AAISM, AAIA, AAIR or AIGP: pick the one that matches your job.
By Ankush Jain · · 4 min read
Each of these four AI credentials tests a different job, so the quickest way to choose is to ask which of those jobs you already do. Three come from ISACA and one from the IAPP, and they are not four levels of one ladder.
The short version
- AAISM (ISACA Advanced in AI Security Management): you run or advise a security programme and now own AI risk inside it.
- AAIA (ISACA Advanced in AI Audit): you audit or give assurance, and AI systems are now in scope.
- AAIR (ISACA Advanced in AI Risk): you run IT risk and need to recommend a response to AI risk.
- AIGP (IAPP Artificial Intelligence Governance Professional): you set or run AI governance, often from a privacy, legal or policy seat, and you don't hold a security or audit credential yet.
Side by side
Facts below are from the issuers' own pages, checked on 30 October 2026. Fees change; confirm them before you register.
| AAISM | AAIA | AAIR | AIGP | |
|---|---|---|---|---|
| Issuer | ISACA | ISACA | ISACA | IAPP |
| Prerequisite | Active CISM or CISSP (ISACA) | CISA, or another listed designation held by someone in an IT audit or advisory role (ISACA) | One of a listed set, including CISA, CISM, CRISC, CGEIT, CDPSE and CISSP (ISACA) | None listed (IAPP FAQ) |
| Questions | 90 (outline) | 90 (outline) | 90 (outline) | 100 (IAPP FAQ) |
| Domains | Governance and programme management 31%, risk management 31%, technologies and controls 38% | Governance and risk 33%, operations 46%, auditing tools and techniques 21% | Risk governance and framework integration 37%, life cycle risk management 21%, risk programme management 42% | Four domains: foundations of AI governance; laws, standards and frameworks; governing AI development; governing AI deployment and use (Body of Knowledge 2.1) |
| Exam fee, member / non-member | US$459 / US$599 | US$459 / US$599 | US$459 / US$599 | US$649 / US$799 (IAPP store) |
| Pass mark | 450 on a 200–800 scale (candidate guide) | ISACA scaled score | ISACA scaled score | 300 (IAPP FAQ) |
The three ISACA exams share a fee and a 90-question format, so the choice between them comes down to the job you do. AIGP is the only one of the four with no credential prerequisite.
None of these pages gives an Indian-rupee fee. All four are priced in US dollars.
One scenario, four answers
The domain weights tell you what each exam cares about. A single scenario shows it better.
An organisation has put an AI agent into production. It can update customer records. Nobody is listed as its owner, and it runs under a developer's credentials.
- An AAISM question asks what the security manager does first. Getting an accountable owner in place comes first, because access, risk acceptance and monitoring all depend on someone owning the agent's scope. Controls follow.
- An AAIA question asks what the auditor reports and what evidence they need. The missing owner and the shared credentials are findings. The auditor doesn't fix them.
- An AAIR question asks how the risk is assessed and which response to recommend, and whether it sits inside appetite.
- An AIGP question is more likely to ask which policy, law or framework obligation applies, and who in the governance structure decides.
The facts stay the same while the best answer changes with the role. If one of those questions feels like your day job, that's your credential.
AAISM next to CISM
AAISM requires an active CISM or CISSP, so it doesn't replace either. It assumes you already know how to run a security programme and tests whether you can apply that to AI systems: model and data risk, AI-specific controls, and governance of tools your organisation didn't build. If you hold CISM, AAISM extends it. If you hold neither CISM nor CISSP, you can't sit AAISM yet.
Is it worth it?
It depends on your job. If AI risk has landed on your desk as a security, risk or audit lead, the ISACA exam that matches your role will test the decisions you're already being asked to make. If you sit in governance, privacy or legal and don't hold a security or audit credential, AIGP is the one you can sit today.
I passed AAISM in 2026 and built CyberQue, an AAISM practice-exam app with original questions written to ISACA's published outline. They are practice questions, not real exam questions. CyberQue is not affiliated with or endorsed by ISACA or the IAPP. AAISM, AAIA, AAIR, CISM, CISA, CRISC, CGEIT and CDPSE are trademarks of ISACA; AIGP is a trademark of the IAPP; CISSP is a trademark of ISC2.
Further reading: Why I chose to pursue AAISM.