Months of preparation have brought you to this point. You know the three domains. You have worked through practice questions, built your governance mental model, and put real time into understanding how AAISM frames AI security decisions. Now that exam day is close, you are trying to figure out exactly what happens when you walk through the door.
That practical gap (knowing the content versus knowing what to do with it on the day) is where a lot of otherwise well-prepared professionals lose points they should have kept. Not because they lacked knowledge, but because they encountered something unexpected at the testing center, mismanaged their time in the first thirty questions, or did not have a strategy for the scenario questions that stumped them.
This guide closes that gap. What to bring, what the PSI check-in process looks like, how to pace 90 questions across 150 minutes, how to approach governance scenario questions under pressure, and what happens the moment you submit. Read this before exam day, not during it.
One Critical Distinction Before You Book: AAISM Uses PSI, Not Pearson VUE
If you have taken other ISACA exams (CISM, CRISC, or CISA), you likely took them through Pearson VUE testing centers. The AAISM is different. ISACA delivers it through PSI, a separate testing partner with its own scheduling system, testing center network, and remote proctoring platform. The process is similar in most ways but different enough that knowing the distinction before you book saves confusion.
To schedule your exam, log into your ISACA account, select the AAISM certification, and complete payment. You will receive an email from PSI with scheduling instructions. From that point, you can book an appointment as early as 48 hours after paying the registration fee, and PSI allows scheduling up to 90 days in advance.
Two delivery options are available: in-person at an authorized PSI testing center, or remote proctoring from a private location. Remote proctoring is not available in India, Mainland China, or Hong Kong. Professionals in those regions must sit the exam at a physical PSI testing center. If you are in one of those regions, confirm your nearest PSI location before your registration window opens, as popular test dates can fill up.
Your name on your identification must match your ISACA registration exactly: character for character, including middle initials if they appear on one but not the other. Any mismatch creates a check-in problem that may delay your start or require rescheduling. Verify this before exam day, not at the front desk.
What Happens at the PSI Testing Center
Arrive 15 to 30 minutes before your appointment time. This is not a suggestion. The check-in process at PSI testing centers requires identity verification, biometric or photo capture, and locker storage of all personal belongings. Arriving minutes before the exam starts creates stress before you have answered a single question.
What to bring:
- Two forms of identification, at least one being a government-issued photo ID
- Your PSI confirmation email or appointment number (not always required, but useful if there is a check-in issue)
- Any approved comfort items for long sessions
What you cannot bring into the exam room:
- Mobile phones, smartwatches, or any electronic devices
- Study materials, notes, or books
- Food or water (confirm with your specific testing center, as policies vary slightly)
- Personal items beyond your ID
Your belongings go into a provided locker before you enter the exam room. PSI provides a computer workstation, scratch paper or a whiteboard for notes, and a writing implement. The testing room is quiet with individual workstations, controlled lighting, and consistent temperature. If noise is an issue, request noise-canceling headphones at the front desk. Most PSI centers have them available.
Once you sit down, you will see the PSI exam interface. It is clean and straightforward. Spend a moment familiarizing yourself with the navigation before the timer starts. Most PSI exams offer a brief tutorial screen at the beginning.
Looking for some exam prep guidance and mentoring?
Learn about our personal mentoring
If You Are Taking the Remote Proctored Option
Remote proctoring through PSI requires preparation well before exam day. The system requirements include a working webcam, a microphone, and a stable internet connection. Smartphones and tablets are not compatible: you need a desktop or laptop.
Run the PSI compatibility check on the exact device and network you will use on exam day, not a different machine. Run it from the same location. PSI provides a tutorial test that includes a system check and five sample questions. Complete it at least 24 hours before your exam, not the morning of.
On exam day, your proctor will walk you through a check-in process that includes ID verification and a 360-degree scan of your testing environment. Your space must be private, free from other people, and clear of unauthorized materials. A plain desk is ideal.
If you experience a technical failure mid-exam and cannot resolve it quickly, contact PSI technical support immediately. Do not close the exam window without proctor guidance. Closing it without proctor approval can be treated as an exam abandonment.
The Night Before and Morning of Exam Day
The night before: Stop studying at least two hours before you plan to sleep. A light review of frameworks you already know well is fine: a quick pass through domain weights or key governance concepts. Do not take a full practice exam, do not read failure stories on certification forums, and do not try to absorb new material. Your brain needs consolidation time, not new input.
