ISACAISACA Advanced in AI Risk
The ISACA Advanced in AI Risk (AAIR) certification empowers experienced IT risk professionals to lead on AI risk. It validates your ability to assess and manage AI-related risks across the enterprise, integrate AI risk into governance frameworks, and guide management through the evolving AI regulatory landscape. Earning AAIR positions you to turn AI risk into a strategic leadership capability.
507 practice questions · Updated 2026-07-30
3Domains
16Objectives
133Concepts
507Questions
AAIR Curriculum
Every domain, objective, and concept the AAIR exam measures.
- AI model types
- AI frameworks
- AI strategies
- AI use cases
- AI model lifecycle
- AI risk landscape
- AI governance integration
- AI Organizational Processes
- Alignment of AI Processes
- Integration with Governance
- Roles and Responsibilities
- Process Lifecycle Management
- Continuous Improvement
- Define AI ownership
- Establish AI oversight structures
- Assign AI accountability
- Integrate AI governance with enterprise risk management
- Document AI roles and responsibilities
- Monitor and review AI accountability
- AI Policy Framework
- AI Policy Development
- AI Procedure Design
- Policy-Procedure Integration
- Organizational Training Needs Assessment
- AI Training Program Design
- Training Implementation and Delivery
- Training Effectiveness Evaluation
- Continuous Improvement of AI Training
- Roles and Responsibilities in AI Governance
- Regulatory Landscape Overview
- Compliance Obligations Mapping
- Legal Risk Assessment
- Data Protection and Privacy Compliance
- Transparency and Explainability Requirements
- Human Oversight and Accountability
- Cross-Border Regulatory Considerations
- Regulatory Change Management
- AI Trustworthiness Principles
- Ethical AI Frameworks
- Societal Impact Assessment
- ESG Integration in AI
- Governance Alignment
- AI Design Principles
- Development Life Cycle
- Procurement Considerations
- Documentation Requirements
- Risk Identification in Design
- Risk Management in Development
- Procurement Risk Assessment
- Documentation for Compliance
- Stakeholder Communication
- Model Training Fundamentals
- Overfitting and Underfitting
- Bias and Variance Trade-off
- Training, Validation, and Test Sets
- Cross-Validation Techniques
- Model Testing Strategies
- Model Validation Approaches
- Performance Metrics
- Adversarial Testing
- Bias and Fairness Testing
- Documentation and Audit Trails
- Risk Identification in Training and Testing
- AI Implementation Planning
- AI System Deployment
- AI Model Validation and Verification
- AI System Monitoring and Maintenance
- AI System Update and Versioning
- AI System Decommissioning Planning
- AI System Decommissioning Execution
- Post-Decommissioning Review
- Data Life Cycle Stages
- Data Quality Management
- Data Lineage and Provenance
- Data Classification and Sensitivity
- Data Governance Frameworks
- Data Privacy and Protection
- Data Storage and Retention
- Data Access and Sharing Controls
- Data Bias and Fairness Considerations
- Data Security Risk Assessment
- Data Compliance and Regulatory Requirements
- Data Asset Inventory and Cataloging
- Data Life Cycle Risk Monitoring
- Threat Identification
- Vulnerability Assessment
- Attack Vector Analysis
- Risk Scenario Development
- Scenario Impact Evaluation
- Scenario Likelihood Estimation
- Risk Prioritization
- Scenario Documentation
- Risk Treatment Options
- Risk Treatment Selection Criteria
- Implementation of Risk Treatments
- Residual Risk Assessment
- Monitoring and Review of Treatments
- Documentation and Communication
- AI Control Evaluation Criteria
- AI Control Selection Process
- AI Control Validation Methods
- Control Integration with AI Lifecycle
- Control Documentation and Communication
- Continuous Control Improvement
- Define AI risk metrics
- Align metrics with risk appetite
- Establish monitoring processes
- Implement monitoring tools and automation
- Develop reporting frameworks
- Tailor reports to audience
- Ensure data quality and integrity
- Review and update metrics
- Integrate with enterprise risk management
- Document and communicate findings
- Identify AI supply chain components
- Assess third-party AI risks
- Apply supply chain risk frameworks
- Perform due diligence on AI vendors
- Establish contractual risk controls
- Monitor and manage ongoing third-party risks
- Address data provenance and lineage
- Mitigate model and algorithm risks from third parties
- Ensure compliance with regulations
- Develop incident response for supply chain failures
- AI Incident Response Lifecycle
- AI-Specific Incident Types
- Incident Response Roles and Responsibilities
- Business Impact Analysis (BIA) for AI
- AI System Criticality and Dependencies
- Business Continuity Planning for AI
- Disaster Recovery Strategies for AI
- Testing and Exercising AI Continuity Plans
- Integration with Organizational Resilience
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for AAIR, so none is invented.