Last updated:
AAIA preparation guide
How hard is the AAIA exam? What ISACA publishes, and what it doesn't
Direct answer
ISACA publishes no pass rate for AAIA, so any percentage you see elsewhere is not an ISACA figure. What ISACA does publish: 90 questions in 150 minutes, scaled scoring, AI Operations at 46% of the exam, and a free quiz it describes as the same level of difficulty as the exam. That quiz includes technical AI items, so expect more than audit process.
Difficulty depends on what you already know. A CISA holder brings audit planning, sampling, evidence and reporting; AAIA adds how AI systems are built, tested, supervised and attacked.
CertArc doesn't rank AAIA against other exams, because no published data supports a ranking.
Start AAIA baselineWhat ISACA publishes about AAIA difficulty (checked October 17, 2026)
| Question | What ISACA says |
|---|---|
| Pass rate | None published on ISACA's AAIA page, outline or candidate guide |
| Scoring | A scaled score from 200 to 800, based on the total answered correctly; pretest items are not scored |
| Domain results | Informational only; no domain is passed or failed on its own |
| Question style | Four options and one best answer; some stems use qualifiers such as MOST likely or BEST |
| Wrong answers | No penalty, so answer every question |
| Official sample | A free 12-question quiz, which ISACA describes as the same level of difficulty as the exam |
| Retakes | Four attempts in a rolling 12 months, paying the full fee each time |
Original teaching example
A practice question: a bank's fraud model reports high overall accuracy, but fraud is rare in its training data and most fraud cases are missed. The model owner cites the accuracy figure as evidence the model works. What should the auditor ask for?
The stronger step is evidence of performance on the rare class, such as how many actual fraud cases the model catches, because overall accuracy can hide it. Uneven class distribution in training data is one of the subjects in ISACA's own free quiz. You don't need to build models for AAIA, but you do need to know what evidence a claim about a model requires.
Is there an AAIA pass rate?
Not from ISACA.
ISACA's AAIA page, outline and candidate guide give no pass rate. Treat any quoted AAIA pass rate as unverified unless it links to ISACA. Some published figures also treat a scaled score as a percentage, which it is not.
How scoring works
Your scaled score reflects every question you answer correctly.
A scaled score converts a raw score to a common 200–800 scale, so that different versions of the exam are comparable and fair. It is not a percentage, and ISACA's candidate guide sets the passing standard on that scale. Pretest items are mixed in but not scored, and domain results are informational.
How technical is AAIA?
More technical than an audit-process exam, judging by ISACA's own free quiz.
Subjects in ISACA's 12-question quiz include generative adversarial networks, uneven class distribution in training data, A/B testing of model versions and runtime attacks, alongside AI in the audit process.
AI Operations is 46% of the exam and covers data, development, change, supervision, testing, threats and incidents, each specific to AI. Candidate accounts posted online disagree: some call AAIA more technical than other ISACA exams, others say it tests governance, risk and explainability more than deep technical skill. Treat each as one person's experience.
Is AAIA harder than CISA?
There's no published data to rank them.
They differ in shape. AAIA has 90 questions in 150 minutes, 100 seconds each on average; CISA has 150 in 240 minutes, 96 seconds each. AAIA builds on the audit judgment CISA tests and adds AI subject matter.
If you don't pass: retake rules
You can retake up to three more times within 12 months of your first attempt, paying the full fee each time.
The waits are 30 days after the first attempt, then 90 days, then 90 days. You can request a rescore within 30 days of results, for US$75. ISACA gives no question-level results, so use your domain results and your own review notes to plan the next attempt.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
What is the AAIA pass rate?
ISACA publishes none. Any figure you see elsewhere is not an ISACA statistic.
Is AAIA harder than CISA?
There is no published data to compare them. AAIA is shorter, at 90 questions to CISA's 150, and adds AI subject matter to audit judgment.
How many times can I retake AAIA?
You have four attempts in a rolling 12 months, waiting 30, then 90, then 90 days, with the full exam fee each time.
Do I need a data science background for AAIA?
ISACA sets no technical prerequisite. Its free quiz does include machine-learning concepts, so plan to learn how AI models are trained, tested and attacked.
Is each AAIA domain scored separately?
No. Domain results are informational; the score counts every question answered correctly.
