Last updated:
AAIA preparation guide
AAIA eligibility and exam format: who can sit and what to expect
Direct answer
ISACA opens the AAIA exam to active CISA holders, and to holders of 15 listed audit and accounting designations, such as CIA, US CPA or ACCA, who work in an IT audit or IT advisory role. ISACA sets no separate years-of-experience rule. The exam has 90 multiple-choice questions in 150 minutes, in English, Simplified Chinese or Spanish, at a PSI test centre or by remote proctoring.
Eligibility for ISACA Advanced in AI Audit (AAIA) comes from ISACA's Qualified Prerequisite List, printed on its AAIA page and in the AAIA Exam Candidate Guide. ISACA's own summary lines are shorter than that list: the guide's summary names only CISA, CIA and CPA. The table below is the full list.
ISACA expanded the list in July 2025 and has added designations since, so older articles often show fewer. Some also add an experience rule that ISACA does not set.
Start AAIA baselineISACA's Qualified Prerequisite List for AAIA (checked October 17, 2026)
| Designation | Issued by | Who qualifies |
|---|---|---|
| CISA | ISACA | All active holders |
| CIA (Certified Internal Auditor) | Institute of Internal Auditors (IIA) | With an IT audit or IT advisory role |
| US CPA | A US state board of accountancy | With an IT audit or IT advisory role |
| ACCA Chartered Certified Accountant | Association of Chartered Certified Accountants (ACCA) | With an IT audit or IT advisory role |
| FCCA (Fellow of the ACCA) | ACCA | With an IT audit or IT advisory role |
| Australian CPA | CPA Australia | With an IT audit or IT advisory role |
| Australian FCPA | CPA Australia | With an IT audit or IT advisory role |
| Japanese CPA | Japan Financial Services Agency | With an IT audit or IT advisory role |
| Canadian CPA (Chartered Professional Accountant) | Canadian provincial accounting bodies | With an IT audit or IT advisory role |
| ICAEW ACA (Associate Chartered Accountant) | Institute of Chartered Accountants in England and Wales (ICAEW) | With an IT audit or IT advisory role |
| ICAEW FCA (Fellow Chartered Accountant) | ICAEW | With an IT audit or IT advisory role |
| CNA (Certified National Accountant) | Association of National Accountants of Nigeria (ANAN) | With an IT audit or IT advisory role |
| CA ANZ Chartered Accountant (CA) | Chartered Accountants Australia and New Zealand (CA ANZ) | With an IT audit or IT advisory role |
| CA ANZ Fellow Chartered Accountant (FCA) | CA ANZ | With an IT audit or IT advisory role |
| Hong Kong CPA | Hong Kong Institute of Certified Public Accountants (HKICPA) | With an IT audit or IT advisory role |
| Hong Kong FCPA | HKICPA | With an IT audit or IT advisory role |
Original teaching example
Priya holds an active CIA and leads her bank's internal audit of a credit-scoring model: she reviews its validation report, its data lineage and the override log the credit team keeps. Her colleague Tom passed the CISA exam last month, but his CISA certification application is still pending.
Priya qualifies: she holds a listed designation and her role is IT audit work. Tom does not yet hold an active CISA certification, which is what ISACA asks for, and ISACA does not say whether a pending application counts. He should ask ISACA before paying the non-refundable exam fee. ISACA, not CertArc, decides eligibility.
Who can sit AAIA?
Active CISA holders, or holders of a listed designation who work in IT audit or IT advisory.
The role condition applies to every listed designation except CISA. ISACA doesn't publish how it judges an IT audit or IT advisory role, so if yours is borderline, ask ISACA support before you register.
ISACA's AAIA pages state no minimum years of experience. You must keep the qualifying credential active, both to certify and to maintain AAIA afterwards.
Does a passed CISA exam count?
ISACA asks for an active CISA certification, not only a passed exam.
Passing the CISA exam is the first step; CISA certification follows when ISACA approves your application, including its experience requirement. ISACA's AAIA pages do not say whether a pending CISA application lets you register for AAIA. Ask ISACA first, because exam fees are non-refundable and non-transferable.
Exam format
90 multiple-choice questions in 150 minutes, each with four options and one best answer.
That is an average of 100 seconds a question. A stem can be a question or an incomplete statement, and some use a qualifier such as MOST likely or BEST. There is no penalty for a wrong answer, so answer every question.
The exam follows ISACA's June 2025 outline: three domains, 17 subareas and 23 supporting tasks.
Languages and delivery
English, Simplified Chinese or Spanish, at a PSI test centre or online with a remote proctor.
Candidates in India, mainland China and Hong Kong must use a test centre; ISACA does not offer AAIA by remote proctoring there. Remote candidates can chat with the proctor in English only.
You can book an appointment as early as 48 hours after paying, and appointments open 90 days ahead.
Scoring and results
ISACA reports a scaled score from 200 to 800, based on the total number of questions you answer correctly.
Unscored pretest questions are mixed in. Domain results are for information only, and no domain is passed or failed on its own. You see a preliminary result on screen; the official score arrives by email within 10 working days. ISACA does not give question-level results.
Your six-month window
From the day you register, you have six months to sit the exam.
You can reschedule without penalty up to 48 hours before your appointment. Miss it, or arrive more than 15 minutes late, and you forfeit the fee.
The candidate guide is inconsistent on extensions: section 2.1 offers one six-month extension for US$75, while section 2.3 says no eligibility extensions are allowed. Confirm with ISACA before you rely on one.
After you pass
Apply for certification within five years and pay the US$50 application fee.
ISACA also asks you to follow its Code of Professional Ethics, its CPE policy and its Information Systems Auditing Standards. CPE starts in the calendar year after you certify: at least 10 hours a year in AI, and 30 over three years.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Can a CIA or CPA sit AAIA?
Yes, if you work in an IT audit or IT advisory role. ISACA lists the CIA, the US CPA and 13 other audit and accounting designations with that condition.
Is work experience required for AAIA?
ISACA's AAIA pages set no years-of-experience rule. You need a qualifying designation and, for every designation except CISA, an IT audit or IT advisory role.
Does a pending CISA application count?
ISACA asks for an active CISA certification and does not say whether a pending application qualifies. Ask ISACA support before you register.
Can I take the AAIA exam online from India?
No. ISACA says candidates in India, mainland China and Hong Kong must sit AAIA at a test centre.
Is there a calculator in the AAIA exam?
No. ISACA's exam-day rules prohibit calculators, notes, paper and other aids, at test centres and online.
When do I apply for AAIA certification?
After you pass. You have five years from passing to apply, and you pay the US$50 application fee then.
