This course contains the use of artificial intelligence.

AI systems are being deployed faster than anyone can audit them — and auditors are being asked to sign off on systems they were never trained to evaluate.

This course prepares you for ISACA's Advanced in AI Audit (AAIA) certification, and more importantly, prepares you to actually do the work. You will learn to assess AI governance structures, build AI-specific risk registers, test models for bias, evaluate MLOps controls, investigate AI incidents, and write findings that survive management challenge.

You will learn by auditing a company, not by watching slides

Every concept in this course is applied to MediTrust AI Inc., a fictional healthcare AI company operating six AI systems across a four-hospital health system — radiology diagnostics, clinical NLP, revenue cycle, clinical trial matching, workforce scheduling, and pharmacovigilance.

The story starts where real AI audit programs usually start: with an incident. A regulatory inspection found that MediTrust's radiology AI showed a 23% higher false-negative rate for Black patients in mammography screening. The board has mandated a comprehensive AI audit program. You are the lead AI auditor, reporting to the VP of Internal Audit, and you are building that program from nothing.

You will meet the Chief AI Officer who thinks governance slows down work that saves lives, the privacy officer drowning in assessments, and the ethics lead whose reviews carry no authority. These are the people you will actually have to audit.

What is covered

All three AAIA exam domains, weighted the way the exam weights them:

Domain 1 — AI Governance, Risk and Compliance (33%): AI and machine learning fundamentals for auditors, governance frameworks (COBIT 2019, NIST AI RMF, ISO/IEC 42001), AI risk identification and treatment, privacy and data governance, the EU AI Act, and the global regulatory landscape.
Domain 2 — AI Development, Implementation and Use (46%): Training data quality and lineage, the AI/ML development lifecycle, MLOps and change management, human oversight models, model drift detection, explainability, bias and fairness testing, AI security threats, prompt injection and GenAI vulnerabilities, and AI incident response.
Domain 3 — AI Auditing Tools and Techniques (21%): Audit planning and scoping, designing audit programs, sampling, evidence collection and evaluation, data analytics, writing findings, and board-level reporting.

How this course is different

Most AI courses hand you generated output and call it practice. This one does not. In the hands-on labs, you produce the audit deliverable and the AI reviews your work — scoring your risk register, challenging your severity ratings, and telling you which claims your evidence does not support.

In other labs the AI plays the auditee: you write the interview questions, and a defensive Chief AI Officer answers them narrowly, redirects, and offers metrics that sound reassuring. Your job is to notice. In others still, the AI produces a deliberately flawed bias audit report or vulnerability assessment, and you have to find what is wrong with it.

That design is deliberate. A course that teaches you to independently verify AI output should not be handing you unverified AI output and calling it an answer.

What you get

80 video lectures (7.3 hours) covering every AAIA exam topic, weighted to the published domain split
A 94-question practice exam with full explanations for every option, weighted to the real exam blueprint
11 section quizzes with scenario-based questions
7 graded assignments building a complete audit file — gap analysis, EU AI Act classification, bias audit report, audit plan, and a capstone board presentation
5 role play scenarios including a risk committee briefing and an AI Audit Manager job interview
Full English captions on every lecture

Who should take this

This is an advanced course. ISACA requires CISA, CIA, CPA or an equivalent audit credential before you can sit the AAIA exam, and this course assumes you already understand audit fundamentals — evidence, sampling, professional skepticism, and reporting. It does not assume any machine learning background. Every technical concept is built from the ground up for auditors.

If you are an IT auditor, internal auditor, risk or compliance professional, or a security professional moving into AI assurance, this course is built for you.

This course is an independent training product. It is not affiliated with, authorized by, endorsed by, or sponsored by ISACA. AAIA, CISA, CIA, CRISC and COBIT are trademarks or registered trademarks of ISACA. Exam content, format, and requirements are set by ISACA and may change — always confirm current details on ISACA's official website.