Assessments
Assessment Security and Integrity Standards
How we protect the fairness, security and confidentiality of CoreKnowledge computer-based assessments, written openly so candidates, employers and exam bodies can trust the result.
1. Our approach
- 1.1We use layered controls matched to the stakes of the assessment (the assurance levels below). No single control is relied on alone.
- 1.2We design to recognised good practice for computer-based assessment, including ISO/IEC 23988 (code of practice for IT-based assessment delivery) and the International Test Commission guidelines on computer-based and internet-delivered testing, and we benchmark published candidate rules of professional bodies such as ACCA and CIMA.
2. Assurance levels
| Level | Used for | Supervision | Controls |
|---|---|---|---|
| 1 Practice | Knowledge checks and drills | None | Personal login, attempt logging, instant feedback |
| 2 Mock exam | Timed mock exams in exam format | None (candidate declaration) | Level 1 plus timed auto-submit, randomised order and options, candidate watermark, integrity flags, result by email |
| 3 Invigilated | Approved sittings, certification exams | Venue invigilator or remote proctor | Level 2 plus photo-ID check, exam password, venue network restriction and secure browser where the sitting requires them |
3. Identity and access
- 3.1Candidates sign in with their own account over an encrypted (HTTPS) connection. Accounts lock for 30 minutes after five failed attempts and passwords must meet a minimum standard.
- 3.2Staff accounts, administrators and assessors cannot sit assessments as candidates through the candidate gateway.
- 3.3Sign-in attempts are rate-limited and logged. Bots are blocked by hidden-field checks and origin checks.
4. Content protection
- 4.1Questions are original, mapped to outcomes and reviewed before release. Question order and answer options are randomised for every candidate where the assessment allows, and several different papers are used.
- 4.2Each page shows a faint candidate watermark (ID and name). If content leaks, it can be traced to a session.
- 4.3Marking keys and unreleased papers are held on our servers and are never sent to the candidate's device.
5. Delivery and timing
- 5.1The clock is held on the server. Answers autosave about every minute and the paper submits itself when time ends.
- 5.2Pass marks, timings and attempts are set per assessment and shown before you start.
6. Monitoring and review
- 6.1We keep a log of each attempt (times, answers, IP address, browser). Automated checks currently flag unusually fast completion, and our assessors can review attempt data for patterns such as identical answers across candidates.
- 6.2A flag is a reason to look, never proof of misconduct. Every concern follows the fair process in Assessment Misconduct, Investigations and Appeals.
- 6.3We review question statistics regularly. Questions that behave unexpectedly are checked, corrected or withdrawn, and affected attempts are re-marked.
7. Governance, incidents and improvement
- 7.1The Assessment Officer, George Mureithi, FCCA, FCPA, MBA, BSc (Hons), owns these standards and reviews them at least once a year and after any serious incident.
- 7.2Security incidents involving personal information follow our Data Breach Response Policy and our Information Security Policy.
- 7.3We may add stronger controls over time (for example secure browser or venue restrictions for particular sittings). We will state the controls that apply on each assessment's start page.