Three domains sound manageable until you realize they're not weighted anywhere close to evenly. One of them accounts for almost half the exam on its own. Treat all three like equal-sized chapters in a textbook, and you'll spend a third of your study time on each when the real split should look nothing like that.
This is the map before the territory: what each domain covers, how much of the exam it carries, and what kind of thinking it tests. It can be policy judgment, operational literacy, or audit methodology, since those aren't interchangeable skills even though they all show up on the same 90-question exam.
Each domain gets a full breakdown here, and each will get its own dedicated deep dive covering the complete sub-topic and task list in more depth.
AAIA Domains at a Glance
Domain | Weight | Tests |
|---|---|---|
1: AI Governance and Risk | 33% | Policy judgment, governance structure, risk and privacy programs |
2: AI Operations | 46% | Operational literacy: how AI systems are built, run, and monitored |
3: AI Auditing Tools and Techniques | 21% | Traditional audit methodology, applied to AI systems |
Domain 1: AI Governance and Risk (33%)
Domain 1: AI Governance and Risk covers five sub-topics: AI models, considerations, and requirements; AI governance and program management; AI risk management; privacy and data governance programs; and leading practices, ethics, regulations, and standards for AI. This domain tests whether you can advise on AI policy convincingly, not just recognize when a policy document exists. Much of the vocabulary overlaps with NIST's AI Risk Management Framework, which is worth reading alongside this domain even though the exam won't test you on it by name.
In practice, this is the domain that shows up before an AI system is ever deployed: whether the organization has a real risk assessment process for new AI use cases, whether privacy considerations were built in from the start rather than bolted on after a complaint, and whether there's actual accountability for the decisions an AI system makes once it's live. Candidates who treat this domain as a policy-memorization exercise tend to miss that it's really testing judgment about organizational readiness.
Domain 2: AI Operations (46%)
Domain 2: AI Operations is the largest domain by a wide margin, covering data management specific to AI, solution development methodologies and lifecycle, change management, supervision of AI solutions, testing techniques, threats and vulnerabilities, and incident response, all specific to AI. None of that is audit theory. It's operational literacy: understanding how an AI system is built, deployed, monitored, and changed before you can meaningfully audit it. IBM's own guide to implementing AI governance frameworks covers this same operational territory, model lifecycle ownership, monitoring, and rollback controls, from the practitioner side, which is useful context for understanding what you'd be auditing.
This is also the domain where prior audit experience helps least directly, since it's asking you to reason about a system that behaves differently over time as it encounters new data, rather than a static application with fixed logic. An auditor who's spent a career evaluating whether a control exists and operates as designed has to adjust that framing here: the question isn't just whether a control exists, it's whether the underlying system's behavior has been monitored closely enough to know if that control is still doing its job six months after deployment.
Domain 3: AI Auditing Tools and Techniques (21%)
Domain 3: AI Auditing Tools and Techniques is the most familiar territory for an experienced auditor, covering audit planning and design, testing and sampling methodologies, evidence collection, data quality and analytics, and audit outputs and reports. The twist: this domain also expects you to know how to use AI tools themselves to run a more effective audit, not just apply traditional methods to AI systems.
Looking for some exam prep guidance and mentoring?
Learn about our personal mentoring
Why the Weighting Looks Like This
ISACA sets domain weights through its own job practice analysis, surveying working professionals about what the role requires day to day, not through an arbitrary editorial decision. Domain 2's outsized weight reflects a real finding from that process: evaluating AI systems in production, not writing policy about them or planning how to audit them, is where auditors report spending the most time and encountering the most difficulty. That's worth internalizing before you assume the weighting will shift toward something more evenly split in a future revision. It's tracking where the real work is, and there's no strong reason to expect that balance to move dramatically anytime soon. If anything, as AI systems become more embedded in day-to-day operations across every function, the operational side of auditing them is more likely to grow in importance than shrink.
How the Domains Work Together
These aren't three independent silos tested separately. A single scenario question can pull from more than one domain at once. A data governance question (Domain 1) about an AI system's training data might also touch how that data pipeline is monitored operationally (Domain 2). Studying each domain in isolation misses that overlap.
A second example makes this concrete: an audit finding about an AI model's degraded performance touches Domain 2 directly (recognizing the operational symptom), but writing up that finding in a way that connects to the organization's broader risk posture and governance accountability pulls straight into Domain 1, and structuring the actual evidence and testing approach behind the finding is Domain 3 work. A real audit engagement rarely stays inside one domain's boundaries, and the exam's scenario questions are built to reflect that. The weighting tells you where to spend study time, not where to draw hard boundaries around what you're learning.
Certification in 1 Week
Study everything you need to know for the CISSP exam in a 1-week bootcamp!
Frequently Asked Questions
It's not necessarily harder content, but it's the least familiar for most experienced auditors, since it tests operational AI knowledge rather than audit methodology. Combined with carrying 46% of the exam, underestimating it is the most common mistake candidates make.
ISACA can revise domain weights when it updates the exam content outline, so always check the current official outline before finalizing a study plan rather than relying on a weighting you saw in an older article.
Not especially. Domain 3's audit methodology content doesn't build the AI-specific knowledge Domains 1 and 2 require, since it's testing a different skill entirely. There's no strict prerequisite structure across the three domains the way there might be in a technical curriculum that builds concept on concept.
Know the Map Before You Study the Territory
Three domains, one carrying nearly half the exam, and three genuinely different kinds of thinking tested underneath them. That's the map. What you do with it, how you sequence your study time and which resources you lean on for each domain, is the next decision.
Built around this exact weighting from the start, DestCert's self-paced AAIA MasterClass gives you a workbook, exam strategy videos, a 90-question practice test, and a student Discord and email support while you study.
John is a major force behind the Destination Certification CISSP program's success, with over 25 years of global cybersecurity experience. He simplifies complex topics, and he utilizes innovative teaching methods that contribute to the program's industry-high exam success rates. As a leading Information Security professional in Canada, John co-authored a bestselling CISSP exam preparation guide and helped develop official CISSP curriculum materials. You can reach out to John on LinkedIn.
