Specialty · Specialty exam
AI Audit
Verifies the ability to define the scope of an organization's AI usage for audit, evaluate controls, test using evidence and samples, and identify and report model and data risks.
Daily practice · Free
10 questions · 25 min · No sign-up needed
Specialty exam · Proctored
35 questions · 60 min · Raw score of 75 or more · $3.99 / one attempt
Specialty exam detailsExam overview
- Questions
- 35
- Time
- 60 min
- Pass mark
- 75 pts
- Recommended experience
- White Belt (AI Basics) level and practical experience in audit and internal controls
Every question has five choices and is marked on an OMR answer sheet. Multiple-choice and true-or-false questions ask for the right combination from a box; ordering and matching questions ask for the right arrangement. Judgment questions (L3) are worth 3 points and all others 2; the raw score is converted to a 100-point scale and graded 1 to 9.
Exam domains
1. Audit Planning, Scoping, and AI Inventory20%
2. Control Design and Operating Effectiveness20%
3. Evidence Collection, Testing, and Sampling25%
4. Model and Data Risk Verification20%
5. Reporting and Follow-up15%
Weights follow the Specialty exam. Practice and mock exams may mix domains differently.
What this exam verifies
- Build an AI inventory and determine a risk-based audit scope
- Evaluate the design and operating effectiveness of AI-related controls
- Collect evidence from AI systems and design testing samples
- Verify model and data risks (accuracy, bias, change management)
- Report audit findings and track follow-up actions
Who it is for
- Internal and external auditors incorporating AI systems into their audit scope
- Risk and compliance professionals designing and reviewing AI controls
- Audit committee support staff receiving AI governance reporting
Does not cover general financial statement audits, expressing audit opinions, or directly developing and fine-tuning models.
Domain details
Domain 1. Audit Planning, Scoping, and AI Inventory
- Knowledge: AI inventory and usage tracking, Risk-based scoping, Shadow AI identification, Regulatory and standards mapping (Framework Act on Artificial Intelligence, NIST AI RMF, ISO/IEC 42001), Audit engagement types (assurance vs. advisory) and objectivity, Relying on specialists and prior audit results
- Skills: Identifying gaps in an AI inventory, Determining audit targets and testing depth based on risk
Domain 2. Control Design and Operating Effectiveness
- Knowledge: Human review controls and superficial approvals, Access and change management controls, Vendor management controls and service organization reports, Automated controls and baselines, Differences between design evaluation and operating effectiveness testing
- Skills: Distinguishing design deficiencies from operating exceptions, Selecting tests to detect superficial human reviews
Domain 3. Evidence Collection, Testing, and Sampling
- Knowledge: Sufficiency and appropriateness of audit evidence, Sampling methods and sample sizes, Logs and reproducibility, Accuracy and completeness of information produced by the entity (IPE), Reliability of AI-generated evidence (auditee AI summaries, auditor AI tools)
- Skills: Designing samples aligned with audit objectives, Reperforming control operations using AI output logs
Domain 4. Model and Data Risk Verification
- Knowledge: Accuracy and error rate metrics and baselines, Bias and subgroup performance, Data lineage and data quality, Model changes, drift, and re-validation
- Skills: Validating model performance claims against evidence, Determining when post-change re-validation is required
Domain 5. Reporting and Follow-up
- Knowledge: Audit findings structure: criteria, condition, cause, and effect, Risk ratings and prioritization, Management responses and remediation deadlines, Follow-up audits
- Skills: Drafting evidence-backed audit findings reports, Verifying completion of corrective actions with evidence
Official documentation
PCAOB
U.S. GAO
Specialty Course · AI Audit
Practice, mock exams and every course book are free. Pay only when you take an official test.