Exam integrity playbook: controls for every AI-era threat

This playbook is for Controllers of Examinations and exam bodies planning remote or hybrid sittings. It pairs each threat with the control that addresses it, then turns the whole thing into a checklist you can run.

Start with identity

Every other control assumes the right person is sitting the exam. Require a photo ID at the start, match it to a live face capture, and re-check presence during the sitting. Proxy candidates are the threat with the highest stakes and the simplest fix.

Match each threat to a control

• AI agents, cheatbots and extensions: detect assistant tools and extensions on the device; lock the exam session.
• Overlay apps and screen manipulation: detect windows drawn over the exam and screen sharing or casting.
• Virtual machines and remote assistance: detect virtualized sessions and remote-control software.
• Multiple devices and people in the room: use camera and audio signals, with environment scans at the start.
• Behavior manipulation: look for patterns over time, not single frames.

Design the paper to resist leaks

Draw questions from a tagged bank and randomize order and options per candidate. Release the paper only at the start of the sitting. A leaked screenshot of one candidate’s paper is then of little use to anyone else.

Put a person on every flag

Automated detection raises flags; trained proctors review them with the evidence and record a decision. Decide in advance who reviews, how quickly, and what counts as a confirmed incident.

Checklist for your next exam cycle

• Before: system checks for every candidate, ID requirements published, question banks tagged and randomized, reviewers scheduled.
• During: identity verified at the start, flags reviewed as they arrive, a support channel open for candidates.
• After: integrity report per candidate, incidents decided by your board, evidence retained for the appeal window.

Want help running it? See Proctoring as a Service and Exam Operations as a Service.