Last updated:
AAISM preparation guide
AAISM vs AAIA vs AAIR: which ISACA AI credential fits you?
Direct answer
Choose by your role and the credential you hold. AAISM (AI security management) is for active CISM or CISSP holders who run or secure AI programs. AAIA (AI audit) is for CISA holders and listed audit and accounting designations. AAIR (AI risk) accepts a wider list, including CISA, CISM, CRISC, CGEIT, CDPSE and CISSP. All three exams are 90 questions in 150 minutes.
AAISM is Advanced in AI Security Management, AAIA is Advanced in AI Audit and AAIR is Advanced in AI Risk. All three exams cost US$459 for ISACA members or US$599 for non-members, plus a US$50 application fee after passing. ISACA's free practice quiz has 12 questions for AAISM and AAIA and 5 for AAIR.
AAIR is the newest. ISACA's AAIR page says registration and exam prep materials are now available (checked October 12, 2026).
A CISM or CISSP holder qualifies for both AAISM and AAIR, so the choice between them comes down to the work you do.
Start AAISM baselineISACA's AI credentials side by side (checked October 12, 2026; AAIA row October 18, 2026)
| Credential | Who can sit | What it covers |
|---|---|---|
| AAISM | Active CISM or CISSP | AI Governance and Program Management 31%, AI Risk Management 31%, AI Technologies and Controls 38% |
| AAIA | Active CISA, or one of 15 listed designations, such as CIA, US CPA, ACCA, ICAEW, CA ANZ or HKICPA, with an IT audit or IT advisory role focus | AI Governance and Risk 33%, AI Operations 46%, AI Auditing Tools and Techniques 21% |
| AAIR | CISA, CISM, CRISC, CGEIT, CDPSE, CISSP, CIA, listed accounting designations, PMI-RMP and other listed credentials | AI Enterprise Governance; AI Risk Program Management; AI Life Cycle Risk Management |
Original teaching example
A retailer is deploying a generative AI assistant for customer service. The security manager decides which prompt-injection and data-leakage controls it needs before launch, the internal auditor tests whether those controls hold against adversarial prompts, and the risk manager judges whether the remaining risk of harmful or leaked answers fits the board's appetite.
Each credential puts the emphasis on one of these roles: AAISM on the security manager, AAIA on the auditor and AAIR on the risk manager. They overlap; AAISM also covers AI risk assessment and treatment in Domain 2. Pick the credential that matches most of the decisions you make at work.
If you hold CISM
AAISM and AAIR are both open to you.
Choose AAISM if you own security decisions for AI systems, and AAIR if you mainly assess and report AI risk.
If you hold CISSP
The same two are open to you, through the CISSP route.
Expect ISACA's manager-first question style in either exam. AAISM's Domain 3 includes AI security architecture and design, which sits closest to CISSP architecture work.
If you hold CISA or an audit designation
AAIA and AAIR are open to you. AAISM is not, unless you also hold CISM or CISSP.
AAIA is ISACA's AI audit credential. Every active CISA holder qualifies; CIA and the listed accounting designations qualify only with an IT audit or IT advisory role focus.
Holding more than one
One annual maintenance fee covers every ISACA Advanced credential you hold.
ISACA charges US$20 a year for members or US$35 for non-members in total for all Advanced credentials. CPE hours can count toward several ISACA certifications when the activity is relevant to each.
Where AAIA and AAISM overlap
Two AAIA subareas share their names with AAISM domains, but each credential asks a different question.
AAIA's 1B, AI Governance and Program Management, and 1C, AI Risk Management, carry the names of AAISM's Domains 1 and 2. AAIA asks the auditor's question: evaluate the governance or risk program and report on what the evidence shows. AAISM asks the manager's: decide and implement.
Languages and test delivery
AAIA and AAISM are offered in different languages, and AAIA has test-centre-only regions.
ISACA offers AAIA in English, Simplified Chinese and Spanish, and AAISM in English, Spanish and Japanese (checked October 18, 2026).
Residents of India, mainland China and Hong Kong can take AAIA only at a test centre; ISACA does not offer remote proctoring for AAIA there.
AAIG, ISACA's AI governance credential in beta
ISACA also lists AAIG (Advanced in AI Governance), which is still in beta.
ISACA's AAIG page opens the beta to active CGEIT holders, or to candidates with six years of enterprise governance experience, including at least one year in AI (checked October 18, 2026).
Because AAIG is in beta, check ISACA's AAIG page for its current status, exam details and fees before you plan around it. This guide compares the three AI credentials that are generally available.
Sources and fact check
Source checked: 2026-10-18
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Which is easiest?
ISACA's pages for these exams give no pass rates, so there is no basis for ranking them.
Can I take AAIR with CISM?
Yes. CISM is on ISACA's AAIR list.
Is AAIR available now?
Yes. ISACA's AAIR page says registration is open (checked October 12, 2026).
Do the three share a maintenance fee?
Yes. One annual fee of US$20 for members or US$35 for non-members covers all your ISACA Advanced credentials.
Does ISACA have an AI governance credential?
ISACA lists AAIG (Advanced in AI Governance) as a beta credential for active CGEIT holders or candidates with six years of enterprise governance experience, including at least one in AI. Check ISACA's AAIG page for its current status.
Does CertArc offer AAIA or AAIR practice?
CertArc offers AAIA practice as well as AAISM, with its own baseline, study plan and coaching. It does not offer AAIR practice.
