Most compliance teams answer "are we ready for the AI rules?" the same way. They pull together the AI policy, the acceptable-use standard, an inventory of tools, and a slide mapping each tool to a regulation. It looks thorough. It also answers a question regulators have mostly stopped asking.
The question now is whether what your organization says about its AI is true. Two US investment advisers found that out in 2024, when the SEC fined them over AI claims they couldn't back up. In the EU, the AI Act's high-risk rules for uses like credit scoring and hiring apply from 2 December 2027, a little over a year from now, and they'll be checked the same way.
Proving a claim is true is audit work. That's why AAIA for compliance officers deserves a close look: it's ISACA's credential for evaluating AI systems the way an auditor does. The complication is eligibility, and plenty of compliance officers sit on the wrong side of it.
What Is AAIA for Compliance Officers?
AAIA (Advanced in AI Audit) is ISACA's certification for auditing AI systems. ISACA describes it as building on audit expertise so you can advise on AI, manage its risk, and ensure compliance. For a compliance officer, the most telling line in the exam outline is supporting task 6: evaluate the organization's AI policies and procedures, including compliance with legal and regulatory requirements.
That's your job, seen from the auditor's chair. Compliance writes and maintains those policies. AAIA trains you to judge whether they hold up when someone independent tests them, and to gather the evidence that settles it.
The exam is 90 multiple-choice questions in 2.5 hours, across three domains. ISACA built it for experienced auditors, so you need a qualifying audit credential before you can sit it. Our AAIA requirements guide covers the eligibility rules in full, and the AAIA exam format breakdown explains how the questions work.
Why AI Regulatory Readiness Is an Audit Question
Regulators judge AI readiness on evidence that your systems do what you say they do. A policy can't supply that evidence, however well it's written.
Think of a building's fire safety plan. The plan says everyone is out in four minutes. That's a claim. The only thing that proves it is a fire drill: someone with a stopwatch, a headcount at the assembly point, and a record of how long it took. Compliance teams write excellent plans. When a regulator shows up, they ask for the drill records.
The SEC's first "AI washing" cases are what happens when nobody runs the drill. On 18 March 2024, the SEC settled charges against two investment advisers over false statements about their use of AI. Delphia had told clients, in its SEC filings, a press release, and on its website, that it used AI and machine learning on client data in its investment process. The SEC found it didn't have those capabilities. Global Predictions had called itself the "first regulated AI financial advisor." Delphia paid a $225,000 civil penalty, and Global Predictions paid $175,000.
What both firms lacked was a check of each public claim against the system before it went out. They'd painted "four minutes" on the fire door without ever timing an evacuation.
The EU is heading the same way. The Council of the EU's timeline for the AI Act's simplification package fixes the delayed high-risk dates at 2 December 2027 for stand-alone high-risk systems, and 2 August 2028 for high-risk AI built into regulated products. That extra time is for building the evidence.
This is also where AAIA thinking differs from policy thinking. A monthly bias review is a detective control, and if you need a refresher on how preventive, detective and corrective controls differ, the distinction matters here. A compliance review asks whether the control is documented. An audit asks whether it ran and what it found.
Can Compliance Officers Qualify for AAIA?
Only if you hold an active CISA or one of ISACA's listed accounting and audit credentials while working in an IT audit or IT advisory role. Compliance and privacy credentials aren't on ISACA's qualifying list, so a compliance background on its own doesn't get you in.
Your credentials and role | Can you sit AAIA? |
|---|---|
Active CISA | Yes, whatever your current role. |
CIA, US CPA, ACCA, or another listed accounting credential, plus an IT audit or IT advisory role | Yes. |
CIA or CPA in a compliance role with no IT audit or advisory focus | Unlikely. The role condition is the sticking point. |
Compliance or privacy credentials only | No. They aren't on ISACA's list. |
CISM or CISSP, without CISA | No, though AAISM is open to you (see below). |
The full list of qualifying designations is in ISACA's AAIA exam candidate guide. You also have to keep that credential active for as long as you hold AAIA.
The first row covers more compliance officers than you might expect. Plenty of people move into compliance from IT audit and keep their CISA. If that's you, you're eligible today, whatever your title says.
If You Don't Qualify Yet
You've got two realistic routes, and the right one depends on the work you want to be doing.
Earn CISA first if you want to audit AI. CISA is the only credential that opens AAIA regardless of role. Our AAIA vs CISA comparison explains how the two fit together.
Look at AAISM if you hold CISM or CISSP. AAISM is ISACA's AI security management credential, and it's open to active CISM and CISSP holders. It suits compliance officers who sit close to the security program and want to lead AI governance from that side. The AAISM certification guide covers what it tests, and the AAISM requirements checklist confirms who qualifies.
How AAIA Compliance Content Maps to Compliance Work
A compliance background covers a good share of Domain 1 and very little of Domain 2, which is where nearly half the exam sits. The weightings below come from ISACA's exam content outline.
