The ISACA AAIA Cheat Sheet You Can Read the Night Before

You've studied the official materials, taken practice tests, and reviewed the ISACA AAIA exam guide. But the night before the exam, you need a concise, high-yield refresher that hits the most important points without overwhelming you. This cheat sheet is designed for exactly that—a quick scan of domain weights, must-know concepts, and common traps to avoid.

Exam Overview

The ISACA AAIA (Associate AI Auditor) exam tests your understanding of AI auditing principles, governance, risk, and controls. It's a 2-hour exam with 100 questions, and you need a score of 450 out of 800 to pass. The exam is available in multiple languages and can be taken at PSI testing centers or remotely. Looking for more detail? See How to Pass ISACA AAIA on Your First Attempt.

Here's the domain breakdown with percentage weights:

• Domain 1: AI Fundamentals (24%) – 24 questions
• Domain 2: AI Governance and Ethics (21%) – 21 questions
• Domain 3: AI Risk Management (25%) – 25 questions
• Domain 4: AI Audit Process (30%) – 30 questions

Note: Weights are approximate; ISACA may adjust them slightly. Focus your study time proportionally—Domain 4 deserves the most attention.

A free AAIA study plan can turn those domain weights into a week-by-week schedule that fits your available time.

Domain 1: AI Fundamentals (24%)

This domain covers the basics of AI, machine learning, and data science concepts. You need to understand the terminology and how AI systems work. This topic pairs well with CompTIA SecAI+ or ISACA AAIA? A Straight Comparison for 2026.

Must-Know Concepts

• AI vs. Machine Learning vs. Deep Learning: AI is the broad field; ML is a subset where systems learn from data; DL uses neural networks with multiple layers.
• Supervised vs. Unsupervised vs. Reinforcement Learning: Supervised uses labeled data (e.g., classification, regression); unsupervised finds patterns in unlabeled data (e.g., clustering); reinforcement learning uses rewards and penalties.
• Common Algorithms: Linear regression, logistic regression, decision trees, random forests, SVM, k-means, neural networks.
• Data Types: Structured (tabular), unstructured (text, images, audio), and semi-structured (JSON, XML).
• Model Training and Testing: Training set, validation set, test set; overfitting and underfitting.
• Key Performance Metrics: Accuracy, precision, recall, F1-score, ROC-AUC.

Common Traps

• Confusing precision and recall: Precision = TP/(TP+FP) (how many selected items are relevant); Recall = TP/(TP+FN) (how many relevant items are selected).
• Thinking that unsupervised learning uses labeled data—it doesn't.
• Assuming that deep learning is always the best choice—for small datasets, simpler models may perform better.

Domain 2: AI Governance and Ethics (21%)

This domain focuses on the governance structures, ethical considerations, and regulatory requirements for AI.

Must-Know Concepts

• AI Governance Framework: A structure that aligns AI initiatives with organizational objectives, ensures accountability, and manages risks.
• Key Regulations: GDPR (data protection), EU AI Act (risk-based classification), NIST AI Risk Management Framework (voluntary but widely adopted).
• Ethical Principles: Transparency, fairness, accountability, privacy, and non-maleficence (do no harm).
• Bias and Fairness: Types of bias (data bias, algorithmic bias, societal bias); techniques to mitigate bias (diverse datasets, fairness metrics).
• Explainability and Interpretability: The ability to explain AI decisions in human terms; LIME and SHAP are common techniques.
• Roles and Responsibilities: AI governance committee, data scientists, auditors, legal/compliance.

Common Traps

• Assuming that GDPR only applies to EU citizens—it applies to any organization processing data of EU residents.
• Thinking that explainability is only for high-risk AI—best practice is to strive for it whenever possible.
• Overlooking the importance of documentation and record-keeping for AI governance.

Domain 3: AI Risk Management (25%)

This domain covers identifying, assessing, and mitigating risks associated with AI systems.

Must-Know Concepts

• Risk Management Process: Identify, assess, respond, monitor, and communicate risks.
• AI-Specific Risks: Model drift, adversarial attacks, data poisoning, privacy breaches, and unintended consequences.
• Risk Assessment Methods: Qualitative (e.g., likelihood/impact matrix) and quantitative (e.g., annualized loss expectancy).
• Controls: Preventive (e.g., input validation), detective (e.g., monitoring), and corrective (e.g., rollback plans).
• Residual vs. Inherent Risk: Inherent risk is before controls; residual risk is after controls.
• Third-Party Risk: When using AI vendors, assess their security and compliance posture.

Common Traps

• Confusing inherent and residual risk—remember inherent is before controls.
• Ignoring model drift—models degrade over time; regular monitoring is essential.
• Thinking that risk management is a one-time activity—it's continuous.

Domain 4: AI Audit Process (30%)

This domain is the largest and most critical. It covers the entire audit lifecycle from planning to reporting. Our post on CISM Passing Score: The ISACA 450/800 Threshold Unpacked covers this further.

Must-Know Concepts

• Audit Planning: Understand the business context, define objectives, scope, and criteria. Consider the AI system's purpose, data sources, and stakeholders.
• Audit Evidence: Collect sufficient, reliable, and relevant evidence. Techniques include inspection, observation, inquiry, and analytical procedures.
• Audit Sampling: Use statistical or non-statistical sampling to test controls or data.
• Audit Documentation: Create working papers that support conclusions and findings.
• Audit Reporting: Provide clear, concise, and objective findings with recommendations. Include management's response.
• Follow-up: Verify that corrective actions were implemented.

Common Traps

• Relying too much on inquiry—combine with other evidence types.
• Not considering the AI system's entire lifecycle (development, deployment, monitoring).
• Failing to evaluate the reliability of data sources used by the AI.

Final Tips for the Night Before

Don't try to learn new concepts now—just review this cheat sheet and your own notes. Get a good night's sleep, eat a balanced breakfast, and arrive early. During the exam, read each question carefully and eliminate obviously wrong answers. Manage your time: you have about 1.2 minutes per question, so don't get stuck on any single question.

Remember, the AAIA exam is about understanding AI auditing principles, not just memorizing facts. Use your critical thinking skills to apply concepts to scenarios. You've prepared well, so trust yourself.

If you want a quick check of weak topics before test day, use the free AAIA readiness check.

Sharpen your readiness with ISACA Advanced in AI Audit (AAIA) mock test and walk into test day knowing exactly where you stand.