AAIA Certification Guide: Cost, Eligibility, Exam Format, and Whether It's Worth It

The ISACA AAIA (Advanced in AI Audit) is the first credential ISACA has issued specifically for auditors who need to evaluate AI systems. It launched in 2025 and is now the closest thing the profession has to a recognized standard for AI assurance work. This page covers everything you need to decide whether to pursue it: who qualifies, what the exam looks like, what it actually costs, and whether it’s worth your time.

AAIA cost at a glance: Exam fee $459 (ISACA member) or $599 (non-member). Certification application fee $50 after passing. Annual maintenance $20/year (member) or $35/year (non-member). CPE: 10 hours/year in the AI domain.

What is the ISACA AAIA certification?

AAIA stands for Advanced in AI Audit. It's a specialist credential layered on top of an existing audit or assurance qualification, not a standalone entry-level certificate. ISACA designed it for credentialed auditors who are already doing the work and need a recognized way to prove they can audit AI systems specifically. The exam tests three domains: AI Governance and Risk (33%), AI Operations (46%), and AI Auditing Tools and Techniques (21%). The heavy weight on AI Operations (the largest domain) reflects ISACA's view that auditors need to understand how AI systems actually function, not just how they're governed on paper.

Who is eligible for the AAIA certification?

ISACA expanded AAIA eligibility in 2025. You qualify if you hold any of the following active credentials: CISA (the most direct path), or a CIA or CPA held in an IT-audit or advisory role. The CIA/CPA pathway was added in the 2025 expansion and opened the credential to a broader population of internal auditors and public accountants working in technology assurance. The credential you hold must be active. Lapsed or suspended credentials do not satisfy the requirement. For the full list of sixteen qualifying credentials and the maintenance rule that ties the AAIA to your prerequisite, see AAIA vs CISA: which to get first.

What is the AAIA exam format?

The AAIA exam is 90 questions, all multiple-choice, delivered in 2.5 hours. It uses ISACA's standard scaled scoring system: raw scores are converted to a scale of 200–800, and the passing score is 450. That's the same format and scoring model as CISA, CISM, and CRISC, so if you've taken any of those, the mechanics are familiar. The exam is available at PSI testing centers and via remote proctoring. You can schedule as early as 48 hours after payment, and your registration gives you a six-month eligibility window. Appointments open up to 90 days in advance.

How hard is the AAIA exam?

For a detailed breakdown of each domain and what the exam actually tests, see the AAIA Exam Domains guide. Read: AAIA Exam Domains Explained →

How much does the AAIA certification cost?

The headline exam fee is $599 for non-members and $459 for ISACA members. But the true cost of getting certified (and keeping it) is higher. Here's the full breakdown:

One note worth making: ISACA Professional membership is $135/year (after a $145 first-year join fee), plus local chapter dues that vary by chapter. The $140 exam-fee discount ($459 vs $599) covers the annual renewal on its own. Annual maintenance is $20/year for members vs $35/year for non-members, so the saving compounds over time. If your chapter dues are significant, run the numbers for your location. The certification application fee ($50) is due after you pass. Passing the exam and being certified are two separate steps. The annual maintenance fee and CPE requirement apply once you're certified and must be maintained to keep the credential active.

How do I get AAIA certified? (Step by step)

The process is straightforward and continuous. There are no fixed exam windows.

Is the AAIA certification worth it?

Here's an opinion, clearly labeled as one. It's worth it if AI is already, or about to be, on your audit plan. Boards are asking how AI is governed. Regulators are circling. Most audit functions have very few people who can credibly say they can audit AI systems. If you're the person who can, AAIA is a clean, recognizable way to prove it, and it carries ISACA's name, which carries weight in audit hiring and procurement in a way a generic online AI certificate doesn't.

It's not worth it if you're using it as a career-change shortcut. AAIA assumes you're already a credentialed auditor. It deepens an existing career; it doesn't start a new one. If you don't have the prerequisite, your money and time are better spent on the foundational credential first.

The honest caveat: it's a new credential. It doesn't yet have the 30-year brand recognition of a CISA, and no certification on its own gets you a job or a raise. They're signals layered on top of demonstrated work. AAIA is a strong, well-timed signal in a domain with real scarcity of qualified people. That's the case for it. Weigh it against your own situation.

Want the data behind that claim? What the AAIA actually does to your salary: verified 2026 market data

AAIA vs. AAISM: which ISACA AI certification is which?

These two get confused constantly because the acronyms are similar. They are different jobs. AAIA (Advanced in AI Audit) is for auditors and assurance professionals who evaluate and provide assurance over AI systems from an independent seat. AAISM (Advanced in AI Security Management) is for security leaders who build and run the security posture against AI-specific threats; it builds on a CISM or CISSP-type background, not an audit one. Pick based on the chair you sit in. If your job is independent assurance, governance, and risk, it's AAIA. If your job is owning AI security operations, it's AAISM. They complement rather than compete. For a full comparison of all three ISACA AI credentials, see the AAIA vs. AAISM vs. AAIR guide.

