AAIA Advanced in AI Audit.

What the AAIA credential is for

Advanced in AI Audit (AAIA) is an ISACA credential built for experienced auditors who need to extend their practice to artificial intelligence. It is a recent addition to the ISACA portfolio, introduced as AI moved from pilot projects into production systems that boards, regulators and customers now expect to be assured. The premise is narrow and deliberate: it assumes you already know how to audit. AAIA does not re-teach the audit process. It teaches you how to apply audit discipline to AI systems, the models behind them and the governance wrapped around them.

That focus is why AAIA is positioned as advanced rather than entry level. It speaks to auditors who already hold an audit credential and a working command of controls, evidence and reporting, and who now have to answer questions a traditional IT audit was never designed to ask. Is the training data fit for purpose? Can the model's behaviour be explained? Is there meaningful human oversight where the system makes consequential decisions? Is the AI used only for its declared purpose? These are the gaps AAIA is meant to close.

Prerequisites and where it sits

AAIA is designed to build on an existing audit foundation rather than to stand alone. ISACA positions it for senior auditors, and in practice candidates are expected to hold CISA or an equivalent recognised audit credential before taking it on. The logic is the same one ISACA applies across its advanced offerings: the certification adds a specialism on top of a proven base, it does not replace that base. An auditor who has never run an engagement will get little from AAIA, while a seasoned CISA holder gets a structured way to make AI engagements defensible.

How it maps to ISO 42001 and the EU AI Act

What makes AAIA practical rather than academic is that it is grounded in the frameworks auditors are now being asked to test against. It maps onto ISO/IEC 42001, the management system standard for AI, which gives an auditor a recognised control structure for AI governance: accountability, data quality, transparency, human oversight and impact assessment. It also aligns with the obligations the EU AI Act places on high-risk systems, where providers must operate a risk management system, maintain technical documentation, ensure human oversight and run post-market monitoring. AAIA equips an auditor to gather evidence against exactly those expectations.

This is where AAIA differs from a general AI governance qualification. A governance certificate teaches you to design and run an AI management system. AAIA teaches you to independently assess one: to plan an AI audit, scope it around intended purpose and risk, test the controls, evaluate the evidence and report findings that a board or regulator can act on. It is the assurance counterpart to the build-and-operate skills that frameworks like ISO 42001 install.

What AAIA-holders actually do

In practice, an auditor with AAIA capability tends to work through a recognisable sequence on an AI engagement:

1. Scope the audit around the AI system's intended purpose, its risk classification and the organisation's role as developer, provider or deployer.
2. Assess the governance: whether accountability is assigned, whether AI risk and impact assessments exist, and whether they are kept current.
3. Test the controls that matter for AI, including data governance, model documentation, transparency to affected users and human oversight.
4. Evaluate post-deployment monitoring, incident handling and the feedback loop that keeps the system within its declared bounds.
5. Report findings in audit language that maps cleanly to ISO 42001 controls and AI Act obligations, so the organisation can close gaps with evidence.

The value to an organisation is independence. An AI governance team can attest that controls exist; an AAIA-equipped auditor can provide the third-party-style assurance that those controls actually work, which is increasingly what regulators, enterprise buyers and procurement functions ask to see.