AAIA Cert Masterclass - Prepare for the Exam in 2026

This course contains the use of artificial intelligence. However, every lecture recording involves me reading the scripts, and I am fully involved in scripting and production. Be careful buying courses with instructors that don't appear in person. AI courses are becoming quite common on learning platforms.

This course is a complete, structured study program for the ISACA Advanced in AI Audit (AAIA) exam. Built domain by domain against the official exam blueprint, it covers every topic area you need to understand before sitting for the exam. Each lesson is a narrated video that explains how concepts connect to each other and to real-world practice — not just what the definition is, but how a practitioner applies it.

D1 — AI Governance and Risk (33% of the exam) — covers evaluate ai solutions to advise on impact, opportunities, and risk to organization., evaluate the impact of ai solutions on system interactions, environment, and humans., evaluate system and business requirements for ai solutions to ensure alignment with enterprise architecture., ai model types, architectures, and capability profiles -- supervised, unsupervised, reinforcement, generative, model documentation standards -- model cards, datasheets for datasets, validation reports, evaluate the role and impact of ai decision-making systems on the organization and stakeholders., evaluate the organization's ai policies and procedures, including compliance with legal and regulatory requirements., evaluate whether the organization has defined ownership of ai-related risk, controls, procedures, decisions, and standards., ai governance structures -- roles, accountability, raci, committee oversight, and board reporting, ai governance frameworks -- nist ai rmf, iso 42001, oecd ai principles, evaluate the monitoring and reporting of metrics (e.g., kpis, kris) specific to ai., evaluate the design and effectiveness of controls specific to ai., evaluate vendors and supply chain management programs specific to ai solutions., ai risk taxonomy -- performance risk, bias risk, security risk, compliance risk, third-party risk, inherent risk, residual risk, risk appetite, and risk tolerance in ai contexts, risk register requirements for ai systems -- ownership, treatment, and status, evaluate the organization's data governance program specific to ai., evaluate the organization's privacy program specific to ai., training data governance -- collection, labeling, quality assurance, and lineage, gdpr obligations for ai -- lawful basis, article 22 automated decision-making, and data subject rights, data minimization, retention, and subject rights in ai contexts, privacy impact assessments and data protection impact assessments for ai systems, analyze the impact of ai on the workforce to advise stakeholders on how to address ai-related workforce impacts, training, and education., evaluate that awareness programs align to the organization's ai-related policies and procedures., responsible ai principles -- fairness, transparency, accountability, non-maleficence, human oversight, eu ai act -- risk tiers, high-risk system obligations, prohibited practices, provider and deployer roles, iso/iec 42001 ai management system requirements and audit implications, sector-specific ai regulations and jurisdictional compliance obligations. You will understand how each of these areas is tested on the exam and how they connect to real-world practice.

D2 — AI Operations (46% of the exam) — covers evaluate data input requirements for ai models (e.g., data appropriateness, bias, privacy)., training data governance -- collection, labeling, quality assurance, and provenance, bias screening and fairness requirements in data preparation, synthetic data, de-identification, and data augmentation strategies, data quality dimensions -- accuracy, completeness, consistency, timeliness, evaluate the ai solution lifecycle (e.g., design, development, deployment, monitoring, and decommissioning) and inputs and outputs for compliance and risk., evaluate algorithms and models to ensure ai solutions are aligned to business objectives, policies, and procedures., ai lifecycle stages -- problem framing, data collection, development, testing, deployment, monitoring, decommissioning, stage-gate governance and sign-off requirements at each lifecycle transition, model development methodologies -- agile ai, mlops, and waterfall approaches, decommissioning obligations -- access removal, data disposal, and documentation archival, evaluate the organization's change management program specific to ai., adkar and organizational change readiness for ai adoption, stakeholder analysis and communication planning for ai rollouts, adoption metrics and change effectiveness indicators, displacement risk and workforce transition program design, evaluate the organization's configuration management program specific to ai., evaluate the organization's identity and access management program specific to ai., human-in-the-loop, human-on-loop, and human-out-of-loop oversight design patterns, escalation trigger design, override log requirements, and automation bias, explainability and transparency requirements for ai output review -- lime, shap, interpretable models, ai system configuration management -- version control, change logging, and rollback procedures, evaluate impacts, opportunities, and risk when integrating ai solutions within the audit process., utilize ai solutions to enhance audit processes, including planning, execution, and reporting., ai testing pyramid -- unit, integration, model, behavioral, and end-to-end layers, bias and fairness testing methods -- disparate impact analysis and subgroup evaluation, model performance benchmarking, accuracy metrics, and pre-defined acceptance thresholds, ongoing monitoring, drift detection, and revalidation triggers, evaluate the organization's threat and vulnerability management programs specific to ai., ai threat landscape -- prompt injection, data poisoning, model extraction, adversarial attacks, red teaming and adversarial testing for ai systems, input validation, output filtering, and access control as ai security controls, security assessment techniques for ai deployments, evaluate the organization's problem and incident management programs specific to ai., ai incident classification -- model failure, data breach, bias event, security compromise, nist sp 800-61 ir lifecycle applied to ai -- preparation, detection and analysis, containment eradication and recovery, post-incident activity, kill switch design and operability testing, post-incident review requirements and corrective action tracking, business continuity planning for ai-dependent processes. You will understand how each of these areas is tested on the exam and how they connect to real-world practice.

