Exam security becomes more useful when educators treat it as a chain of evidence rather than a collection of isolated controls.
Identity verification remains fundamental because it establishes who is sitting the assessment. Yet confidence in a high-stakes result depends on more than that first checkpoint. Educators also need to know what conditions applied, which resources were permitted, how the assessment was supervised, what happened when something unusual occurred and whether the resulting evidence still supports the decision attached to the mark.
A stronger model therefore depends less on maximum control and more on continuity between identity, assessment conditions and professional judgement.
Security is stronger when every control answers a question
One challenge to the assumption that tighter supervision always produces stronger integrity comes from research published in Educational Psychology Review. Across four preregistered field studies at an eastern Chinese university familiar with unproctored exams, the comparison of supervised and unsupervised examinations found lower cheating under unproctored conditions.
The value of the finding is not that supervision matters less. Instead, it shows that security measures do not operate independently of culture, assessment design or candidate expectations.
Each control therefore needs a defined purpose.
Identity checks answer who entered the exam. Resource rules define what candidates may use. Supervision provides visibility into whether the intended conditions are being maintained. Incident processes determine what should happen when those conditions change.
Clearer questions make it easier for educators to avoid depending too heavily on a single safeguard simply because it is visible or easy to measure.
Risk should decide how much assurance an exam needs
Security requirements become easier to justify when they are tied to the consequences of the assessment.
An exam used for practice does not require the same assurance as one determining professional competency, progression or qualification. The useful starting point is therefore not a standard security template, but the decision the result will support.
Educators can then work backwards.
Stronger authentication may be warranted where candidate identity carries significant risk. Access conditions become more important when unauthorised resources could materially change what the exam measures. A disputed result with serious consequences may justify clearer incident records and a more formal review pathway.
A risk-based approach keeps security proportionate because every control has a recognisable reason for being there.
It also prevents an exam from accumulating restrictions that add complexity without adding meaningful assurance.
Assessment conditions give monitoring its meaning
Monitoring is only useful when educators have first defined what counts as acceptable activity.
A closed book examination, for example, depends on different conditions from one designed around approved reference material. The same behaviour can therefore mean different things depending on the assessment.
Content security follows the same logic. Some examinations depend on questions remaining confidential before and during delivery. Others may use open materials but place greater emphasis on how candidates interpret or apply them.
Clear conditions make observations easier to interpret. Rather than asking whether behaviour looked unusual, educators can ask whether it affected a condition that mattered to the validity of the assessment.
A clearer distinction between unusual behaviour and meaningful risk helps keep oversight proportionate and reduces the chance that every irregularity is treated as equivalent.
Technology becomes useful after the security model is clear
The practical challenge begins once educators have decided which conditions matter. Identity requirements, access rules, timing, supervision and incident procedures still need to be applied consistently when the exam is actually delivered.
Where the consequences of an unreliable result are greater, the choice of high-stakes exam software can affect how reliably those agreed conditions are carried through from planning into delivery. The technology does not determine the integrity model, but it can help assessment teams apply the controls they have already judged appropriate and retain the evidence needed when exceptions require review.
Professional judgement remains central. Educators decide which risks matter, how much assurance is proportionate and what evidence is sufficient to support confidence in the result.
Assessment design can reduce reliance on monitoring
Generative AI has made the limits of control-based security more visible because knowing who submitted work does not necessarily establish how that work was produced.
The 2025 research, 'The Impact of Generative AI on Academic Integrity of Authentic Assessments', tested whether experienced university markers could distinguish genuine student work from versions modified or generated using generative AI. Their difficulty doing so led the researchers to conclude that authentic assessment alone was not sufficient protection against inappropriate AI use.
For educators, the more useful response is not automatically stronger surveillance.
Assessment design can generate evidence that another security layer cannot. Where independent performance matters, candidates may need to apply knowledge to unfamiliar material, demonstrate a process or explain how they reached a conclusion.
Those choices make the evidence richer because educators are no longer relying on identity and monitoring alone to support the meaning of the result.
The assessment itself can therefore contribute to assurance rather than leaving the entire burden to security controls.
Visibility matters most when something unexpected happens
Security frameworks are tested most clearly when an exam departs from the expected path.
A connection may drop. An approved resource may become unavailable. A candidate may trigger an alert that requires interpretation rather than an immediate conclusion.
Educators therefore benefit from deciding in advance which events matter, what information should be retained and who is responsible for reviewing it.
A clear process creates a useful distinction between detection and judgement.
An alert can identify that something occurred. It cannot determine by itself whether the validity of the assessment was affected. Professional judgement still requires context.
Consistent records give educators that context and make similar events easier to handle in similar ways across different sessions.
Post-exam review extends security beyond submission
The security process should continue long enough to determine whether the result remains defensible.
Where an exam includes an interruption or unusual event, educators can consider the available evidence together rather than judging one signal in isolation. Authentication records, session information, incident notes and assessment performance may each contribute a different part of the picture.
Review also creates information that can improve future exam windows.
Repeated confusion around permitted resources may indicate that instructions need refinement. A recurring incident type may show that a control is too sensitive or that a process needs clarification. Differences between locations may reveal where expectations are being applied inconsistently.
Post-exam review therefore does more than resolve individual cases. It allows the security framework itself to improve.
Consistency matters more than uniformity at scale
Larger cohorts and varied delivery models make consistency harder to maintain, but they do not require every exam to use identical controls.
The more useful goal is consistent reasoning.
Educators can establish common principles for identity, permitted resources, escalation and review while allowing individual assessments to apply those principles differently according to risk.
The same direction appears in TEQSA's 2026 guidance on assuring quality learning in a generative AI-integrated future. The guidance places learning assurance alongside evaluative judgement, critical thinking and ethical reasoning, reinforcing the idea that confidence in outcomes depends on more than a single control.
For assessment leaders, the implication is a more adaptable model. A professional examination, a remote university exam and a lower-stakes knowledge check may use different safeguards while still being governed by the same underlying question: does the available evidence justify confidence in the result?
Trust in the result is the final test
Identity verification matters because every assessment needs a credible connection between a person and a result.
Integrity requires the next step.
Educators need to connect identity with the conditions of the exam, the evidence produced during delivery and the judgement applied when something does not go as planned.
When those elements work together, security becomes less about accumulating controls and more about protecting the meaning of the assessment.
Identity tells educators who took the exam. A connected integrity framework gives them a reason to trust what the result says.
