Last updated:
AAIA preparation guide
AAIA auditor mindset: evaluate the AI, don't run it
Direct answer
On AAIA questions the auditor evaluates, tests, concludes, reports and recommends. Management owns the AI system, accepts its risk and implements fixes. An option where the auditor approves a model, retrains it, accepts a risk or writes the policy is usually the weaker answer, unless the scenario is an advisory engagement that keeps independence. Read the stated role before the options.
ISACA's AAIA tasks show the stance: 21 of the 23 begin with “Evaluate”, one with “Analyze” and one with “Utilize”.
AAIA builds on CISA or an equivalent audit designation, so the audit stance carries over. What changes is the subject: models, training data, monitoring, AI-specific threats and the AI tools auditors use themselves.
Start AAIA baselineAuditor or management? Sort the action
| Action in an option | Whose job | The auditor's version |
|---|---|---|
| Approve a model for production | Management: the model owner or AI committee | Evaluate whether the approval gate worked and left evidence |
| Retrain or roll back a model | Management: the model owner and data science team | Test whether the change followed change control and revalidation |
| Accept an AI risk | Management: the accountable risk owner | Evaluate whether the right person accepted it, on a current assessment |
| Write the AI policy | Management | Evaluate whether the policy covers the use and is followed |
| Comment on a planned AI control | The auditor, as an adviser that keeps independence | Give views on the design without approving or owning it |
Original teaching example
During an audit of an HR screening model, you find that recruiters override many of its rejections and nobody reviews why. The HR director asks you, as the auditor, to set a new score threshold, since you have already analysed the override data.
Setting the threshold would make the auditor part of the control being audited. Report the finding: overrides are not reviewed, so nobody knows whether the model or the recruiters are wrong. Recommend that the model owner analyses overrides, reviews the threshold and sets an escalation route. The auditor can share the analysis as evidence and later test the fix.
The auditor's role in AI questions
Evaluate, conclude and report; recommend, don't implement.
Most AAIA scenarios give you an AI system, a control around it and a fact that tests the control. The question asks what the auditor should do, conclude, test, rely on or report. That is how CertArc writes its AAIA questions.
Evaluate, don't implement
An option where the auditor fixes the problem looks helpful but costs independence.
If the auditor retrains the model, they cannot then give assurance on the retraining. The stronger option reports the issue to the owner, recommends action and follows up.
CertArc's AAIA review names this miss “Answered as management, not as an auditor”. It is not a rule that every management action is wrong: some questions ask what management should do, and the stated role decides.
When advising is the right answer
Advice is in scope when management keeps the decision.
ISACA describes Domain 1 as the ability to advise stakeholders on implementing AI, and one task is to “evaluate AI solutions to advise on impact, opportunities, and risk to organization.” The line is ownership: the auditor can comment on a design, but management approves and runs it.
Reading MOST, BEST and FIRST
The qualifier tells you which audit step or which risk the question wants.
ISACA's Exam Candidate Guide says every question has one best answer. In CertArc's teaching, FIRST usually points to understanding the AI system or the scope before testing; BEST to the strongest evidence or action within the auditor's role; MOST to the highest AI risk.
Three short scenarios
Each one turns on the role, not the technology.
- A data scientist asks the auditor to sign off a model's validation report. Stronger: decline the sign-off, and evaluate whether the validation met the organization's own criteria.
- An audit finds no human review of a lending model's declines. Management says it will accept the risk. Stronger: confirm that the accountable owner accepted it on a current assessment, and report the decision at the level the audit charter sets.
- An AI committee asks internal audit to help design monitoring for a new model. Stronger: advise on what the monitoring should show, while the model owner designs, approves and runs it.
How CertArc practice uses this
The review shows why the auditor's option beats the helpful one.
After each question, Your answer shows why your choice felt right and why it is not the AAIA answer. Compare the answers sets every option side by side, with where each one breaks. The CertArc AAIA Lens maps the scenario signal, the trap and the winning move. Tag the reason you missed, so the pattern is visible across sprints.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Why is the “fix it” answer often wrong for an auditor?
Because the auditor would then own part of the control being audited. Reporting and recommending keeps the audit independent and leaves the decision with management.
How is this different from AAISM's manager stance?
AAISM asks what the AI security manager should decide or build. AAIA asks what the auditor should evaluate and report. The same scenario can have a different best answer in each.
Is recommending the same as deciding?
No. A recommendation leaves the decision with management, who may accept the risk instead of acting on it.
What if management rejects the auditor's recommendation?
The auditor reports the risk and management's response at the level the audit charter sets, such as senior management or the audit committee. The auditor does not override the decision.
Does the auditor mindset mean avoiding technical detail?
No. You need enough AI knowledge to judge whether a control and its evidence are adequate. The difference is how you use that knowledge.
Can the auditor use AI tools without losing independence?
Yes, if the audit team controls the tool and checks its output. ISACA's outline includes using AI to enhance audit processes.