Confirm your logistics: the route to the testing center, your appointment time, which two forms of ID you are bringing, and where your confirmation email is. Set multiple alarms.
The morning of: Eat a real breakfast. Protein and complex carbohydrates provide sustained energy without a crash. Avoid excessive caffeine if it tends to increase your anxiety. If you normally drink coffee, have your normal amount.
Arrive at the testing center 15 to 30 minutes early. Use any extra time to breathe and settle, not to cram. You are not learning new content at this point. You are preparing your mental state for 150 minutes of focused governance thinking.
Certification in 3 Days
Study everything you need to know for the AAISM exam in a 3-day bootcamp!
The AAISM Exam Format on Test Day
The confirmed AAISM exam format:
Total questions | 90 |
Time limit | 150 minutes (2.5 hours) |
Average time per question | 100 seconds |
Passing score | 450 out of 800 (scaled) |
Question format | Multiple choice and scenario-based |
Results | Immediate pass/fail notification |
Score report | Domain-level feedback within 24-48 hours |
Retake policy | 4 attempts per rolling 365-day year; 30-day wait after attempt 1, 90-day wait after attempts 2 and 3 |
The 450 out of 800 passing score uses a scaled scoring model. Your raw number of correct answers is adjusted based on the difficulty of the questions you received, similar to how CISM and CRISC are scored. You will not receive a numerical score on the results screen: only a pass or fail notification, followed by a domain-level breakdown in your score report if you did not pass.
How to Approach Scenario-Based Questions
The AAISM exam does not test recall. It tests governance judgment. Questions present organizational scenarios and ask you to identify the most appropriate action for a security leader responsible for AI programs. Multiple answer options will appear partially correct. The distinction between right and wrong is often a question of which option reflects the best governance decision, not which is technically accurate.
- The governance-first mental model: Before reading answer options, ask yourself what the scenario is actually asking. Is this a Domain 1 question (program governance, policy design, AI system inventory)? Domain 2 (risk identification, risk treatment, third-party AI risk)? Domain 3 (AI controls, adversarial defenses, monitoring)? Identifying the domain focus helps you apply the right governance framework before you evaluate the options.
- Qualifier words matter: Pay careful attention to MOST, BEST, FIRST, and PRIMARY. These qualifier words signal that multiple options have merit, and you are looking for the optimal one given the specific context. LEAST and EXCEPT signal reverse logic. Read every word of the question stem before touching the answer options.
- When multiple options look correct: Eliminate the options that address the right problem at the wrong layer. AAISM consistently rewards governance-level decisions over technical implementation details. An answer that involves designing a policy or governance structure will generally beat one that involves configuring a specific technical control, unless the question explicitly asks about controls.
- First instinct vs second-guessing: Most AAISM professionals report that their first instinct, when they have properly applied the governance framework, is correct more often than second-guessed revisions. Change answers only when you can identify a specific reasoning error, not because the question felt hard.
The governance-first mental model is the single most important preparation shift for this exam. The free Neutral Playbook from Destination Certification builds exactly that model. How to approach AI security management decisions in a way that maps to how AAISM frames its questions. Reading it before your exam changes how you read questions, not just how you study content.
Time Management for 150 Minutes
At 100 seconds per question, 150 minutes feels manageable until you encounter a complex scenario with a long vignette. Build in buffer time with these pacing benchmarks:
- After 30 questions: You should be at approximately 50 minutes elapsed. If you are significantly ahead, you are rushing: slow down. If you are behind, flag and move.
- After 60 questions: You should be at approximately 100 minutes elapsed.
- After 80 questions: You should be at approximately 133 minutes elapsed. You now have roughly 17 minutes for the final 10 questions and any flagged review.
- Reserve 15 minutes for reviewing flagged questions before submitting.
The flagging strategy: When a question stumps you within the first 30 to 40 seconds of reading, flag it and move forward. Do not spend three minutes on a single question in the first half of the exam. Flag 15 to 25 questions maximum. More than that suggests either insufficient preparation or overly cautious reading, both of which have different remedies.
