ISACA Advanced in AI Risk (AAIR) Complete Exam Prep

This course contains the use of artificial intelligence. All learning content was planned, checked and approved by people.

The ISACA Advanced in AI Risk (AAIR) certification tests whether an experienced risk, audit, security or governance professional can manage the risks of AI across a whole organization: governing it, managing it through its life cycle, and running the risk program around it. The exam has 90 multiple-choice questions in 150 minutes, across three domains: AI Governance and Framework Integration (37%), AI Life Cycle Risk Management (21%) and AI Risk Program Management (42%).

This course prepares you for that exam with one method you use on every question: Recognize the risk, Locate it in the AI life cycle, Map it to the framework that governs it, and Treat it in proportion to the stakes. You meet the method in the first section, watch it run on a full scenario in Lecture 83, and use it on the practice test at the end.

What you get

112 video lectures, about 7.5 hours, in 21 sections that follow the official exam outline domain by domain

19 section quizzes (79 questions), each answer explained

A 90-question practice test weighted like the real exam (33 / 19 / 38 questions across the three domains), with an explanation for every answer

Downloadable resources: a three-framework crosswalk, the four-step quick card, the exam blueprint at a glance, a control reference, an attack lifecycle map, an EU AI Act tier and role decision card, the NIST trustworthiness characteristics, the three lines of defense for AI, a use-case go/no-go worksheet, a vendor and foundation-model due-diligence checklist, an incident-response runbook skeleton, an exam-day facts sheet, an ISO/IEC 23894 crosswalk, a glossary, an AI risk register template and a Statement of Applicability starter

What the course covers

Foundations: what AI is for risk work, machine learning to generative AI, foundation models, how AI fails differently, and the AI value chain

The three frameworks: NIST AI RMF and its four functions, the seven trustworthiness characteristics, the Generative AI Profile, ISO/IEC 42001 as a management system, the EU AI Act's risk tiers, and how to use all three together

Governance (Domain 1): risk taxonomy, appetite and tolerance, use-case evaluation, integration with enterprise risk management, ownership, RACI, the three lines of defense, real human oversight, policy, training, regulation (EU AI Act, GDPR and automated decisions, beyond the EU), trustworthy AI, ethics and ESG

Life cycle (Domain 2): design, build versus buy, model cards and datasheets, technical documentation, training data risk, TEVV, performance and drift, fairness testing, red-teaming, deployment gates, monitoring, change management, decommissioning, AI inventory, lineage and data governance

Risk program (Domain 3): the AI threat landscape (evasion, poisoning, extraction, privacy attacks, prompt injection), risk scenarios, threat and vulnerability assessment, prioritization, treatment, residual risk, controls and the Statement of Applicability, KRIs, board reporting, audit and assurance, AI supply chain risk, incident response, regulatory reporting, business impact analysis and continuity

Exam strategy: the four-step move on any question, how scaled scoring really works, pacing, and what to keep checking after you pass

How this course is different

One method, used everywhere. The same four steps come back in every domain, so you practice one way of reasoning instead of memorizing lists.

The three frameworks side by side. NIST AI RMF, ISO/IEC 42001 and the EU AI Act are taught as one picture, with a crosswalk you can download, rather than as three separate memorization lists.

Date stamps where the rules move. Lectures on fast-moving points, such as EU AI Act deadlines and control counts, carry an on-screen date stamp or an "evolving area" flag, so you know exactly what to re-check before you sit the exam.

Exam mechanics from the source. Scoring, pacing, wrong answers and unscored questions are taught from ISACA's own candidate guide, not from rumor.

Up to date

The course was checked in November 2026 against ISACA's AAIR candidate guide and the current EU AI Act, including the 2026 Digital Omnibus amendments. Lecture 112 explains which perishable details to keep checking, because AI regulation keeps changing.

The practice questions are original. They follow the published exam outline and do not reproduce real exam items.

This course is independent. It is not affiliated with, sponsored by or endorsed by ISACA. ISACA, AAIR and Advanced in AI Risk are trademarks of ISACA. NIST, ISO/IEC and other names belong to their respective owners.