AAIA Exam Format: Question Types, Duration, and Passing Score

Picture a candidate who's spent months on the three AAIA domains, confident on AI governance, comfortable with the operations content, ready for whatever the audit-tools questions throw at them. Then the exam starts, and the first thing that trips them up isn't a domain question at all. It's a stem asking for the MOST likely answer among four options that all sound reasonable, and they've never practiced reading for that qualifier before.

Domain knowledge and exam-format familiarity are two separate kinds of preparation, and only one of them shows up in a typical study plan. Format-related surprises, an unfamiliar question structure, an unexpected room scan, uncertainty about whether a blank answer costs more than a wrong one, cost time and confidence independent of how well you actually know the material.

This guide covers exactly what the format looks like, sourced directly from ISACA's own exam candidate guide: how questions are built, what happens with pre-test items that don't count toward your score, how the 200-to-800 scaled score actually works, and what test day looks like at a PSI center versus a remote proctored session.

AAIA Exam Format at a Glance

What a Question Looks Like

Every AAIA question follows the same structure: a stem, either a question or an incomplete statement, followed by four answer options. Only one is correct or best.

Watch for qualifier language. A stem asking for the MOST likely outcome or the BEST response isn't asking what's technically true. It's asking you to rank several defensible options and pick the strongest one. Candidates who read past that qualifier and answer as if it's a simple factual question are the ones who pick a correct-sounding answer that isn't the one being asked for.

There's no penalty for a wrong answer. Your score is based purely on total correct answers, so an unanswered question costs you exactly as much as a wrong one. Answer everything, even a guess.

Are Any Questions Unscored?

Yes. ISACA's exams, AAIA included, mix scored items with pre-test items that don't count toward your final score at all. ISACA doesn't publish a way to identify which questions are which during the exam itself, so the practical implication is simple: treat every question as if it counts, since there's no reliable way to spot the ones that don't.

How the Passing Score Works

A 450 isn't a percentage. ISACA reports scores on a scaled range from 200 to 800, a conversion of your raw score onto a common scale so that different versions of the exam stay comparable. An 800 means every question answered correctly, 200 means only a handful did.

Here's the detail that trips people up: your domain-level results are informational only. ISACA does show you a breakdown by domain afterward, but your pass or fail outcome is based on your total correct answers across all 90 questions combined, not on hitting a threshold within each domain individually. You could underperform in one domain and still pass comfortably on overall strength in the other two.

What Happens on Test Day

The rules differ depending on whether you're at a PSI test center or testing remotely, and both are stricter than most candidates expect.

At a test center: bring a current, valid, government-issued photo ID with your signature, matching the name on your registration exactly. Arrive at least 30 minutes early. You'll be in a room with other test-takers, and some ambient noise is normal. Personal items get stored away and aren't accessible until you're done.

Remote proctoring: before your exam starts, you'll complete a mandatory room scan: a 360-degree pan of the room, a scan of your desk surface including under your keyboard, and a scan from floor to ceiling. You'll also do a mirror check, holding a mirror or phone up to show the screen, keyboard, and monitor edges, to reveal blind spots your webcam alone can't capture.
 
If you use a phone for the scan, ISACA requires it to be placed out of reach in the testing room afterward, not removed from the room entirely. This level of scrutiny isn't unique to ISACA, other certification bodies have piloted similarly strict identity-validation measures for remote proctoring as the format becomes standard across the industry.

Both formats prohibit the same core things: notes, calculators, phones (except for the remote mirror check itself), smartwatches, food, drinks, and visitors. Per ISACA's own phrasing, one 10-minute break is allowed with proctor permission, and your exam is paused during it, but the timer is not, so no extra time is granted.

What If Something Goes Wrong?

If a genuine emergency, illness, or family bereavement keeps you from your appointment, ISACA has a documented personal hardship process: contact PSI within 72 hours and provide supporting documentation, and you can reschedule without forfeiting your fee. Outside of that, missing your appointment or arriving more than 15 minutes late forfeits your registration entirely, no exceptions.

If severe weather closes a test center, PSI reschedules you at no extra cost. Reschedules requested more than 48 hours before your appointment carry no penalty either.

Tips for the AAIA Exam Format

1. Don't hunt for the unscored questions. You can't identify pre-test items during the exam, so trying only wastes time you don't have.
2. Watch for MOST/BEST qualifiers on every stem. Build the habit in practice, not on exam day.
3. Answer every question before time runs out. Blank and wrong cost you the same amount.
4. If testing remotely, do a full dry run of your setup beforehand, including the compatibility check ISACA provides, so the room scan doesn't eat into your actual exam time.
5. Don't over-index on domain-level feedback if you fail. It's informational, not diagnostic of exactly what cost you the pass, since only your total score determines the outcome.
6. Expect the room scan and monitoring to feel invasive if you're testing remotely, and plan for it. A strictly monitored, high-stakes environment is exactly the kind of situation Forbes has covered strategies for managing performance anxiety around, and going in prepared for the scrutiny itself, not just the content, keeps it from eating into your focus once the clock starts.

Frequently Asked Questions 

Practice the Format, Not Just the Content

Pre-test items, the room-scan process, the way scaled scoring works, none of that shows up in a typical study plan, and all of it can cost a candidate points that have nothing to do with domain knowledge. Knowing the domains gets you the knowledge. Knowing the format is what keeps that knowledge from getting wasted on a technicality.

A 90-question practice test built to the same format as the real exam anchors DestCert's self-paced AAIA MasterClass, along with exam strategy videos, a workbook, and a student Discord and email support while you prepare.