The BEST way to manage AI risk at enterprise level is to:
Domain 1
Answer: B · whyIntegration ensures consistent appetite, ownership and reporting.
ISACA · AI Risk
AAIR - ISACA Advanced in AI Risk
IT risk, GRC and ERM professionals with an existing risk/audit/security credential who manage AI risk across the enterprise.
Overview
- Prerequisites
- Must hold one of the qualifying designations (e.g., CISA, CISM, CRISC, CGEIT, CDPSE, CISSP, CGRC, CIA, CRMA, PMI-RMP, US CPA, ACCA) and have experience in IT risk or advisory roles. US$50 application fee.
- Maintenance
- ISACA Advanced-certification CPE rules apply (AAIA/AAISM pages state 10 CPE/year, 30 per 3 years, US$20/US$35 combined annual fee for all Advanced certs) - confirm AAIR specifics on the official site.
- Outline in effect
- 15 Apr 2026
AAIR duration, scoring and maintenance specifics not confirmed - check official site.
Exam facts
- Questions
- 90
- Duration
- check official site
- Question types
- Multiple choice
- Passing score
- check official site
- Format
- Computer-based
- Delivery
- PSI test centres or remote proctoring (test centre only for residents of India, mainland China and Hong Kong)
Cost
- Member
- US$459
- Non-member
- US$599
- Notes
- Plus US$50 application fee.
Domains & weights
- Domain 1 - AI Risk Governance and Framework Integration37%
- Domain 2 - AI Life Cycle Risk Management21%
- Domain 3 - AI Risk Program Management42%
Upcoming changes
No announced changes as of 19 Oct 2026.
Study plan
- Week 1
Domain 1
- AI models, strategies, use cases; ownership and accountability; policies and training; regulatory/legal; trustworthiness and ESG.
- Week 2
Domain 2
- Design, procurement and documentation; training, testing and validation; implementation to decommissioning; AI data and asset management.
- Week 3
Domain 3 (part 1)
- AI risk scenarios, treatment strategies, control evaluation and selection.
- Week 4
Domain 3 (part 2)
- AI KRIs and reporting, supply-chain risk, AI incident response, BIA/BCP/DRP.
- Week 5
Scenario workshop
- Build an AI risk register for three use cases with inherent and residual ratings, owners, treatments and KRIs.
- Do 60 mixed scenario questions; focus on 'BEST next step for the risk practitioner'.
- Week 6
Framework mapping
- Map NIST AI RMF 1.0 (Govern/Map/Measure/Manage) and AI 600-1, ISO/IEC 23894 and the EU AI Act risk tiers to the AAIR domains.
- Note how AI risk plugs into the existing ERM / IT risk framework (CRISC concepts).
- Week 7
Practice
- ISACA free quiz + QAE; mixed scenario sets.
- Week 8
Review
- Focus on Domain 3 (42%).
Exam tips
- Read every question for the role you are playing (auditor, risk practitioner, security manager): ISACA rewards the answer that fits that role, not the most technical one.
- Watch qualifier words such as FIRST, BEST, MOST, PRIMARY and GREATEST: several options are often true, and only one is the best next step.
- There is no penalty for wrong answers, so never leave a question blank.
- Integrate AI risk into the existing ERM framework rather than building a separate silo.
Common pitfalls
- Treating AI risk only as model accuracy.
- Forgetting to update the enterprise risk register and taxonomy for AI risks.
Resources & official links
Official
Also widely used
- ISO/IEC 23894 AI risk management
- NIST AI RMF 1.0
- ISO 31000:2018
Sources
- ISACA AAIR page (prerequisites, fees)
- AAIR Exam Content Outline (90 questions, domains)
- ISACA press release: AAIR launched (15 Apr 2026)
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
An AI use case exceeds the organisation's risk appetite. The risk practitioner should:
Domain 3
Answer: B · whyPractitioners recommend; owners decide within governance.
Which KRI would BEST signal rising AI risk?
Domain 3
Answer: B · whyGrowth in unmanaged AI use indicates increasing exposure.
Risk should be assessed at which point of the AI life cycle?
Domain 2
Answer: B · whyAI risk changes over the life cycle.
Which contract clause MOST reduces AI supplier risk?
Domain 3
Answer: B · whyData-use limits and incident notification address key AI supplier risks.
An AI system's decisions significantly affect customers. Which control is MOST important?
Domain 3
Answer: B · whyHuman oversight mitigates harm from high-impact automated decisions.
Which document BEST captures AI risk ownership?
Domain 1
Answer: A · whyRegisters record risks, owners, responses and status.
Environmental and social impacts of AI fall under which area?
Domain 1
Answer: A · whyESG and societal impacts are part of AI trustworthiness.
Decommissioning an AI model safely includes:
Domain 2
Answer: B · whyEnd-of-life activities prevent orphaned systems and data exposure.
AI-related scenarios should be added to:
Domain 3
Answer: B · whyAI failures and attacks must be covered in resilience planning.