AAIA Requirements: Full Eligibility Guide and Prerequisites

You've found the list. CISA, CIA, a handful of CPA designations. You hold one of them. You still aren't sure you qualify, because the fine print says "with an IT audit or IT advisory role focus," and nobody tells you what that means in practice.

That's the gap this guide fills. Not just the list of what qualifies, but what the qualifiers on that list require of your day-to-day work, whether you need separate years of experience on top of the credential, and what your fastest path looks like if you don't hold any of these yet.

What Are the AAIA Requirements?

You need one active credential from ISACA's approved list. Holding CISA qualifies you on its own, with no additional conditions attached. Every other qualifying credential comes with one extra condition: your role needs an IT audit or IT advisory focus.

How to Become Certified

Qualifying is step one. Passing the exam isn't the finish line either; there's a short process after.

You have five years from your exam pass date to complete this process. Miss that window, and you'd need to pass the exam again.

Looking for some exam prep guidance and mentoring?

---

Learn about our personal mentoring

1-on-1 Personal Mentoring

Does Your Role Count as "IT Audit or IT Advisory"?

ISACA doesn't define this phrase anywhere in its public materials. It appears identically across every official AAIA page, with no further breakdown, no examples, no rubric. That's not an oversight you can research around; it's genuinely left to interpretation.

Here's a reasonable way to think about it, offered as a practical read rather than ISACA's own stated criteria: the question is what your role does day-to-day, not just what credential you hold. A CPA whose day-to-day work is IT audit, systems control testing, or technology risk advisory clearly fits the spirit of the requirement. A CPA doing tax preparation or general financial statement audit, with no IT-specific component, is a much harder case to make, even though the credential itself is identical on paper.

If your role sits somewhere in between, honest self-assessment matters more than parsing the wording further. ISACA reviews applications individually, so the safest approach is describing your actual responsibilities plainly when you apply rather than assuming the credential alone settles the question. A useful gut check: if your work already touches the kind of governance and risk vocabulary in NIST's AI Risk Management Framework, your role focus is probably closer than you think.

Do You Need Separate Work Experience for AAIA?

No, and this is one of the more commonly confused points. AAIA has no independent years-of-experience requirement of its own. The experience requirement lives entirely in whichever prerequisite credential you're using to qualify: CISA's own experience requirement, your CPA licensure, or your CIA credential's requirements. Once you hold one of those active, AAIA itself asks nothing further on the experience front beyond passing the exam and completing the application steps.

Credential-by-Credential Notes

A few of the qualifying designations are worth a specific note:

US CPA, Canadian CPA, Australian CPA/FCPA, Japanese CPA. All are licensed accounting credentials issued by their respective national or regional bodies, not by ISACA. Your license needs to be active and in good standing, the same bar ISACA applies to CISA itself.

ACCA and FCCA. These come from the UK-based Association of Chartered Certified Accountants and are recognized globally, not just in the UK, so a CPA-equivalent credential from a different jurisdiction than the ones explicitly named on ISACA's list is worth checking against ACCA's own recognition agreements before assuming it doesn't qualify.

ICAEW ACA and FCA, CA/FCA (Australia and New Zealand), Hong Kong CPA/FCPA, CNA (Nigeria). These regional chartered accountant designations round out the list, each issued by its own national institute. The same role-focus condition applies to every one of them.

What If You Don't Have Any of These Yet?

Your timeline is bounded by whichever qualifying credential is fastest for you to earn, and none of them are quick. CISA, the most direct route since it's the only one that qualifies without the role-focus condition attached, still requires five years of professional information systems auditing, control, or security experience, though up to three years of that can be waived through specific education substitutions, bringing the realistic minimum closer to two years for some candidates.

If you're starting from zero, AAIA isn't a near-term option. It's a credential you plan toward once you're already on the path to CISA, CIA, or one of the CPA designations, not something to pursue in parallel with an entry-level career. That said, the broader push toward credentialed AI skills isn't slowing down; the World Economic Forum's own research on the AI and digital skills gap suggests the wait is worth planning for, not avoiding.

Frequently Asked Questions

Your Eligibility Is Just the First Step

What qualifies, what the vague "role focus" wording means in practice, and the fact that AAIA itself asks nothing about experience beyond the credential you're already using to get in the door are all settled now. If you've confirmed you qualify, the only real question left is how you want to prepare.

Once you've confirmed you qualify, preparation is the only thing left to plan. A workbook, exam strategy videos, a 90-question practice test, and a student Discord and email support to lean on while you study, that's what DestCert's AAIA MasterClass gives you.