ISACA AAIR

Candidates must hold a qualifying designation from ISACA's published list before registering. The list includes ISACA's CISA, CISM, CRISC, CGEIT, and CDPSE, plus recognized global credentials such as CRMP, CRMA, CERP, CGRC, CISSP, CIA, CPA variants, ACCA, and PMI-RMP. ISACA also expects proven experience in IT risk or advisory roles.

AAIR exams are computer-based and administered at authorized PSI testing centers globally or as remotely proctored exams. Residents of India, mainland China, and Hong Kong are an exception: the exam is exclusively available at testing centers there, and live remote proctoring cannot be used. Verify PSI test site availability and check system compatibility before registering.

Registration establishes a six-month eligibility period, so you have six months from your registration date to take the exam. The registration fee must be paid in full before you can schedule and sit for the exam. If you cannot find a date, confirm your eligibility has not expired in the Certification & CPE Management tab of your ISACA account.

Appointments are only available 90 days in advance, so check back closer to your desired date if nothing appears. You can reschedule anytime within your eligibility period without penalty, provided you act at least 48 hours before your scheduled appointment. You can also schedule as early as 48 hours after paying your registration fees.

ISACA lists the exam cost at US$459 for members and US$599 for non-members. A separate US$50 application processing fee applies when you apply for certification after passing. Confirm current pricing on ISACA's site before registering, since fees can change.

Passing is only the first step. To become AAIR certified you must hold a qualifying designation, pass the exam, pay the US$50 application processing fee, and adhere to the Code of Professional Ethics and the Continuing Professional Education Policy. Candidates have five years from passing the exam to apply for certification.

ISACA offers an online review course, a review manual in digital and print, a questions, answers and explanations database with a pool of more than 200 items, and virtual workshops. A sensible order is the review manual for coverage, the online course or workshop for structure, then the database for practice, finishing with the free five-question quiz as a quick check.

ISACA positions AAIR as advanced, aimed at experienced risk professionals rather than beginners. Expect scenario-based questions that require judgment across AI governance, life cycle risk, and program management. Common failure modes include treating AI risk as purely technical, ignoring governance and oversight, and under-preparing on how AI risk is managed across the full life cycle.

ISACA's published AAIR pages do not state a retake policy, number of attempts, waiting period, or retake fee. Because this detail is not confirmed in the source material, check ISACA's exam candidate guide and terms of use for the current policy before assuming you can immediately rebook.

No. ISACA lists AAIR separately from AAIA (Advanced in AI Audit) and AAISM (Advanced in AI Security Management). AAIR focuses on AI-related IT risk management: AI Enterprise Governance, AI Life Cycle Risk Management, and AI Risk Program Management. Choose AAIA or AAISM if your role centers on audit or security management instead.