What Is Advanced in AI Risk (AAIR)?

Overview

Advanced in AI Risk (AAIR) is a ISACA credential. ISACA AAIR exam prep for CRISC holders and other qualified risk professionals. Covers AI risk governance, AI life cycle risk, and AI risk program management. This PathKey™ guide summarizes the domains, format, cost signals, eligibility, and renewal pattern so you can decide before you book. Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the ISACA exam. ISACA sets exam content, fees, and policies.

Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the ISACA exam. ISACA sets exam content, fees, and policies.

Who it is for

• CRISC holders and IT risk managers responsible for AI use in their organization.
• Audit, security, and GRC professionals who hold a qualifying certification and advise on AI risk.
• Risk directors who report AI exposure to leadership and boards.

Exam domains

Weights follow the official outline.

1. 01

   AI Models, Frameworks, and Use Cases

   Maps to ISACA Domain 1, AI Risk Governance and Framework Integration (37%), Understand the AI models, frameworks, and strategies an organization uses, and Evaluate AI use cases against the organization’s risk appetite.

2. 02

   AI Ownership, Oversight, and Policy

   Maps to ISACA Domain 1, AI Risk Governance and Framework Integration (37%), Define AI ownership, oversight, and accountability, and Develop AI risk policies, procedures, roles, and acceptable risk tolerance levels.

3. 03

   AI Regulation, Trust, and Ethics

   Maps to ISACA Domain 1, AI Risk Governance and Framework Integration (37%), Assess compliance with AI-related laws, regulations, frameworks, and standards, and Address trustworthiness, ethics, bias, privacy, safety, and ESG impacts.

4. 04

   AI Design, Development, and Procurement

   Maps to ISACA Domain 2, AI Life Cycle Risk Management (21%), Assess risk in AI design, development, procurement, and documentation, and Evaluate suitability, algorithms, and training approaches.

5. 05

   AI Training, Testing, and Validation

   Maps to ISACA Domain 2, AI Life Cycle Risk Management (21%), Review risk in model training, testing, and validation, and Monitor drift and other changes across the AI life cycle.

6. 06

   AI Implementation and Decommissioning

   Maps to ISACA Domain 2, AI Life Cycle Risk Management (21%), Assess risk during implementation, maintenance, and decommissioning, and Assess human oversight controls at critical decision points.

7. 07

   AI Risk Scenarios and Assessment

   Maps to ISACA Domain 3, AI Risk Program Management (42%), Identify AI risk scenarios, including threats, vulnerabilities, and attacks, and Conduct risk assessments that classify AI risk.

8. 08

   AI Risk Treatment and Controls

   Maps to ISACA Domain 3, AI Risk Program Management (42%), Develop and recommend treatment strategies for identified AI risk, and Evaluate, select, and validate controls that keep AI risk within tolerance.

9. 09

   AI Risk Metrics, Monitoring, and Reporting

   Maps to ISACA Domain 3, AI Risk Program Management (42%), Capture AI risk in enterprise metrics and reporting for boards, management, and operations, and Keep watching for new and emerging AI risk.

10. 10

    AI Supply Chain, Incidents, and Continuity

    Maps to ISACA Domain 3, AI Risk Program Management (42%), Evaluate AI risk in the supply chain and third-party resources, and Integrate AI risk scenarios into enterprise incident management.

Exam format and cost

Questions

Confirm on the vendor site

Duration

Confirm on the vendor site

Format

Multiple choice and related item types (confirm on the vendor outline)

Passing score

Confirm the passing score on the vendor site

Cost

Confirm the current exam fee on the vendor site before you register

Delivery

Vendor-approved test center or online proctoring (confirm on the vendor site)

Languages

Confirm available languages on the vendor site

Experience and eligibility

ISACA requires AAIR candidates to hold one of its qualifying designations, such as CISA, CISM, CRISC, CGEIT, CDPSE, CISSP, CGRC, CIA, or PMI-RMP. Confirm your eligibility with ISACA before you register. ISACA says AAIR candidates should have proven experience in IT risk or advisory roles.

Renewal

Renewal rules for Advanced in AI Risk (AAIR) are set by ISACA. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.

Roles this credential fits

• AI risk governance and framework integration, AI life cycle risk management, and AI risk program management, mapped to ISACA’s three AAIR exam domains, for risk professionals who already hold CRISC or another qualifying certification.
• AI Risk
• Teams standardizing on this credential for hiring or compliance

Official sources

• ISACA credentialing

Always confirm fees, dates, and eligibility on the vendor site before you register. Vendors change outlines and prices without notice.