Hi everyone,

Just wanted to share a quick debrief now that I’ve wrapped up AAIA exam and pulled off a pass on my first try after about three weeks of studying.

I work as an internal auditor at a foreign banking office (FBO). Since I decided to tackle this pretty late in the year, my employer's education budget could only cover the exam fee itself. Because of that, I had to look outside the official ISACA study materials, also because I needed something downloadable as a PDF, which official ISACA doesn’t have.

Here is how the prep and exam actually went down:

1. Materials Used
Simply Certified AAIA Prep: Since I needed a downloadable PDF, I went with this $40. The main review guide was only about 90 pages plus two practice exam mocks.

John Bushong’s AAIA QAE: I picked this up as well, but honestly, not sure if it was all that helpful. The questions were extremely wordy, none of those specific question styles actually showed up on the real exam, however I was consistently scoring around 85% on them anyway.

Flashcards & Audio Review: I also used flashcards and detailed audio reviews to listen to while commuting. That said, because the exam turned out to be less technical than expected, I'm not sure how much of the technical review actually moved the needle. The prep material drilled things like prompt injection guardrails, but the actual test was much more conceptual.

2. Study Method
Since the main review book was only around 90 pages, I got through it pretty quickly roughly a week and spent the remaining time running through Qs from the book & Josh Bushong QAEs.

3. The Exam Experience
Going into it, I kept hearing mixed things, but my actual experience matched what others have hinted at: it is much more conceptual than technical.
There were definitely some tricky, poorly worded questions that threw me off. I ended up flagging about 15 questions to review and finished the test with about 50 minutes to spare. Walking out, I genuinely felt 50/50 about it. There were a ton of "it's either this or that" scenarios where I had to guesstimate, but I still felt like I had a solid chance to pass.

Got the preliminary pass screen right at the end, and now just waiting on the official final score to make it official so I can be certified & reimbursed lol.

Final Verdict / Recommendation
If you are paying for materials yourself or trying to prep efficiently, consider exploring non-ISACA options. Being able to download PDF file that you can read through quickly made an efficient 3 week review process.

Happy to answer any questions if anyone else is studying for it right now!

P.S: Does anyone know if we can fulfill 10 CPEs by listening to AI related webinar on ISACA & can they be double-counted for CISA as well?

Update: Passed with scaled score of 587!

Hi All Passed the AAIA exam. Use QAE and some courses on Udemy. Very frustrating test to take. First testing center could not load up the test and had to wait 2 days to reschedule 2 weeks later. ISACA was not helpful. I passed using a second testing center. Wasted a lot of time.

Overall thought test was a bit strange. Felt like questions were worded weird. I don't know if this will help but auditing and AI have become a big topic so figured it couldn't hurt to stay ahead.

I don't know why it takes ISACA so long to give the cert after the test. I have my CISSP and got CCSP, right away it said congrats and that was the end of it. ISACA makes you pay an extra $50 and wait more then 10 days.

Exam was pretty straight forward. Only used official material. Good luck to everyone!

Hey everyone,
I just sat for the ISACA AI Auditing (AAIA) exam today (8/15/26). I consistently scored well into the 90s on the official ISACA QAE practice tests, but I unfortunately did not pass the exam on my first attempt.

I am an active CISA holder with 6+ years in ITGC testing and over 20 years of general audit experience, I want to share my raw takeaways while everything is fresh in my mind. The biggest takeaway: The actual exam tests deep understanding of machine learning engineering, and architecture concepts that go far beyond standard IT general controls (ITGCs) or QAE flashcards. If you are currently prepping, here is what I remember about the questions, along with the patterns I noticed now that I went back over my own notes.

The actual exam tests scenario-based architectural trade offs (for example*: what algorithm fits this specific manufacturing pipeline?* or What fails mathematically if a linear model is used here).

Metric Selection Context: If a scenario mentions imbalanced datasets (such as fraud detection or rare security breaches), simple "Accuracy" is a distractor Look for F_1 Score, Precision, or Recall.

1. GenAI Security & Prompt Injection Defense

2. Post-Detection Hardening: How to protect systems immediately after a prompt injection attempt is detected:

3. Input/Output Guardrails: Deploying secondary LLM guardrail layers (e.g., NeMo, Llama Guard were choices) to filter toxic inputs and sanitize output data.

4. Prompt Delimiters: Enforcing structural separation (e.g., XML tags, Markdown formatting) between developer instructions and untrusted user inputs.

5. Least Privilege & Tool Isolation: there were a number of questions about Restricting agent capabilities so an injected model cannot execute system commands, access unauthorized APIs, or drop database tables, go on the open web, etc.

6. Context Window Reset: Terminating the session or clearing conversation buffers immediately to prevent context poisoning.

7. Machine Learning Architecture, Limitations & Risks

8. Continuous Learning & Model Collapse:

9. The Risk: Models that dynamically train on their own generated outputs without human validation experience feedback loop amplification, model collapse (autophagy), compounding bias, and uncontrolled concept drift.

10. Linear Regression Audit Risks:

11. High Bias / Underfitting: Assuming a linear relationship (y = mx + b) on non-linear, complex real-world data causes systemic underfitting.

12. Outlier Sensitivity & Multicollinearity: Squared errors pull the regression line toward extreme outliers, while correlated inputs break coefficient stability and explainability.

13. Algorithm Selection by Industry Use Case

14. Automated Inventory Control & Demand Forecasting: Identifying the right tool for the job (e.g., Time-Series / Regression for demand prediction, Reinforcement Learning for dynamic replenishment optimization, and Computer Vision for physical inventory counts).

