ISACA offers AI audit credential

IT auditors who know a lot about artificial intelligence can now show it through a new certification, as the ISACA — the organization behind credentials like CISA and CISM — now offers an AAIA, or "Advanced in AI Audit," credential. The certification demonstrates that an IT audit professional can navigate the complexities of AI and has the skills to respond to risks, identify opportunities and ensure compliance while safeguarding organizational integrity. Overall, it validates expertise in conducting AI-focused audits, addressing AI integration challenges, and enhancing audit processes through AI-driven insights.

The credential requires knowledge of a wide range of AI-related audit skills, proven through an exam scheduled through ISACA. Only those with an active CISA from ISACA, CIA from the IIA, or CPA from the AICPA are eligible to pursue the AAIA, which covers the key domains of AI governance and risk, AI operations, AI auditing tools and techniques.

Chiefly, professionals must demonstrate "AI operations" skills that concern balancing sustainability, operational readiness and the risk profile with the benefits and innovation AI promises to support enterprise-wide adoption of this powerful technology. This includes AI-specific data management, AI solution lifecycle management, AI-specific change management, supervision of AI solutions (especially agents), testing techniques for AI solutions, AI-specific threats and vulnerabilities, and AI-specific incidence response management. 

The next largest area of focus is "AI governance and risk," which is mainly concerned with advising stakeholders on implementing AI solutions through appropriate and effective policy, risk controls, data governance and ethical standards. This encompasses general knowledge of AI and its business impacts, AI governance and program management, AI risk management, data and data governance programs, and how AI fits into standards frameworks and professional ethics. 

After that is "AI auditing tools and techniques," which focuses on optimizing audit outcomes for innovation and highlights the professional's knowledge of audit techniques tailored to AI systems and the use of AI-enabled tools to streamline audit efficiency and provide faster, quality insights. This includes audit planning and design, testing and sampling methodologies, evidence collection techniques, data quality and analytics, outputs and reports, all specific to AI. 

There are a number of task-based secondary classifications, such as "utilize AI solutions to enhance audit processes, including planning, execution and reporting" and "evaluate algorithms and models to ensure AI solutions are aligned to business objectives, policies and procedures."

"ISACA is proud to have served the global audit community for more than 55 years through our audit and assurance standards, frameworks and certifications, and we are continuing to help the community evolve and thrive with the certifications and training they need in this new era of audits involving AI," said Shannon Donahue, ISACA chief content and publishing officer. "Through AAIA, auditors can demonstrate their expertise and trusted advisory skills in navigating AI-driven challenges while upholding the highest industry standards."

As AI becomes increasingly integrated into the world economy, a number of standard-setting and certification bodies have responded to rising concerns about the impact the technology can have on business and the economy as a whole. The National Institute of Standards and Technology released its AI Risk Management framework at the beginning of 2023. The following year, the International Organization for Standardization released ISO 42001, which specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organization. ISACA says this is the first advanced AI audit certification in the world, developed in response to rising concerns about the black box nature of many AI models which, in turn, has driven calls for more oversight by audit and assurance professionals over the technology's internal structures.