The career questions people actually search

A lot of people land on AAIA while asking a bigger question: is there a future in this, and does it pay? The realistic path to becoming an AI auditor is: build a foundation in IT audit (CISA is the standard entry credential), get hands-on with how your organization actually uses AI, then specialize. AAIA is the specialization step. AI audit isn't a separate profession you parachute into; it's IT audit pointed at a new class of system. On compensation: audit is a stable, well-compensated profession, and the intersection of audit and AI is where the scarcity premium lives right now. The eye-catching "$900,000 AI job" headlines describe elite ML research roles at frontier labs, a different universe from audit. The grounded version: professionals who can govern and assure AI are in genuinely short supply, and scarcity tends to show up in compensation. On which jobs survive AI: the recurring answer from labor research is roles that combine judgment, accountability, and human trust. Independent assurance is close to the center of that. Someone has to attest that the AI is fair, controlled, and compliant, and that someone can't be the AI. If anything, AI creates audit work.

Bottom line

The AAIA is a focused, credible, and well-timed credential for the auditor whose world now includes AI. The mechanics are straightforward: 90 questions, 2.5 hours, $459 with membership, an existing audit credential to qualify, and CPE to maintain. The judgment call isn't about the exam; it's about you: if AI assurance is your lane or your next one, this is one of the cleanest ways to prove you can do the work. If it isn't, no certificate will make it so.

Want a domain-by-domain difficulty breakdown before you commit to prep? How Hard Is the AAIA Exam? An Honest Answer From a First-Attempt Pass →

Ready to build your study plan? How to Pass the AAIA Exam on Your First Attempt →

Frequently asked questions

Do I need a CISA to take the AAIA?

No. A CISA is the most direct path, but ISACA expanded eligibility in 2025 to include CIA and CPA holders working in IT-audit or advisory roles. The credential you hold must be active.

How long is the AAIA exam?

90 questions, 2.5 hours, delivered at a PSI testing center or via remote proctoring.

What is the passing score for the AAIA?

450 on ISACA's 200–800 scaled scoring system.

How much does the AAIA exam cost?

$599 for non-members, $459 for ISACA members. Add a $50 certification application fee after passing, plus annual maintenance fees and CPE.

How long do I have to schedule the AAIA after registering?

You have a six-month eligibility window from the date of registration. You can book as early as 48 hours after payment, up to 90 days in advance.

What CPE is required to maintain the AAIA?

At least 10 CPE hours per year in the AI domain, with 30 hours required over each three-year cycle.

What is the difference between AAIA and AAISM?

AAIA is for auditors providing independent assurance over AI systems. AAISM is for security leaders managing AI security operations. They target different roles and build on different prerequisite credentials.

Is the AAIA worth it in 2026?

For credentialed auditors with AI on their audit plan, yes: it's a well-timed, recognizable signal in a domain with genuine scarcity of qualified people. For those without the prerequisite credential, the foundational certification (CISA) is the better first investment.

When is the AAIA certification application fee due?

The $50 application processing fee is due after you pass the exam, not at registration. Passing the exam and receiving the certification are two separate steps.

What does it cost to retake the AAIA exam?

A retake requires paying the full exam registration fee again: $459 for ISACA members, $599 for non-members. ISACA does not offer a discounted retake fee.

What if I run out of time in my six-month eligibility window?

You can purchase a six-month extension for $75 before your eligibility expires. If you let the window expire without extending, you forfeit the exam fee.

Written by Baz Abouelenein, a CIO and IT-audit practitioner who passed the ISACA AAIA exam on the first attempt and builds AAIA study tools at itauditapp.com. This article is informational and reflects the author's experience; it is not affiliated with or endorsed by ISACA. Verify all current exam details, fees, and eligibility rules directly with ISACA before registering.

1. [1] ISACA AAIA credential page.
2. [2] ISACA AAIA Exam Candidate Guide: source of 90-question / 2.5-hour / domain-weight facts.
3. [3] ISACA press release: expanded AAIA eligibility (2025).
4. [4] ISACA: Maintain AAIA Certification.

Before you make a study plan, review the three AAIA exam domains and their weighting. AAIA exam domains explained →

Written by Baz Abouelenein
Higher-education CIO and IT auditor. AAIA · CISA · CISM · CRISC · CISSP · PMP

Not affiliated with or endorsed by ISACA, ISC², or PMI.

AAIA, CISA, CISM, and CRISC are registered trademarks of ISACA. CISSP is a registered trademark of ISC². PMP is a registered trademark of PMI. IT Audit Prep is not affiliated with, endorsed by, or sponsored by ISACA, ISC², or PMI.