Chapter 1 of 3 · ISACA AAIA
AI Governance and Risk
AI models and requirements, AI governance, AI risk management, privacy and data governance, ethics, regulation and standards.
- 6topics
- 31 minfast track
- 33%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1AI Models, Considerations and RequirementsHow an IT auditor evaluates AI models and requirements: model types, generative AI, agents, business case, architecture fit and…5 min
- 2AI Governance and Program ManagementAuditing AI governance: ownership and accountability, AI policy, AI inventory, committees, three lines, awareness and AI…5 min
- 3AI Risk ManagementAuditing AI risk management: AI risk categories, impact assessments, risk appetite and treatment, vendor and supply chain risk…5 min
- 4Privacy and Data Governance Programs for AIAuditing privacy and data governance for AI: data ownership, lawful basis, minimization, privacy impact assessments, data subject…5 min
- 5AI Ethics and Leading PracticesResponsible AI for auditors: fairness, transparency, accountability, OECD AI Principles, NIST AI RMF and the Generative AI…5 min
- 6AI Regulations and StandardsAuditing AI compliance: EU AI Act tiers, provider and deployer duties, Digital Omnibus dates, fines, and ISO/IEC 42001, 23894 and…6 min
About this chapter
What this chapter covers
AI Governance and Risk is 33% of the ISACA AAIA exam. It tests whether you can advise stakeholders on using AI to meet strategic goals, and evaluate whether the organization has ethical and responsible AI policy, sound governance, managed implementation risk, and leading practice in data governance, privacy and security.
The domain covers AI models, considerations and requirements (1A), AI governance and program management (1B), AI risk management (1C), privacy and data governance programs (1D), and leading practices, ethics, regulations and standards for AI (1E).
The exam has 90 multiple choice questions. Candidates must already hold CISA or an approved audit or accounting designation, so the exam assumes you know general audit practice and adds the AI layer on top.
Questions are written from the IT auditor's viewpoint. You choose what the auditor should evaluate FIRST, which evidence BEST shows a governance control works, or what is the MOST significant gap. The auditor evaluates and recommends; management designs, owns and fixes.
How the topics fit together
Governance sets who owns AI and what the rules are, risk management decides which AI uses are acceptable, and privacy and data governance protect the data that every model depends on. Ethics principles, regulations and standards supply the criteria the auditor measures all of this against.
When an option asks the auditor to approve a model, write the AI policy or accept a risk, it is almost always wrong. The auditor gives assurance and advice; management and the AI owners make the decisions.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA AAIA question bank has 750 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.