Online Exam and Proctoring Tools

Online Exam and Proctoring Tools explains software used to deliver assessments, verify identity, restrict the testing environment and review possible irregularities. Tools range from ordinary online quizzes to live remote proctoring and secured test-center systems.

Assessment integrity should begin with valid assessment design. Surveillance technology cannot turn a weak exam into strong evidence, and flags from automated systems should not be treated as proof of misconduct.

On this page — 22 sections

1. Online assessment framework
2. Types of online exam tools
3. Start with assessment validity
4. Identity assurance
5. Lockdown browsers
6. Remote proctoring models
7. Privacy
8. Home and family privacy
9. Accessibility and accommodations
10. Technical requirements
11. Academic integrity by design
12. Incident review
13. Due process
14. Procurement
15. Vendor questions
16. Alternatives
17. Metrics
18. Common failures
19. Institutional governance
20. Frequently asked questions
21. Related Knowledge Compass guides
22. Official sources and review notes

Online assessment framework

Area	Question
Purpose	Which knowledge or skill must be demonstrated?
Risk	What consequence follows the result?
Identity	How much assurance is necessary?
Environment	Which controls are proportionate?
Access	What accommodations and alternatives are needed?
Privacy	Which personal and room data are collected?
Review	How are flags investigated?
Evidence	Does the exam validly measure the intended outcome?

Types of online exam tools

Type	Typical capability
LMS quiz	Questions, timing and automatic scoring.
Assessment platform	Item banks, rubrics and advanced reporting.
Lockdown browser	Restricts device functions.
Identity verification	Checks credentials or identification.
Live remote proctoring	A person observes the session.
Recorded proctoring	Video is reviewed later.
Automated monitoring	Software flags events for review.
Test center delivery	Controlled facility and equipment.
Practical assessment	Simulation, coding, portfolio or demonstration.

Start with assessment validity

The format should match the construct. A multiple-choice exam may test knowledge but cannot fully demonstrate laboratory, clinical, teaching, design or interpersonal performance.

Outcome	Possible evidence
Recall	Secure or open-book questions.
Reasoning	Cases and written explanation.
Writing	Draft and final work.
Technical skill	Lab or coding task.
Oral communication	Presentation or defense.
Practical competence	Observed demonstration.
Long-term work	Portfolio or project.

Identity assurance

Identity controls can include institutional login, multifactor authentication, identification documents, test-center checks or live verification. The control should match the consequence and avoid collecting more data than necessary.

Lockdown browsers

A lockdown browser may block applications, copy and paste, printing or navigation. It cannot control every external device or person, and it can conflict with assistive technology, security software or institutional devices.

• Test required operating systems.
• Provide a practice exam.
• Check assistive technology.
• Explain installation and removal.
• Offer a managed-device or test-center alternative.
• Document technical-failure procedures.

Remote proctoring models

Live proctoring

A human observes the session and can communicate with the learner. It can support immediate clarification but is expensive and may introduce inconsistent judgment.

Recorded proctoring

Video and screen data are captured and reviewed later. Institutions need clear retention, access and review rules.

Automated monitoring

Software may flag gaze, sound, movement, objects or device events. Such signals are context-dependent and can be affected by disability, environment, skin tone, lighting, culture or technical conditions.

Automated flags should initiate human review, not determine misconduct.

Privacy

Proctoring can collect identification, face and voice data, room video, screen activity, device information, location, behavior and incident notes. This creates a high privacy burden.

1. Document the necessity.
2. Minimize the data collected.
3. Explain collection before registration.
4. Review biometric and education-record rules.
5. Control vendor access.
6. Set short retention where possible.
7. Provide access and correction routes.
8. Define breach response.
9. Delete data after the purpose ends.

Home and family privacy

A room scan or continuous camera can expose family members, religious objects, health information or living conditions. Institutions should consider less intrusive alternatives and avoid assuming every learner has a private room.

