AIAC-07 · Assurance track
For internal and IT audit functions that must plan, execute, and report an audit of an AI system, and stand behind the finding.
§ 1 — Intended candidates
Internal auditors, IT auditors, third-line assurance functions, and external audit teams extending into AI.
§ 2 — Examination domains
Domain weightings are published with the full syllabus ahead of the first cohort.
Converting "audit our AI" into an executable scope with defined criteria, boundary, and period.
What constitutes sufficient appropriate evidence for an AI control, and when a management assertion is not it.
Sampling, reperformance, and challenge testing applied to systems whose behaviour is probabilistic.
Documenting an AI audit so another auditor could reach the same conclusion from the same file.
Grading AI findings proportionately, and tracking remediation on controls that degrade silently.
§ 3 — How to certify
Preparation is optional. Choose whichever route suits how you already work — the examination, the fee, and the marking standard are the same either way.
Register and sit the examination. Suitable for practitioners already working in assurance who want the credential without preparation.
The same examination, bundled with self-paced preparation mapped to the syllabus. Taking it confers no advantage in marking and is never required.
Preparation is optional. The examination is available at the same fee and marked to the same standard whether or not preparation was purchased, and assessors are not told which route a candidate took. How we manage this conflict.
§ 4 — Assessment
Scenario-based examination against an audit context supplied at the start, requiring an evidence sufficiency assessment and a written finding with a proposed grading.
Successful candidates receive a credential with a unique identifier that any employer can check against the public record. See credential verification.
Curriculum mapping indicates alignment of learning content with published frameworks. It does not constitute endorsement by, or certification under, any standards organization or regulator.
§ 5 — Further reading
Three terms used interchangeably that mean different things, have different outputs, and require different independence. A practitioner-level distinction.
Producing credible, independently reviewable evidence that an AI system works as intended — and how that differs from governance and compliance.
One is a certifiable management system standard, the other a voluntary risk framework. They are not alternatives, and treating them as such is a mistake.