Your cart is empty.
Keep shopping
ISACA AAIR Exam Prep: Advanced in AI Risk Certification
8 students
ISACA AAIR Exam Prep: Advanced in AI Risk Certification
NIST AI RMF, ISO 42001, EU AI Act, OWASP LLM Top 10 & MITRE ATLAS — 2 mock exams for CISA, CRISC & CISSP holders
Last updated 7/2026
English
What you'll learn
- Apply the NIST AI RMF 1.0 Govern, Map, Measure, and Manage functions to enterprise AI risk — mapped to real governance decisions
- Compare NIST AI RMF, ISO 42001, ISO 23894, and EU AI Act on scope, risk approach, and control specificity — the core AAIR exam skill
- Implement ISO 42001 AI Management System requirements and Annex A controls for responsible AI development and deployment
- Use OWASP LLM Top 10 to assess prompt injection, insecure output handling, supply chain, and denial of service risk in AI deployments
- Navigate the EU AI Act risk tier structure — prohibited uses, high-risk obligations, conformity assessment, and provider vs deployer duties
- Identify and assess data risk — training data bias, data lineage requirements, data poisoning, and GDPR data minimisation obligations
- Apply the SR 11-7 model validation framework to AI models including drift detection, back-testing, and independent validation requirements
- Apply MITRE ATLAS tactics and techniques to model AI system threats including inversion, membership inference, and adversarial examples
- Plan and execute AI red team exercises — scope, rules of engagement, severity classification, and integration with NIST AI RMF Measure
- Design an enterprise AI risk program — AI system inventory, risk appetite, controls framework, KRIs, and board-level reporting structure
- Integrate AI risk into existing CRISC IT risk lifecycles and COSO ERM frameworks using the three lines of defence model
- Answer AAIR scenario-based exam questions with confidence — worked examples, elimination logic, and ISACA judgment framework by domain
Explore related topics
Course content
6 sections • 35 lectures • 6h 21m total length
Requirements
- An active ISACA or equivalent credential is required to sit the AAIR exam: CISA, CRISC, CISM, CISSP, CGEIT, CDPSE, or one of the 25 qualifying designations
- No prior AI or machine learning background is required — the course includes a technical primer covering the AI terminology every risk professional needs
- No software tools required — this is a framework, governance and exam preparation course, not a data science or AI development course
- CISA and CRISC holders will find the course builds on their existing knowledge rather than repeating it
- You can take this course before holding a prerequisite credential — the frameworks and methodology stand on their own, and the AI risk knowledge is useful whether or not you sit the exam
Description
▸ AI risk has moved from the IT department to the boardroom. Regulators are not waiting.
The EU AI Act is in force. The NIST AI Risk Management Framework is referenced in government procurement contracts. ISO 42001 is being mandated by enterprise clients across financial services, healthcare and critical infrastructure. ISACA has responded with a new advanced credential — the AAIR — for credentialled IT risk professionals who need a structured, exam-validated framework for managing AI-specific risk at enterprise scale.
This is the complete preparation programme for it.
▸ What the AAIR exam is
AAIR launched in April 2026. It is a 90-question, scenario-based exam that tests applied judgment, not definitions. The prerequisite is an existing ISACA or equivalent credential — CISA, CRISC, CISM, CISSP, CGEIT or CDPSE among 25 qualifying designations.
The exam covers three domains: AI Risk Governance and Framework Integration, AI Lifecycle Risk Management, and AI Risk Program Management. This course covers all three in full.
▸ Get in early
AAIR is three months old. The professionals who hold it now are the ones being asked to lead AI risk programmes, sit on AI governance committees and advise boards — before the market fills and the credential becomes table stakes rather than a differentiator.
▸ Domain 1 — Governance and framework integration
The full regulatory landscape: NIST AI RMF 1.0 function by function, ISO 42001 AIMS requirements and Annex A controls, ISO 23894 risk management guidance, and the EU AI Act risk tier structure with provider and deployer obligations. Plus sectoral frameworks — SR 11-7 for financial services, FDA SaMD for healthcare AI, CISA guidance for critical infrastructure — and the ISACA Digital Trust Ecosystem Framework that underpins the exam's conceptual lens.
▸ Domain 2 — AI lifecycle risk
What the exam tests most directly: data quality, bias and lineage risk; model drift, validation and SR 11-7 applied to AI; fairness metrics and explainability obligations under GDPR and the EU AI Act; OWASP LLM Top 10 applied to enterprise deployments; MITRE ATLAS tactics for AI threat modelling; AI red teaming methodology; third-party and vendor due diligence; and incident management including EU AI Act serious incident reporting.
▸ Domain 3 — Risk programme management
Programme design and scope, the AI system inventory, risk assessment methodology with worked examples, the controls framework mapped to COBIT 2019 and ISO 27001, Key Risk Indicators, board-level reporting, the audit function's role in AI assurance, and integration with existing ERM and CRISC IT risk frameworks.
▸ Exam technique, not just content
The course closes with preparation by domain: high-frequency question types, worked scenarios with model answers and elimination logic, and the ISACA judgment framework for scenario questions where several answers look plausible. Plus emerging topics — agentic AI, post-quantum cryptography intersections, and what is coming after the EU AI Act.
▸ What you get
Over 6 hours of structured video across 35 lectures and five sections
Two full AAIR mock examinations — scenario-based, timed and retakeable
Complete coverage of all three exam domains
Worked scenarios with elimination logic and model answers
Lifetime access, mobile and TV access, and a certificate of completion
Udemy's 30-day money-back guarantee
▸ Built by a practitioner
Taught by a practising engineer and risk professional with over fifteen years delivering safety-critical projects across regulated energy infrastructure, and direct experience teaching IEC 62443, IEC 61511 and GICSP content to working professionals. The frameworks are explained as they apply in practice; the exam scenarios reflect how ISACA tests applied judgment rather than recall.
▸ No prior AI or machine learning background is required — the course includes a technical primer covering the AI terminology every risk professional needs. No software or tools; this is a governance, framework and exam preparation course.
If you hold CISA, CRISC, CISM or CISSP and AI risk is on your organisation's agenda, this credential is worth pursuing now.
Enrol now and sit AAIR with the frameworks and the exam technique in place.
Who this course is for:
- CISA, CRISC, CISM, and CISSP holders who need a validated AI risk credential and want structured preparation for the AAIR exam
- IT risk and governance professionals whose organisations are deploying AI and who need a structured framework for assessing and managing AI-specific risks
- Information security managers and CISOs responsible for AI governance who need to understand how AI risk integrates with existing IS governance structures
- Internal auditors and assurance professionals who need to assess AI systems, evaluate AI controls, and report AI risk findings to audit committees
- Compliance and regulatory professionals managing EU AI Act, DORA, NIS2, or financial sector AI obligations who need the AAIR framework as a structured compliance lens
- Risk consultants and advisory professionals who advise clients on AI governance and need a credentialled, exam-validated framework for client-facing engagements
- Enterprise risk managers integrating AI risk into existing ERM frameworks and needing the ISACA-endorsed methodology for doing so