Advanced in AI Risk - AAIR
ISACA Services and Tool Selection
Practice choosing the right provider service, product, workflow, or control for a scenario.
Official Scope and Verification
This lesson is mapped to the verified Advanced in AI Risk - AAIR outline. Official sources and public status were rechecked on 2026-07-13. Provider pages remain authoritative for late-breaking blueprint, availability, scheduling, price, language, delivery, and retake changes.
Current ISACA AAIR certification with official domain percentages, subtopics, and other skills tested.
Official Objectives Emphasized Here
| Domain or objective area | Published weight | Key objective groups | Official source |
|---|---|---|---|
| Other Skills Tested | Published without a scored percentage | Evaluate risk related to AI models and solutions including design, suitability, algorithms, training, drift, and AI life cycle; Facilitate integration of AI risk management into an enterprise risk management framework and risk programs; Develop and implement an AI risk management framework, including roles, accountability, policies, procedures, and risk tolerance; Conduct risk assessments to identify and classify risks associated with AI; Develop and recommend risk treatment strategies for identified AI risks; Assess compliance with applicable AI-related regulations, laws, frameworks, standards, and guidelines; Integrate AI risk considerations into existing governance programs; Integrate AI risk considerations into existing risk register and control taxonomies; Evaluate AI use cases based on the organization's risk appetite; Monitor and test organizational processes to identify AI risks; Collaborate with stakeholders to develop and integrate AI risk concepts into enterprise-wide awareness training; Capture AI risk considerations in enterprise risk metrics and reporting, including board, management, and operations reporting; Conduct or evaluate threat and vulnerability assessments on AI projects and programs; Collaborate with stakeholders to integrate AI risk scenarios into the enterprise incident management program; Continuously assess and monitor the risk landscape for emerging AI risk; Evaluate controls to manage AI-related risk within the organization's risk tolerance; Advise on AI-related risk within contracts and service agreements, including data usage and intellectual property; Evaluate AI risk as part of supply chain risk management; Collaborate with stakeholders to address AI trustworthiness and impacts including ethics, bias, privacy, safety, and environmental, social, and governance implications; Leverage AI to support the risk management program, including risk profile, reporting, evaluation, risk models, and analysis; Integrate AI-related risk considerations into the change management process; Incorporate AI-related risk considerations into incident response, BIAs, the BCP, and DRP; Assess human oversight controls at critical decision points for risk and AI impact | ISACA official AAIR exam content outline |
Authoritative Sources for This Scope
- ISACA official AAIR exam content outline - Official source; accessed 2026-07-13.
Service and tool selection is where learners often confuse adjacent options. A scenario usually gives you enough information to reject attractive but oversized answers. Your job is to match it to the simplest ISACA capability, workflow, or control that satisfies the requirements.
Selection Framework
| Scenario cue | What it usually tests | How to decide |
|---|---|---|
| Need a quick business outcome | Managed service, course workflow, or configured feature. | Prefer the provider feature that already solves the task with less custom build effort. |
| Need current internal knowledge | Retrieval, search, grounding, data governance, or knowledge management. | Choose a pattern that reads approved sources at response time and preserves access rules. |
| Need custom predictive behavior | ML workflow, features, training data, experiment tracking, or model serving. | Verify that the prompt actually requires custom training rather than a prebuilt model or service. |
| Need automation or actions | Agent, workflow, tool call, integration, approval, or orchestration pattern. | Check permissions, rollback, human review, and what the agent is allowed to do. |
| Need trust, compliance, or auditability | Governance, logs, policy, identity, risk assessment, or monitoring. | A model choice alone is not enough; select the control that creates evidence and accountability. |
Study Sources And Tested Capability Areas
Use this provider-specific lens while studying Advanced in AI Risk - AAIR: Select the audit, risk, or security management action that produces evidence and reduces AI system risk.
- AI audit planning: write one sentence explaining what problem it addresses and one sentence explaining a scenario where it would not be enough.
- risk registers: write one sentence explaining what problem it addresses and one sentence explaining a scenario where it would not be enough.
- control testing: write one sentence explaining what problem it addresses and one sentence explaining a scenario where it would not be enough.
- security management: write one sentence explaining what problem it addresses and one sentence explaining a scenario where it would not be enough.
- evidence collection: write one sentence explaining what problem it addresses and one sentence explaining a scenario where it would not be enough.
- assurance reporting: write one sentence explaining what problem it addresses and one sentence explaining a scenario where it would not be enough.
Track-Specific Selection Cues
- Read the exact credential title first. Many AI credentials are role-based, so the same AI concept can be tested differently for an engineer, architect, auditor, business leader, teacher, or administrator.
- Translate every objective into a real scenario with a user, data source, risk constraint, and expected output.
- Separate durable AI principles from provider product names so you can still reason when a product name changes.
- Use an AI system inventory, risk classification, control mapping, evidence collection, and monitoring plan.
- Connect AI risks to data protection, transparency, accountability, vendor management, incident response, and change control.
- Study NIST AI RMF and OWASP GenAI Security as general references, then map them to the credential provider objectives.
Common Distractor Patterns
- Too custom: selecting model training, code, or infrastructure when the scenario asks for a managed feature or course workflow.
- Too generic: choosing a general AI answer that does not match the provider capability or credential role.
- Too unsafe: ignoring identity, data protection, approval, or audit requirements.
- Too expensive: selecting a high-complexity approach when a simpler service, workflow, or retrieval pattern satisfies the requirement.
- Too narrow: solving the model task but ignoring ingestion, governance, monitoring, or user adoption.
Worked Example
Scenario: An organization deploys an AI decision aid. The governance answer should identify owner, purpose, data, risk level, controls, evidence, monitoring, and appeal or review path.
Good answer behavior: identify the workflow stage first, then choose the ISACA capability that fits the role, data, and risk constraints.
Bad answer behavior: Treating governance as a policy document instead of operational controls with evidence.
Self-Learner Drill
- Create a table with columns for requirement, likely provider feature, why it fits, and common distractor.
- Add at least ten rows from official examples, course demos, credential objectives, or documentation pages.
- Cover at least one row each for data ingestion, GenAI output, search or retrieval, workflow automation, security, monitoring, and cost.
- Review the table before mixed quizzes. If two tools seem interchangeable, write the constraint that separates them.
Useful Links
- ISACA Credentialing - Official ISACA credential catalog.
- ISACA Advanced in AI Audit - Official AAIA credential page.
- ISACA Advanced in AI Risk - Official AAIR credential page.
- ISACA Advanced in AI Security Management - Official AAISM credential page.