Last updated:
AAIA preparation guide
AAIA vs CISA: how ISACA's AI audit credential builds on CISA
Direct answer
AAIA is not an alternative to CISA. ISACA opens AAIA to active CISA holders, and to holders of listed audit and accounting designations who work in IT audit or IT advisory. CISA tests information systems audit across five domains; AAIA applies the same auditor stance to AI governance and risk, AI operations, and AI auditing tools and techniques. A CISA holder needs nothing else to sit AAIA.
The exams differ in size. CISA has 150 questions in 240 minutes; ISACA Advanced in AI Audit (AAIA) has 90 in 150. ISACA reports both on a 200–800 scaled score.
For ISACA's other AI credentials, CertArc's AAISM vs AAIA vs AAIR guide compares all three.
Start AAIA baselineCISA and AAIA side by side (checked October 17, 2026)
| Topic | CISA | AAIA |
|---|---|---|
| Who can sit the exam | No prerequisite credential; certification then needs ISACA's experience requirement | Active CISA, or a listed designation held by someone in an IT audit or IT advisory role |
| Exam | 150 multiple-choice questions, 240 minutes | 90 multiple-choice questions, 150 minutes |
| Exam fee | US$575 members, US$760 non-members | US$459 members, US$599 non-members |
| Content | 5 domains: 18%, 18%, 12%, 26%, 26% | AI Governance and Risk 33%, AI Operations 46%, AI Auditing Tools and Techniques 21% |
| After passing | Apply within five years, with verified experience | Apply within five years; US$50 application fee |
| Keeping it | CISA's own CPE and maintenance fee | 10 AI CPE a year and 30 over three years; US$20 or US$35 a year; the qualifying credential stays active |
Original teaching example
An internal auditor plans a review of a bank's anti-money-laundering alert model. The model owner offers the vendor's validation report and says analysts review every alert the model raises.
A CISA answer checks scope, controls and evidence. AAIA keeps that and adds the AI facts that change the test: whether the vendor's validation used data like the bank's, whether model changes go through change control, and whether analysts can and do override alerts, with a log to show it. The tempting answer accepts the vendor's report because the vendor is reputable.
Prerequisite, not alternative
AAIA follows CISA; it doesn't replace it.
Keeping AAIA requires keeping your qualifying credential active, so a CISA holder maintains both. If you hold neither CISA nor a listed designation, CISA comes first.
What carries over from CISA
The audit process: planning, testing and sampling, evidence, data analytics and reporting.
AAIA's AI Auditing Tools and Techniques domain (21%) applies these steps to AI systems. CISA's governance, acquisition and operations domains relate to AAIA's governance, life-cycle and change subareas, now with AI-specific risks.
What is new
The AI subject matter, most of it in AI Operations.
AI Operations is 46% of AAIA. It covers data management, development methods and life cycle, change management, supervision of outputs, testing techniques, threats and incident response, each specific to AI. Domain 1 adds AI models and requirements, AI risk management, privacy and data governance, and the ethics, regulations and standards for AI.
Which to do first
CISA, unless you already hold a listed designation and work in IT audit or IT advisory.
A CIA or a listed accountant in an IT audit or advisory role can sit AAIA without CISA. If you passed the CISA exam but your certification is still pending, ask ISACA before registering for AAIA: it asks for an active CISA certification.
Sources and fact check
Source checked: 2026-10-17
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Can I take AAIA without CISA?
Yes, if you hold a listed designation such as CIA, US CPA or ACCA and work in an IT audit or IT advisory role.
Does AAIA replace CISA?
No. AAIA builds on CISA or a listed designation, which must stay active while you hold AAIA.
Do CPE hours count for both CISA and AAIA?
They can. ISACA says AI CPE that also meets another ISACA certification's requirements may count toward it.
Is AAIA harder than CISA?
ISACA publishes no AAIA pass rate, so there is no data to compare. AAIA is shorter, at 90 questions to CISA's 150.
What happens to AAIA if my CISA lapses?
ISACA requires the qualifying credential to stay active and revokes AAIA if its certification requirements are not met.
Which first if I hold neither?
CISA, unless you hold a listed designation such as CIA and work in IT audit or IT advisory.