Domain | Weight | Typical compliance officer starting point |
|---|---|---|
1. AI Governance and Risk | 33% | Strongest. Includes privacy and data governance programs, and leading practices, ethics, regulations, and standards for AI. Mapping requirements to controls carries over directly. AI models and AI-specific risk management are newer. |
2. AI Operations | 46% | The main gap. Covers data management for AI, development lifecycles, AI change management, supervision of outputs and decisions, testing techniques, AI-specific threats, and incident response. |
3. AI Auditing Tools and Techniques | 21% | Familiar if you've worked in audit, newer if your experience is mostly being audited. Covers audit planning, testing and sampling, evidence collection, data analytics, and audit reporting. |
ISACA scores the exam on total correct answers, regardless of domain. The weights tell you where the questions sit, and a strong Domain 1 can offset a weaker Domain 2. With 46% of the questions in Domain 2, though, there's only so much offsetting Domain 1 can do.
AAIA compliance content starts from vocabulary you use every week, then pushes past where most compliance programs stop. Take change management. Your policy probably says material changes to a system get reviewed before release. Domain 2 asks what counts as a material change for a model that retrains itself on new data every month, who decides, and where the record of that decision lives. You can't answer it without knowing how the system works well enough to test it. That's the part compliance officers usually learn from scratch, and our AAIA domains breakdown goes through every sub-area, Domain 2 included.
The audit skills carry over. The AI part can be learned.
Looking for some CISSP exam prep guidance and mentoring?
Learn about our personal CISSP mentoring
The Exam Question Compliance Officers Get Wrong
The AAIA exam rewards gathering independent evidence before doing anything else. A compliance officer's trained instinct is to fix the exposure first, and the exam keeps punishing that instinct. ISACA's candidate guide says every question has one best answer, and many turn on a qualifier such as MOST likely or BEST. Here's a question from the free DestCert app that shows the pattern. It's written in the style of the real exam and isn't taken from it.
An auditor discovers undocumented data manipulation steps applied before model training. What is the MOST appropriate audit response?
A. Accept the manipulations as standard practice since data cleaning is a routine part of the machine learning workflow
B. Recommend retraining the model from scratch using only raw unmanipulated data to ensure dataset integrity
C. Determine whether the manipulations are methodologically justified and consistently applied, and assess bias risk
D. Escalate the finding directly to the board of directors as evidence of intentional data poisoning by malicious actors
The best answer is C.
A leans on someone else's practice. Data cleaning is routine, and an auditor still can't accept manipulation nobody documented without reviewing it.
B is the trap built for a compliance officer. In your day job, removing the exposure is a good instinct, and starting again from raw data feels like the clean, responsible answer. But retraining is an operational decision, and you don't know yet whether the manipulation caused a problem at all. You'd be rebuilding the fire exit before anyone has timed an evacuation.
D jumps to a conclusion the evidence doesn't support. Escalating to the board as data poisoning assumes malicious intent that nobody has shown.
C is the drill. It produces the auditor's own evidence and tests what was actually done to the data. It's the same kind of check that would have caught the problem in the Delphia case, where nobody tested what the firm said about its AI against what the system could do.
Our AAIA practice questions walk through more items built on the same test-first logic.
Certification in 1 Week
Study everything you need to know for the CISSP exam in a 1-week bootcamp!
Frequently Asked Questions
Not by name. ISACA's exam content outline doesn't list specific laws. Domain 1 includes leading practices, ethics, regulations, and standards for AI, and one supporting task asks you to evaluate AI policies and procedures for compliance with legal and regulatory requirements. The exam tests how you audit compliance with AI rules in general, which applies to the EU AI Act and to any other regime your organization falls under.
The AAIA exam has 90 multiple-choice questions and a time limit of 2.5 hours. Each question has four options and one best answer. Scores are reported on ISACA's 200 to 800 scale, and you need 450 or higher to pass. There's no penalty for wrong answers, so every question should be answered.
The exam registration fee is US$459 for ISACA members and US$599 for non-members. After passing, you pay a US$50 application processing fee. Keeping the certification requires an annual maintenance fee of US$20 for members or US$35 for non-members, plus at least 10 CPE hours a year and 30 over every three years.
Choose AAIA if you hold a qualifying audit credential and want to provide independent assurance over AI systems. Choose AAISM if you hold an active CISM or CISSP and want to lead AI security and governance inside the program. The deciding question is whether you want to test the controls or own them.
You get four attempts within a rolling 12-month period. After a first failed attempt, you wait 30 days before the second, then 90 days before each of the third and fourth. You pay the full registration fee for every attempt.
Turn Your AI Compliance Program Into Evidence That Holds Up
Option B is the answer to unlearn, and that takes practice on questions built around the same trap. Check the eligibility table first, so you're preparing for an exam you're allowed to sit.
The AAIA MasterClass trains the audit judgment this exam rewards: weighing several reasonable answers and picking the one the evidence supports. Rob Witcher teaches it, and he holds CISA, the credential AAIA builds on. You get exam strategy videos on how ISACA frames its questions, a 90-question practice test, a workbook, and the student Discord while you study. Many employers pay for certification training, so ask yours before you enroll.
John is a major force behind the Destination Certification CISSP program's success, with over 25 years of global cybersecurity experience. He simplifies complex topics, and he utilizes innovative teaching methods that contribute to the program's industry-high exam success rates. As a leading Information Security professional in Canada, John co-authored a bestselling CISSP exam preparation guide and helped develop official CISSP curriculum materials. You can reach out to John on LinkedIn.
