Last updated:
AAISM preparation guide
AAISM Domain 2: AI risk management
Direct answer
Domain 2 asks whether you can judge AI risk against its value and the organization's limits, recognise AI-specific threats, and manage the vendors and components an AI system depends on. Assess before you act, and check who accepts the risk.
AI risk has familiar parts (likelihood, impact, treatment) and unfamiliar ones: model behaviour that drifts, attacks that target training data or prompts, and components you did not build.
Many questions hinge on whether an assessment has happened yet, and on who owns the decision to accept, treat, transfer or avoid the risk.
Start AAISM baselineDomain 2 subareas (31% of the exam)
| Subarea | What the questions test |
|---|---|
| 2A AI risk assessment, thresholds and treatment | AI trust, identifying and classifying AI risk, risk frameworks, acceptable limits, response strategies and AI threat modelling |
| 2B AI threat and vulnerability management | The AI threat landscape and mitigation strategies |
| 2C AI vendor and supply chain management | Vendor management, deployer duties, shared responsibility, integration and software supply-chain risk |
Original teaching example
A business unit wants to use a third-party model to screen job applicants. The vendor's documents do not say how the model was trained or tested for bias. What should the AI risk lead do before approving use?
Check the legal duties for AI in hiring and get privacy approval for any test data. Obtain the training and testing evidence through the vendor process and, where it does not cover this use, test the model for bias and performance on representative applicant data. Assess the risk against the organization's thresholds, including how human review of rejections should work. Without adequate evidence, the risk owner decides with that uncertainty in view: limit the use, require testing first or reject. Approving now with a promise to monitor skips the assessment.
Know what the vendor is responsible for
Shared responsibility for AI differs by service model. Read the scenario for what the organization deploys and controls, not just what it buys.
Name the AI-specific threat
Prompt injection, data poisoning, model evasion and synthetic media each call for different mitigations. Identify which one the scenario describes before choosing a control.
Assess before you accept
The risk owner decides after an assessment, not before it.
Approving an AI use with a promise to monitor skips the assessment. Check the organization's thresholds, then accept, treat, transfer or avoid.
Worked examples by subarea
One original scenario per subarea, with the stronger answer.
- 2A: A team wants a customer-service model to approve refunds of any amount, although customers can steer it through their messages. Stronger: set a refund threshold the risk owner accepts for the model, with human approval above it.
- 2B: A generative AI service that learns from user feedback is live with no mitigations for prompt injection or for poisoning through that feedback. Stronger: pause or gate learning from feedback until checks on that feedback exist, then put mitigations in place for each threat that applies, such as input and output controls.
- 2C: A team builds a downloaded pretrained model into a product without checking it. Stronger: treat it as a supply-chain component: check its source and model documentation, scan the file format for code that runs on load, and test it for hidden behaviour before use.
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Is AI risk scored differently from other risk?
The method is familiar; the inputs include model behaviour, data provenance and automation level.
Why does the domain name differ from ISACA's candidate guide?
ISACA's candidate guide uses “AI Risk and Opportunity Management”; its outline page uses “AI Risk Management”. Both describe the same domain.
How is Domain 2 weighted?
31% of the exam, by ISACA's outline.
How many subareas does Domain 2 have?
Three, 2A to 2C, in ISACA's outline.
Does Domain 2 cover AI vendors?
Yes. Subarea 2C covers vendor management, deployer duties, shared responsibility and the software supply chain.
