AAIA, AAISM, and AIGP all launched in the last 18 months, and the question I get most often from CISA holders is: which one should I take?
They aren't interchangeable. AAIA is an audit credential. AAISM is a security-management credential. AIGP is a privacy and policy credential. The exam fees are similar; the prerequisites and the body of knowledge are not.
This post breaks down what each credential actually tests, who should take it, and how to choose if you're coming from a CISA or CISSP background.
If you skip the details, here is the summary:
Already know which credential fits? If it's AAIA, start with the free practice questions. Try 50 free AAIA questions →
The AAIA is a technical audit credential. It targets professionals who audit IT systems and need to understand risks from machine learning and generative AI.
The AAIA suits internal auditors, IT risk advisory consultants, and compliance managers. Candidates must hold an active CISA, CIA, CPA, or equivalent advanced auditing certification to take the exam. This ensures candidates understand audit methodology before auditing AI systems.
The AAIA exam has 90 questions and lasts 150 minutes. It emphasizes operations and technical controls.
The exam tests verifying policy compliance by engineering teams, not writing AI policy.
Choose AAIA if your job requires issuing opinions on AI control effectiveness. If you verify that training datasets are scrubbed of PII, this certification fits.
The AAISM targets security leaders defending organizations from AI-specific threats while enabling AI adoption.
The AAISM targets CISOs, security directors, and senior cybersecurity architects. Candidates must hold an active CISM or equivalent security management credential.
The AAISM exam focuses on building and managing AI security programs.
Choose AAISM if you secure AI systems your company builds or buys. If you implement controls the AAIA auditor tests, this credential fits.
The IAPP launched the AIGP to address overlaps between data privacy and AI governance. It is the broadest certification of the three.
The AIGP has no prerequisites. Privacy professionals, legal counsel, policy advisors, and compliance officers hold it. No technical background is required, which makes it the most accessible entry point into AI governance certification.
The AIGP exam has 90 questions and lasts 150 minutes. It focuses on policy, ethics, and law.
Candidates must understand global regulatory approaches, trustworthy AI principles, and AI governance board establishment. The exam covers the EU AI Act, OECD AI Principles, and legal implications of automated decision-making. It tests legal definitions of high-risk AI under European law rather than technical validation methods.
Choose AIGP if your role is advisory, legal, or policy-driven. If you draft corporate acceptable use policies for ChatGPT or advise boards on regulatory risks, this certification fits.
All three exams share the same format: 90 questions, 150 minutes. The differences are in focus, prerequisites, and cost. AAIA and AAISM (ISACA): $459 for members, $599 for non-members. AIGP (IAPP): $649 for members, $799 for non-members. Difficulty: AAIA and AAISM are rated high — both require operational knowledge of AI systems. AIGP is rated medium — it rewards memorization of laws and frameworks over technical depth.
If you're an IT auditor preparing for AAIA, see how the app covers all three domains at exam difficulty. Try 50 free AAIA practice questions →
Specialization drives value in 2026. IT auditors should choose AAIA. It extends audit methodology to complex AI technology. The CISA prerequisite limits candidates to proven professionals, adding weight to the credential.
If AAIA fits your path, the next step is passing the exam.
Most candidates who pass on the first attempt spend 6 to 8 weeks working through questions. AAIA Prep covers every domain at exam difficulty.
Ready to start preparing for the AAIA exam? Try 50 free AAIA practice questions →
Need the full ISACA AI cert comparison — AAIA, AAISM, and AAIR side-by-side with a cross-credential decision matrix? AAIA vs AAISM vs AAIR: ISACA's Three AI Certs, Compared →
Ready to take the AAIA? A first-attempt pass account with a six-week plan, scenario heuristics, and what to cut. How to Pass the ISACA AAIA Exam: A First-Attempt Playbook →
Not sure if the AAIA is the right credential for your role? The full guide covers AAIA cost, eligibility, and whether it's worth it. AAIA Certification 2026: Cost, Eligibility, and Is It Worth It →