IICTI Certified AI Auditor

Holders demonstrate that they can apply and evaluate aI audit frameworks, criteria and regulatory landscape, risk-based AI audit planning, scoping and evidence, auditing AI management systems and governance and training data provenance, quality and lineage audit, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for AI Auditor.

Who it is for: Professionals working, or preparing to work, in artificial intelligence roles.

1. 01AI audit frameworks, criteria and regulatory landscape8% of the exam

   • Evaluate which legal and normative criteria apply to an AI system and derive auditable control objectives from them.
   • Scope: EU AI Act risk tiers and obligations, ISO/IEC 42001 and ISO/IEC 42006, NIST AI RMF and GenAI profile, ISO/IEC 23894, IIA AI auditing framework, sectoral model risk rules (SR 11-7).
2. 02Risk-based AI audit planning, scoping and evidence13% of the exam

   • Design a risk-based AI audit plan with defensible scope, criteria and evidence strategy.
   • Scope: AI system inventories, risk-based scoping, materiality, audit universe, sampling of models and decisions, evidence sufficiency, ISO 19011 and ISAE 3000 assurance engagement principles.
3. 03Auditing AI management systems and governance8% of the exam

   • Evaluate the design and operating effectiveness of an organisation's AI governance and management system.
   • Scope: ISO/IEC 42001 clauses and Annex A controls, AI policies and roles, AI impact assessment (ISO/IEC 42005), lifecycle governance, third-party and foundation-model supplier oversight.
4. 04Training data provenance, quality and lineage audit7% of the exam

   • Assess whether training and evaluation data are lawful, traceable and fit for the AI system's intended purpose.
   • Scope: Data provenance and consent, licensing and copyright, ISO/IEC 5259 data quality, representativeness and sampling bias, data poisoning risk, datasheets and lineage evidence.
5. 05Model validation, performance and robustness testing7% of the exam

   • Evaluate model validation evidence and challenge whether performance claims hold under realistic conditions.
   • Scope: Independent validation, metric selection and thresholds, out-of-distribution and drift testing, adversarial robustness, uncertainty and calibration, reproducibility of training and evaluation.
6. 06Fairness, bias and non-discrimination assessment9% of the exam

   • Assess AI outcomes for unjustified bias and evaluate the adequacy of mitigation and monitoring.
   • Scope: Fairness metrics and their incompatibilities, protected attributes and proxies, disparate impact testing, intersectional analysis, mitigation techniques and legal non-discrimination standards.
7. 07Transparency, explainability and human oversight14% of the exam

   • Evaluate whether transparency and human oversight measures are meaningful and effective for affected users.
   • Scope: Model cards and system cards, SHAP/LIME and counterfactual explanations, explanation fidelity, user disclosure duties, human-in-the-loop design, automation bias and override effectiveness.
8. 08Generative AI and LLM system assurance7% of the exam

   • Assess the risk controls and evaluation evidence of generative AI and LLM-based systems, including agentic deployments.
   • Scope: Hallucination and groundedness evaluation, RAG and agent tool-use risks, prompt injection and jailbreak resistance, red-teaming governance, content provenance (C2PA), OWASP Top 10 for LLM applications.
9. 09AI security and privacy controls audit7% of the exam

   • Evaluate security and privacy controls protecting AI models, pipelines and personal data across the lifecycle.
   • Scope: MITRE ATLAS, model extraction and inversion, membership inference, secure MLOps pipelines, model and artefact integrity, AI SBOM, privacy-preserving ML and GDPR automated decision rules.
10. 10MLOps, change control and post-deployment monitoring audit7% of the exam

    • Assess whether AI change management and production monitoring keep systems within approved risk boundaries.
    • Scope: Model registries and versioning, deployment approvals, CI/CD for ML, drift and performance monitoring, incident logging, post-market monitoring and serious incident reporting under the EU AI Act.
11. 11Conformity assessment, AI audit reporting and opinions13% of the exam

    • Lead the formation of audit conclusions and communicate defensible findings and opinions to boards and regulators.
    • Scope: EU AI Act conformity assessment and technical documentation (Annex IV), findings rating, root-cause analysis, audit opinions and limitations, auditor independence, competence and ethics.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner