions (e.g., Outputs, Impacts, and Decisions) | Whether outputs and decisions are monitored, and people can review, challenge and override them | Monitoring and drift reports, AI KPI and KRI reports, human review and override logs, escalations |
| 2E Testing Techniques for AI Solutions | Whether testing fits the model and its use: performance, robustness, bias and explainability | Test plans, results on representative data, acceptance criteria and sign-off |
| 2F Threats and Vulnerabilities Specific to AI | Whether AI-specific attacks are identified and treated, and access to models and data is controlled | Threat models that name AI attacks, adversarial test results, access reviews for models and pipelines |
| 2G Incident Response Management Specific to AI | Whether AI incidents are defined, detected, contained and learned from | AI incident criteria in the response plan, incident tickets, preserved prompts, outputs and model versions |
Original teaching example
A bank's credit-limit model was retrained on six more months of data and released to production on a Friday. The data science lead says retraining is routine and not a change. The change log has no entry, and the model validation team never saw the new version. You are auditing AI change management.
Retraining produces a new model version, so CertArc treats it as a change under 2C. The finding is that a new version reached production without a change record or revalidation. Compare the versions in the model registry with approved changes to see how often this happened, then report. Recommend that management bring retraining under change control with revalidation before release. The auditor neither rolls back the model nor approves the version.
Data, lifecycle and change (2A–2C)
Trace a model version back to its data and its approvals.
A useful audit test is to take the model in production and ask for the dataset that trained it, the validation that approved it and the change that released it. A break anywhere in that chain is a finding.
ISACA's tasks here include evaluating data input requirements for AI models, “e.g., data appropriateness, bias, privacy”, and the AI solution lifecycle, “e.g., design, development, deployment, monitoring, and decommissioning”.
Supervision and testing (2D–2E)
Monitoring and testing are evidence only when someone acts on the results.
Supervision in ISACA's subarea name covers outputs, impacts and decisions. A drift dashboard nobody reviews, or a human reviewer who cannot override the model, is supervision on paper only.
For testing, check that the tests fit the intended use and population, and that the acceptance criteria were set before the results came in.
Threats and incidents (2F–2G)
Check that AI attacks and AI failures appear in the threat and incident programs by name.
NIST's adversarial machine learning taxonomy (NIST AI 100-2) separates poisoning attacks, which occur during training, from prompt injection, an attack on deployed generative AI systems. Each needs its own control and leaves different evidence.
An AI incident needs its own criteria: a model giving harmful or wrong outputs may never trigger a security alert. Check that the response plan says what to preserve, such as prompts, outputs and the model version.
How technical Domain 2 gets
Technical enough to judge AI evidence, not to build or tune models.
Of ISACA's 23 tasks, 21 begin with “Evaluate”. You need to know what drift, bias testing, data poisoning and prompt injection are, and what records they leave, so you can judge whether a control addresses them.
Worked examples by subarea
One original scenario per subarea, with the stronger audit answer.
- 2A: A fraud model's training data comes from a vendor extract, and nobody can show how it was filtered. Stronger: report that data lineage is missing for the training set and test whether the data quality checks the procedure requires were run.
- 2B: A chatbot went live after a pilot, with no record of who approved the move to production. Stronger: test the lifecycle gate for deployment and report that it was bypassed.
- 2C: Engineers changed a content filter's thresholds directly in production to reduce complaints. Stronger: report a configuration change outside change control and check what else changed the same way.
- 2D: Recruiters override many of a screening model's rejections, and nobody reviews why. Stronger: report that override data is not analysed and recommend that the model owner reviews it.
- 2E: A model was tested only on data from the regions where it was built, but it now serves new regions. Stronger: report that testing does not cover the current population.
- 2F: A customer chatbot can read internal documents, and no test for prompt injection has been run. Stronger: report the untested threat and the broad access, and recommend testing and least-privilege access.
- 2G: After a chatbot leaked one customer's details to another, the team deleted the conversation logs. Stronger: report that the incident procedure did not require preserving AI evidence.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
How is AAIA Domain 2 weighted?
46% of the exam, the largest of the three domains in ISACA's outline.
How many subareas does Domain 2 have?
Seven, 2A to 2G, in ISACA's outline.
Is model retraining a change?
In CertArc's teaching, yes: retraining creates a new model version, so it should pass change control and revalidation. Change Management Specific to AI is subarea 2C.
How technical is AAIA Domain 2?
Know what AI controls and attacks are and what evidence they leave, well enough to evaluate them. ISACA's tasks ask you to evaluate, not to build models.
Is supervision the same as monitoring?
Monitoring is one part. ISACA's subarea 2D covers supervision of outputs, impacts and decisions, which also means people who can review and override the model.
Does Domain 2 include AI security?
Yes. Subarea 2F covers threats and vulnerabilities specific to AI, and ISACA's tasks include evaluating identity and access management specific to AI.
How can I practise Domain 2?
Take the free CertArc baseline to see your result by domain, then work through that domain's study sprints. Each review shows Your answer, Compare the answers and the CertArc AAIA Lens, so you see why the tempting option is weaker.