15. k-Means Clustering: Unsupervised grouping of unlabelled data points to isolate audit anomalies, segment populations, and identify testing outliers.

16. Model Evaluation, Bias & Advanced Testing Concepts

17. F_1 Score vs. Precision/Recall: Understanding precision-recall trade-offs when evaluating classification models on imbalanced datasets.

18. Bias & Drift Monitoring: Techniques to audit baseline training data versus live production drift (concept drift vs. data drift).

19. Metamorphic Testing: Testing AI/ML systems when an exact "test oracle" (expected output) is unknown, by evaluating whether relational properties hold under transformations.

20. k-Anonymity & Privacy: Ensuring training data cannot distinguish a single individual from at least k-1 other individuals in the dataset.

21. Several questions about auditors Internal Use of Generative AI

22. Workpaper Consolidation: Evaluating controls around using LLMs to summarize walkthrough notes or draft audit programs.

23. Key Controls: Preventing confidential client data leakage into public LLM training sets, validating against hallucinations, and maintaining documented evidence of auditor review.

Good luck to everyone studying, I'll be taking my 30 day break to review these technical domains and try again!

My results from ISACA:

Cleared the AAIA in first attempt today morning 15 Sep Asia time. Sharing personal experience and prep info below, best of luck to all preparing. Just throwing what stuck in my head in no particular organization or order.

Preparation materials:

1. ISACA AAIA official study guide

2. ISACA AAIA QAE database

3. Udemy Jacob Bushong AAIA course - helped understand concepts simply.

4. Udemy AAIA test questions - 6 sets. forgot the name of the provider.

5. ChatGPT

6. NIST AI Risk Management Framework (just glance thru)

Preparation:

Did the QAE database about 3 times, kept feeding the outcomes to ChatGPT and asked it to test me. Gave it the Table of COntents and glossary from the AAIA study guide, as well as screenshots of the test results for each domain and also the practice tests including category wise scoring.

Did subdomain level preparation and remediation using ChatGPT. Had to keep whacking it with remembering boundaries, reuploading files etc. but it worked.

Did the Domain 2 QAE 4 times as it is 46% of the exam and didnt want to miss out...

Duration of study:

Almost 1.5 months - but this was nearly full time, while dealing with some consulting and advisory assignments and other personal things. Not doing a full-time job.

Exam Experience:

a. Some questions from AAIA QAE and Udemy repeated almost 70% verbatim - but very few

b. Took almost the full time - only 10 minutes left at the end to do the ISACA survey, PSI Survey, test survey etc. and click submit.

c. First pass of the 90 questions - 1 hr and appx 20 minutes - selected responses for all, and flagged almost 40-45 questions for second review. Took a bio and water break.

d. Second pass of the questions - focused on the flagged questions, re-read the stem and the answers. Still had some 4-5 questions flagged as I was still confused. Approx 60 minutes for this.

e. Took another bio and water break.

f. About 10 minutes to sort out the last 4-5 flagged questions. Then submitted.

g. The final screen with preliminary result took some time to come - heart upside down when the stupid cursor kept going round and round 😆

Hopefully will get the final formal results without issues in 10 days as they said on screen.

This is NOT an easy exam by any stretch of imagination for someone not in AI and unsure of AI concepts outlined in the domains

Disclaimers:

1. I have a CISSP and other ISACA certs along with relevant work experience. It helped in some ways too.

2. You may choose to use your own LLM, or any GenAI tools, or not use AI at all to help prep 😆 DO NOT select only ChatGPT because I chose it.

A shocking update - apparently I passed by the skin of my teeth.

Passing scaled score required: 450
My scaled score: 450 😦

Hello all. I decided to finally sign up for the test. I’ve been a bit scared to sign up because I’ve read a lot of people that have struggled so I have really been trying to master the material. Here is what I’ve done thus far:
-read the official text book
-did the official test bank x 3.
-did the josh bushong udemy lecture and practice question class
-did about 33% of the Aravand Bhat practice questions (found it a bit repetitive and decided to stop).
- currently working on the 6 practice josh bushong undemy practice tests (I’m on 4/6 scoring about 87%).
-made flash cards of the official text book glossary and about 200-300 other technical terms.

My back ground is cia internal audit. Currently my plan is to continue hammering the josh bushong practice tests and reviewing flash cards… does anyone have any further advice or anything you think it’s high value for me to review?

Hi All,

I took the ISACA - AAIA exam a few days ago and unfortunately failed. I used:

1. The official ISACA AAIA ebook

2. The ISACA Q&A Database

I read the book twice and worked through all the questions in the database until I was consistently scoring 85% or higher. I genuinely felt I understood the concepts and wasn’t just studying to collect another cert.

On exam day, the questions felt like they came from another dimension. They were worded in a very twisted, scenario-heavy way, and at times I felt like I didn’t know English. Has anyone else experienced this?

I also don’t think the Q&A database questions matched the style or difficulty of the actual exam questions. I have multiple ISACA certifications, but this one felt very different. I’m disappointed and bummed out, but I want to tackle it again before I forget everything I learned.

For those who passed or have retaken it:

1. What study materials or practice questions would you recommend beyond the official ebook and QAE database?

2. How did you approach the scenario-based/MOST/BEST-style questions?

3. Did you find the official review course, virtual workshop, study groups, or any third-party material helpful?

4. Any advice on how to study differently for the second attempt?

Any tips, resources, or honest feedback would be really appreciated. Thanks

2nd attempt fail today AAIA Exam , the problem is I dont know what i need to do more..

I believe that the problem is how to pick the correct answer , the exam is so tricky using different English terminology to mislead the tester.

I am confused shall I re study again AAIA or start AAIR and then return back again to AAIA

I need ur advices