Last updated:
AAIA preparation guide
AAIA exam domains: weights, 17 subareas and 23 tasks
Direct answer
ISACA's June 2025 outline has three AAIA domains: AI Governance and Risk (33%), AI Operations (46%) and AI Auditing Tools and Techniques (21%). Under them sit 17 lettered subareas and 23 supporting tasks. AI Operations is the largest, with seven subareas. ISACA publishes nothing below the subareas and no map from tasks to domains, so treat any finer topic list as someone's interpretation.
These are ISACA's names, from the AAIA Exam Content Outline web page and the outline appendix in the AAIA Exam Candidate Guide, which agree. ISACA's main AAIA page names the domains but not their weights.
Domain results on your score report are informational. Your score depends on all the questions you answer correctly, whatever their domain, so the weights show where the questions are, not hurdles to clear one by one.
Start AAIA baselineAAIA domains and subareas (June 2025 outline, checked October 17, 2026)
| Domain | Weight | Subareas |
|---|---|---|
| Domain 1: AI Governance and Risk | 33% | 1A AI Models, Considerations, and Requirements; 1B AI Governance and Program Management; 1C AI Risk Management; 1D Privacy and Data Governance Programs; 1E Leading Practices, Ethics, Regulations, and Standards for AI |
| Domain 2: AI Operations | 46% | 2A Data Management Specific to AI; 2B AI Solution Development Methodologies and Lifecycle; 2C Change Management Specific to AI; 2D Supervision of AI Solutions (e.g., Outputs, Impacts, and Decisions); 2E Testing Techniques for AI Solutions; 2F Threats and Vulnerabilities Specific to AI; 2G Incident Response Management Specific to AI |
| Domain 3: AI Auditing Tools and Techniques | 21% | 3A Audit Planning and Design; 3B Audit Testing and Sampling Methodologies; 3C Audit Evidence Collection Techniques; 3D Audit Data Quality and Data Analytics; 3E AI Audit Outputs and Reports |
Original teaching example
A practice question: a hospital's sepsis-alert model flags patients for review. Clinicians can override an alert, but nobody reviews the overrides, and the vendor's validation used another hospital's patients. What should the auditor evaluate first?
One scenario touches 2D (supervision of AI solutions), 2E (testing techniques for AI solutions), 3C (audit evidence collection) and supporting task 17 (design and effectiveness of controls specific to AI). Learn the subareas as a coverage checklist rather than as separate silos. The auditor first evaluates whether the oversight and validation controls work for this hospital, not whether to replace the model.
Domain 1: AI Governance and Risk (33%)
Five subareas on how AI is governed, risk-managed and kept within privacy rules, ethics, law and standards.
Read them from the auditor's side: does the organization have AI policies, owners and a risk process, and do they work? Supporting tasks 6 (AI policies and compliance), 8 (ownership of AI-related risk and decisions) and 10 (the privacy program specific to AI) fit here, although ISACA does not assign tasks to domains.
- 1A AI Models, Considerations, and Requirements
- 1B AI Governance and Program Management
- 1C AI Risk Management
- 1D Privacy and Data Governance Programs
- 1E Leading Practices, Ethics, Regulations, and Standards for AI
Domain 2: AI Operations (46%)
Nearly half the exam: the AI system in operation, across seven subareas.
These subareas cover an AI system's data, how it is built and changed, how its outputs are supervised and tested, and how AI-specific threats and incidents are handled. Expect AI concepts here that a general IT audit background may not cover, such as training-data quality, model retraining and adversarial inputs.
- 2A Data Management Specific to AI
- 2B AI Solution Development Methodologies and Lifecycle
- 2C Change Management Specific to AI
- 2D Supervision of AI Solutions (e.g., Outputs, Impacts, and Decisions)
- 2E Testing Techniques for AI Solutions
- 2F Threats and Vulnerabilities Specific to AI
- 2G Incident Response Management Specific to AI
Domain 3: AI Auditing Tools and Techniques (21%)
The audit itself, applied to AI: planning, testing and sampling, evidence, data analytics and reporting.
Supporting tasks 1 and 2 add the reverse case: evaluating and using AI tools inside the audit process, from planning to reporting.
- 3A Audit Planning and Design
- 3B Audit Testing and Sampling Methodologies
- 3C Audit Evidence Collection Techniques
- 3D Audit Data Quality and Data Analytics
- 3E AI Audit Outputs and Reports
The 23 supporting tasks
ISACA lists 23 tasks as other skills tested; the candidate guide numbers them 1 to 23.
The web page lists the same tasks in another order, with the guide's first two (AI in the audit process) at the end. CertArc uses the guide's numbering. Twenty-one tasks start with “Evaluate”; task 2 starts with “Utilize” and task 22 with “Analyze”. Shortened here:
- 1. Impacts, opportunities and risk of integrating AI into the audit process
- 2. Using AI to enhance audit planning, execution and reporting
- 3. AI solutions, to advise on impact, opportunities and risk
- 4. Impact of AI on system interactions, the environment and humans
- 5. Role and impact of AI decision-making systems
- 6. AI policies and procedures, including legal and regulatory compliance
- 7. Monitoring and reporting of AI metrics such as KPIs and KRIs
- 8. Defined ownership of AI-related risk, controls, procedures, decisions and standards
- 9. Data governance program specific to AI
- 10. Privacy program specific to AI
- 11. Problem and incident management specific to AI
- 12. Change management specific to AI
- 13. Configuration management specific to AI
- 14. Threat and vulnerability management specific to AI
- 15. Identity and access management specific to AI
- 16. Vendors and supply chain management for AI solutions
- 17. Design and effectiveness of controls specific to AI
- 18. Data input requirements for AI models, such as appropriateness, bias and privacy
- 19. System and business requirements, aligned with enterprise architecture
- 20. The AI solution life cycle, from design to decommissioning, for compliance and risk
- 21. Algorithms and models, aligned to business objectives, policies and procedures
- 22. Impact of AI on the workforce, training and education
- 23. Awareness programs aligned to AI-related policies and procedures
What the outline does not say
No topic list below the subareas, no task-to-domain map, and no named law, framework or standard.
Subarea 1E covers leading practices, ethics, regulations and standards for AI, but the outline names no specific law or framework. A guide that says the exam tests a particular framework at control level is going beyond what ISACA publishes.
ISACA's Review Manual and other prep products may go deeper. They are ISACA's teaching material; the outline is what defines the exam's coverage.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Which AAIA domain is largest?
AI Operations, at 46% of the exam, with seven of the 17 subareas.
Are AAIA domain scores pass or fail?
No. ISACA reports domain results for information only; your score is based on all the questions you answer correctly.
Does ISACA list frameworks or laws for AAIA?
No. Subarea 1E covers regulations and standards for AI, but the outline names none.
How many tasks does the AAIA outline have?
23 supporting tasks. ISACA does not map them to domains or subareas.
Which outline version is current?
The June 2025 outline, on ISACA's outline page and in the candidate guide appendix (checked October 17, 2026).