Accessibility and accommodations

• Extra time and breaks.
• Screen-reader and keyboard compatibility.
• Permission for assistive devices.
• Alternatives to gaze or movement monitoring.
• Interpreter or support-person rules.
• Reduced-distraction locations.
• Test-center or oral alternative.
• Accessible identity verification.

An accommodation should not automatically generate a misconduct flag. The assessment, disability and technology teams need a coordinated process.

Technical requirements

Requirement	Risk
Webcam and microphone	Cost, privacy and hardware failure.
Stable broadband	Exclusion and interruption.
Operating system	Unsupported devices.
Administrator rights	Institutional or workplace device restrictions.
Room conditions	No private or quiet space.
Power	Outage and battery failure.
Upload speed	Recording loss.

Academic integrity by design

Many integrity risks can be reduced without intensive surveillance.

• Use larger item banks.
• Require explanation.
• Use local or personalized cases.
• Assess process and drafts.
• Use open-book questions that require application.
• Add oral checks for high-stakes work.
• Use practical demonstrations.
• Clarify collaboration and AI rules.

Incident review

1. Preserve the original evidence.
2. Check technical logs.
3. Review approved accommodations.
4. Ask the learner for context.
5. Separate a flag from a finding.
6. Use trained human reviewers.
7. Apply a consistent standard.
8. Provide appeal and correction.
9. Record the decision and retention date.

Due process

High-stakes findings can affect grades, credentials and careers. Institutions should disclose the evidence, allow a response and use decision-makers who understand the tool’s limitations.

Procurement

1. Define exam consequence and threat model.
2. Consider less intrusive assessment.
3. Review accessibility.
4. Map every data field.
5. Review biometric and privacy obligations.
6. Test false flags with representative users.
7. Define human review.
8. Set retention and deletion.
9. Plan technical failure.
10. Require export and contract exit.

Vendor questions

• Which behaviors are flagged?
• What evidence supports accuracy?
• How does performance vary across users?
• Is biometric data created?
• Where are recordings stored?
• Who can review them?
• Are data used to train models?
• Can monitoring features be disabled?
• How are accommodations configured?
• What happens after contract termination?

Alternatives

Alternative	Use
Open-book application exam	Tests reasoning rather than recall.
Oral defense	Verifies understanding.
Project	Shows extended performance.
Local test center	Provides controlled environment.
In-person practical	Tests hands-on skill.
Portfolio	Uses multiple artifacts.
Frequent low-stakes checks	Reduces one-exam pressure.

Metrics

• Exam completion.
• Technical failure.
• Accommodation success.
• Flag rate.
• Confirmed-case rate.
• Appeal and reversal.
• Learner support contacts.
• Privacy incidents.
• Cost per exam.
• Independent validity evidence.

Common failures

• Choosing surveillance before redesigning assessment.
• Treating flags as guilt.
• No practice test.
• No alternative for unsupported devices.
• Inaccessible lockdown software.
• Recording rooms without proportionality.
• Keeping biometric data indefinitely.
• Ignoring false-positive patterns.
• No appeal.
• Measuring integrity only by detected cases.

Online exam security should be proportionate, accessible and reviewable, with valid assessment—not surveillance—as the foundation.

Institutional governance

An institution should maintain an approved assessment and proctoring policy rather than allowing every course to choose different surveillance. The policy should classify assessment risk and match controls to consequence.

Risk level	Possible approach
Low stakes	Ordinary quiz and feedback.
Moderate stakes	Authenticated assessment with application tasks.
High stakes	Multiple evidence sources, controlled environment or proportionate proctoring.
Practical competence	Observed or simulated performance.

The institution should document the decision, owner, evidence, limitations and next review date.

Frequently asked questions

Related Knowledge Compass guides

• Virtual Classroom Software Explained
• AI in Education
• What Is EdTech?
• Adaptive Learning Platforms Explained
• Education Technology & EdTech

Official sources and review notes

Last reviewed: June 2026. Proctoring features, privacy law and accessibility obligations change.

• U.S. Department of Education Student Privacy
• W3C WCAG 2.2
• FTC Children’s Privacy
• UNESCO Technology in Education

↑ Back to top