Malpractice in digital assessment

Candidates, centres, markers and administrators need clear guidance on what is and is not allowed. Policies should explicitly address plagiarism, collusion, use of AI tools, acceptable support, authorised materials, identity expectations and investigation processes.

Where AI is concerned, ambiguity creates risk. Providers should explain whether AI use is prohibited, limited, declared or permitted in specific contexts, and how those rules align to the skills being assessed.

Assessment design is one of the strongest controls available.

Practical approaches may include:

• using authentic tasks that are harder to outsource

• varying question sets or item order where appropriate

• applying time limits thoughtfully

• assessing process as well as final output

• combining written responses with oral, practical or scenario-based elements

• reviewing where open-book design is more valid than trying to simulate closed conditions poorly.

The aim is not simply to make cheating harder. It is to create assessments that better reflect genuine competence.

Where impersonation is a risk, identity checks should be proportionate to the stakes of the assessment. This may include:

• candidate identity verification before the assessment

• secure login and access controls

• validation against known learner records

• review of anomalies across access patterns, submissions or candidate behaviour

Secure authoring, storage, distribution and scheduling all matter. Organisations should review:

• who can access live content

• how access is granted and monitored

• whether content exposure is minimised

• how content is rotated, versioned or windowed

• what controls exist to detect unusual access or sharing

Technology can help identify patterns that deserve further review. For example, organisations may use similarity analysis to compare submissions against published sources, previous candidate work, known reference material or other internal content sets. This can help investigators move beyond instinct and focus on evidence. The important principle is that such tools should support expert judgement, not replace it. Similarity is a signal for review, not a finding on its own.

Digital assessment systems should capture meaningful evidence that can support investigation and defensible decision-making. Useful evidence may include:

• login history

• timestamps

• submission metadata

• access logs

• changes across versions

• administrative actions

• exception handling records

Without an audit trail, even well-founded concerns can be difficult to prove.

Markers, administrators, invigilators, compliance teams and centre staff need consistent understanding of risk indicators, escalation routes and evidential standards. Training should cover both prevention and response, including how to recognise suspicious patterns without making unsupported assumptions. 

Patterns matter. Organisations should look for recurring issues by qualification, assessment type, centre, cohort, delivery model or time window. This helps teams identify where risk is increasing, where controls are weak, and where policy or design changes may have the greatest impact.