ISACA AAIR study plan

Map the AI Enterprise Governance domain blueprint into a personal concept outline covering strategy alignment, board and executive oversight, policy hierarchy, and accountability structures.

Define and contrast AI governance, AI risk management, and AI compliance in writing, citing at least one concrete control example for each.

Build a one-page inventory of the governance artifacts an enterprise needs (AI policy, acceptable use policy, model inventory standard, AI risk appetite statement, third-party AI standard).

Identify the roles that typically own AI accountability (governing body, AI governance committee, model owner, risk function, internal audit) and draft a RACI sketch for three AI use cases.

Draft a sample AI risk appetite statement with explicit tolerance thresholds and escalation triggers.

Explain how AI governance integrates with existing enterprise risk management and internal audit three-lines-of-defense structures.

Analyze at least three regulatory and standards frameworks relevant to AI oversight (for example NIST AI RMF, ISO/IEC 42001, OECD AI Principles, EU AI Act) and note where they converge and diverge.

Distinguish board-level oversight duties from management-level operational duties and write five board-level questions that test governance maturity.

Walk through each phase of the AI life cycle (ideation and intake, data acquisition, development, validation, deployment, monitoring, decommissioning) and list the risk decisions made at each gate.

Build a risk register with at least eight AI-specific risks mapped to life cycle phases, with likelihood, impact, and owner columns.

Identify where AI risk management differs from conventional IT risk management, giving at least four concrete differentiators.

Practice selecting risk treatment options (avoid, mitigate, transfer, accept) for three sample AI risk scenarios and justify each choice.

Develop a data quality and provenance checklist covering training data lineage, consent, representativeness, and bias testing.

Draft validation and testing criteria for a hypothetical model, including performance thresholds, fairness metrics, robustness checks, and human-in-the-loop requirements.

Design a post-deployment monitoring plan with drift detection, performance thresholds, and incident escalation paths.

Explain the risk implications of third-party and foundation-model dependencies and list due diligence questions for AI vendors.

Structure an AI risk program charter defining scope, governance interfaces, reporting lines, and success metrics.

Build a risk taxonomy and scoring methodology (for example likelihood-by-impact matrix with AI-specific severity modifiers) and apply it consistently to five risks.

Design key risk indicators for AI systems and specify thresholds, data sources, and reporting frequency for each.

Map the reporting cadence from operational teams to the governing body, including what each audience needs to see.

Design a control framework for AI risk that maps controls to identified risks and references recognized control objectives.

Draft an AI incident response playbook covering detection, triage, containment, notification, and post-incident review for model failure and misuse scenarios.

Plan an independent assurance approach, distinguishing first-line testing, second-line oversight, and third-line audit for AI systems.

Assess third-party and supply chain risk management controls, including contract clauses, ongoing monitoring, and exit strategies.

Synthesize the three domains into an integrated one-page model showing how governance sets direction, life cycle risk management executes, and program management sustains.

Complete at least 100 practice questions across all domains and log every miss with the underlying concept gap rather than the answer text.

Re-drill the two weakest blueprint subdomains identified by practice performance until miss rates fall below 20 percent.

Write concise explanations of ten commonly confused concept pairs (for example risk appetite versus risk tolerance, validation versus verification, monitoring versus audit).

Take two full-length timed practice exams and record per-domain and per-subdomain accuracy under exam conditions.

Review every missed item from both exams and close each gap by restating the governing principle in your own words.

Recite from memory the key frameworks, life cycle phases, and program components without notes, then verify against your outlines.

Finalize a one-page exam-day reference sheet limited to decision principles and framework names, not definitions.