Domain 3 (AI Technologies and Controls, 38%) is the highest-weighted domain and typically produces the most technically complex questions. If you feel less confident in AI-specific threat and control content, the free AI Threat Hunting Playbook from Destination Certification addresses exactly that territory. The detection and response thinking that connects to what Domain 3 tests. Reviewing it before exam day helps you recognize the governance implications of technical AI security scenarios rather than getting stuck on implementation details.
Why Passing AAISM Matters Beyond the Test
The AAISM exam day is a high-stakes two-and-a-half-hour window that represents something larger than a test result. As ISACA's 2025 AI Pulse Poll found, 89% of digital trust professionals say they need to increase their AI skills and knowledge within two years to retain their job or advance their career. That is not a preference. It is a workforce reality shaping how organizations evaluate security leaders.
The professionals who pass AAISM on their first attempt are the ones who prepared for both the content and the conditions. They walked in knowing the governance frameworks, knowing how the scenario questions are structured, and knowing what to do when a question was difficult. Exam day preparation is not a supplement to content preparation. It is the last mile of it.
After You Submit
The moment you click submit, the PSI interface will display your provisional result: pass or fail. This immediate notification is reliable. It reflects the scaled scoring calculation applied to your performance across all 90 questions.
If you passed, your result is provisional until ISACA conducts its post-exam review. Official certification typically follows within a few business days. You will receive instructions for completing your AAISM certification application, including confirmation that your CISM or CISSP prerequisite is active.
If you did not pass, your score report (available within 24 to 48 hours in your ISACA account) provides domain-level feedback showing whether you performed below proficiency, near proficiency, or above proficiency in each domain. This breakdown is your study guide for the retake. ISACA allows four exam attempts within a rolling 365-day window from your first attempt date. After the first failed attempt, you must wait 30 days before retaking. After the second failed attempt, the wait is 90 days. After the third failed attempt, the wait is also 90 days. Each retake requires purchasing a new exam registration. Once the 365-day window from your first attempt has passed, the cycle resets.
Either way, give yourself recovery time immediately after the exam. Four hours of sustained governance thinking creates real mental fatigue. Do not make important decisions or schedule demanding work in the hours following the exam.
Frequently Asked Questions
Two forms of identification, with at least one being a government-issued photo ID. The name on your ID must match your ISACA registration exactly: character for character. Even minor discrepancies like a missing middle initial can cause check-in delays. Verify this well before exam day. Accepted primary IDs include driver's licenses, passports, and national identification cards.
Yes, if you are not located in India, Mainland China, or Hong Kong. Remote proctoring is available for professionals in most regions. You need a desktop or laptop computer with a working webcam and microphone, a stable internet connection, and a private testing environment. Run the PSI compatibility check on the exact device and network you will use before scheduling your remote appointment.
90 questions, 150 minutes (2.5 hours). The average time per question is approximately 100 seconds. The passing score is 450 out of 800 on a scaled scoring model. Results are delivered immediately upon submission.
Yes. PSI's exam interface allows you to flag questions for later review and navigate back to them before final submission. Use this strategically: flag questions you cannot resolve within 30 to 40 seconds on first pass, continue through the exam, and return to flagged questions during your reserved review time at the end.
You receive an immediate provisional pass or fail result on the PSI interface. A detailed domain-level score report follows within 24 to 48 hours in your ISACA account. If you passed, you will receive instructions for completing your certification application. If you did not pass, the domain breakdown in the score report identifies where to focus your preparation for a retake.
AAISM Preparation Does Not Stop the Night Before. It Starts Here
You now know what to expect at check-in, how to pace 90 questions across 150 minutes, how to approach governance scenario questions when two options look correct, and what the screen will show you the moment you submit. That operational clarity removes a layer of uncertainty that otherwise costs composure and costs points.
If you want to move fast through your remaining preparation, the AAISM Bootcamp delivers all three domains in three intensive days of live online instruction, with expert-led sessions and real-time Q&A throughout. If your schedule requires more flexibility, the AAISM MasterClass gives you the same expert instruction at your own pace, with an adaptive learning system that identifies exactly what you still need to work on before exam day.
Before committing to a full program, the free Neutral Playbook from Destination Certification is worth reading now. It builds the governance-first mental model that makes scenario questions on the AAISM significantly more approachable, and it takes less than an hour to read.
Ninety questions, 150 minutes, one result. The professionals who pass are the ones who prepared for all three.
