ISACA AAIR study guide
ISACA AAIR · Work through your exam, one topic at a time.
The ISACA Advanced in AI Risk (AAIR) certification is an advanced, practice-driven credential focused on AI-related IT risk management. ISACA describes it as designed to enhance the expertise of certified IT risk professionals, giving them the strategic skills to guide management in addressing AI-related risks and safeguarding organizations from potential financial and reputational harm. It is not an entry-level or general AI literacy certificate: candidates must already hold a qualifying designation, such as an ISACA CISA, CISM, CRISC, CGEIT, or CDPSE, or one of the other recognized global credentials listed by ISACA, and should have proven experience in IT risk or advisory roles. The exam covers three key practice areas: AI Enterprise Governance, AI Life Cycle Risk Management, and AI Risk Program Management. Topics on this exam: AI Enterprise Governance, AI Life Cycle Risk Management, and AI Risk Program Management. The ISACA AAIR study guide has 3 sections and about 1,007 words.
01AI Enterprise Governance
This domain tests whether you can establish the decision rights, policies and oversight that make AI risk manageable at the organizational level - not whether you can build a model. Core rules Accountability sits with the board and senior management. AI risk is an enterprise risk, reported through the ERM framework with its own appetite statement covering bias, safety, privacy, IP and third-party exposure. Apply the three lines model: the business or AI product owner owns the risk (first line), risk and compliance set the framework and challenge (second line), internal audit gives independent assurance (third line).
369 words, about 2 min02AI Life Cycle Risk Management
This domain tests whether you place the right risk activities in each phase: plan and design, data preparation, development, verification and validation, deployment, operation and monitoring, decommissioning. Risk work is continuous, not a gate passed once. Core rules Design fixes most of the risk: intended use, prohibited uses, affected populations and the human-oversight model. Undocumented intended use makes later validation meaningless.
314 words, about 2 min03AI Risk Program Management
This domain tests whether you can run AI risk as a repeatable program: taxonomy, assessment method, metrics, reporting, assurance and third parties. Core rules Adopt a common AI risk taxonomy so scores are comparable across use cases; assess inherent and residual risk separately. Use a defined methodology with calibrated scales and explicit impact dimensions: people, regulatory, financial, reputational, operational. Define KRIs before deployment: drift rate, incident and near-miss counts, human-override rate, inventory coverage, overdue remediation.
324 words, about 2 min