D3 — AI Auditing Tools and Techniques (21% of the exam) — covers ai audit universe -- inventory, risk ranking, and coverage planning, audit engagement scoping -- objectives, criteria, and boundary setting, audit program development -- control objectives and test procedures, competency requirements and specialist resource planning for ai audits, risk-based audit approach -- proportional coverage and documented rationale, evaluate the design and effectiveness of controls specific to ai (testing application)., tests of design vs. tests of operating effectiveness for ai controls, ai audit sampling -- representative, edge-case, and demographic slice populations, third-party and vendor audit procedures -- soc reports, right-to-audit clauses, continuous auditing techniques for ai control monitoring, ai audit evidence types -- model cards, training data lineage, validation reports, drift reports, interview and walkthrough techniques for ai control assessment, evidence sufficiency, reliability, corroboration, and independence standards, working paper documentation and audit trail requirements, scope limitation identification and disclosure requirements, data analytics techniques applied in ai audit testing, impact ratio analysis and disparate impact quantification, ai decision log sampling and population characterization, data quality validation for audit analytics inputs, automated monitoring tool integration with audit analytics workflows, audit finding classification -- critical, significant, moderate, observation, root-cause analysis and recommendation framing for ai findings, audit report structure -- executive summary, findings, management response, follow-up procedures, management action plans, and remediation validation, communicating ai audit results to non-technical stakeholders. You will understand how each of these areas is tested on the exam and how they connect to real-world practice.

Every domain includes practice questions designed to mirror the style and difficulty of AAIA exam scenarios, covering not just recall but application and analysis. The course closes with full-length practice exams with detailed answer explanations, so you can measure your readiness and focus your remaining study time where it matters most.

Major topics covered: evaluate ai solutions to advise on impact, opportunities, and risk to organization., evaluate the impact of ai solutions on system interactions, environment, and humans., evaluate system and business requirements for ai solutions to ensure alignment with enterprise architecture., ai model types, architectures, and capability profiles -- supervised, unsupervised, reinforcement, generative, model documentation standards -- model cards, datasheets for datasets, validation reports, evaluate the role and impact of ai decision-making systems on the organization and stakeholders., evaluate the organization's ai policies and procedures, including compliance with legal and regulatory requirements., evaluate whether the organization has defined ownership of ai-related risk, controls, procedures, decisions, and standards., ai governance structures -- roles, accountability, raci, committee oversight, and board reporting, ai governance frameworks -- nist ai rmf, iso 42001, oecd ai principles, evaluate the monitoring and reporting of metrics (e.g., kpis, kris) specific to ai., evaluate the design and effectiveness of controls specific to ai., evaluate vendors and supply chain management programs specific to ai solutions., ai risk taxonomy -- performance risk, bias risk, security risk, compliance risk, third-party risk, inherent risk, residual risk, risk appetite, and risk tolerance in ai contexts, risk register requirements for ai systems -- ownership, treatment, and status, evaluate the organization's data governance program specific to ai., evaluate the organization's privacy program specific to ai., training data governance -- collection, labeling, quality assurance, and lineage, gdpr obligations for ai -- lawful basis, article 22 automated decision-making, and data subject rights, data minimization, retention, and subject rights in ai contexts, privacy impact assessments and data protection impact assessments for ai systems, analyze the impact of ai on the workforce to advise stakeholders on how to address ai-related workforce impacts, training, and education., evaluate that awareness programs align to the organization's ai-related policies and procedures., responsible ai principles -- fairness, transparency, accountability, non-maleficence, human oversight, eu ai act -- risk tiers, high-risk system obligations, prohibited practices, provider and deployer roles, iso/iec 42001 ai management system requirements and audit implications, sector-specific ai regulations and jurisdictional compliance obligations, evaluate data input requirements for ai models (e.g., data appropriateness, bias, privacy)., training data governance -- collection, labeling, quality assurance, and provenance, AAIA exam prep 2026.