Most institutions buy proctoring before they design what happens after a flag. The software produces a signal; the process decides whether that signal becomes a fair outcome or a grievance. This planner is where you write the process down.
Prefer a printable, fill-in version? Download Exam Integrity Incident Response Planner as a branded PDF — ready to print and complete by hand or on screen.
Download the fillable PDF →A proctoring flag is not a finding. It is a piece of evidence that a human still has to interpret — and the distance between those two things is where most institutions get into trouble. When there is no written triage path, every flag lands on whoever happens to be available, review standards drift by department, students hear about the allegation weeks later, and the record of how the decision was made is thin enough to collapse under appeal.
This planner walks you through building that path before you need it. It is deliberately vendor-neutral: it works whether your flags come from live proctoring, recorded review, lockdown browsers, AI-based behavior analytics, or an instructor's own observation.
How to use it
Fill it in with the people who will actually run the process — an assessment or academic integrity lead, a registrar or conduct officer, a faculty representative, and someone from IT or the LMS team. Work through the sections in order. Section 1 is a pre-flight check on the policies that have to exist before a flag can be acted on. Section 2 forces the hardest decision: which flag types justify which level of review, and who has authority to decide. Section 3 puts a clock on each stage. Section 4 is the running log you will be very glad to have when a pattern gets questioned.
Do not try to resolve every edge case in one sitting. A planner that covers your five most common flag types and gets used beats a thirty-page policy nobody opens.
Why the tiering matters most
The single biggest failure mode in exam integrity is treating all flags as equivalent. A browser-focus event during a 90-minute exam and a second face detected in frame are not the same allegation, and they should not travel the same path. Tiering lets low-signal flags resolve quickly at the course level while genuinely serious cases get the scrutiny — and the documentation — they deserve. It also protects your faculty, who otherwise absorb the entire review burden with no guidance on where the threshold sits.
Automated flags carry their own obligations. Under Article 22 of the GDPR, individuals have the right not to be subject to decisions based solely on automated processing that significantly affect them; where such processing is permitted, safeguards must include human intervention, the ability to state their point of view, and the ability to contest the decision. Even outside the EU, that is a sound design principle: a human decides, the software only surfaces.
Due process is a design requirement, not a formality
In Goss v. Lopez (1975), the Supreme Court held that public school students facing suspension must receive oral or written notice of the charges, an explanation of the evidence against them, and an opportunity to present their side. Your institution's obligations will vary by sector, state, and whether you are public or private — but notice, evidence, and a chance to respond is the floor any credible integrity process should be able to demonstrate on paper.
Records matter too. Under FERPA, student discipline files are education records (34 CFR § 99.2), which shapes who may see a proctoring review file, how long you keep session recordings, and what you can say to a parent or an outside party. Decide those retention and access rules now, in Section 1, rather than in the middle of a contested case.
Where this fits
If you are still selecting a vendor, pair this with the questions in our assessment and proctoring advisory work — the incident process you design here should be a scoring criterion, not an afterthought. If a program review or self-study is on your horizon, the Accreditation Readiness Scorecard will help you connect academic integrity practice to the evidence your reviewers will ask for. And if you want a second set of eyes on a process that is already live, get in touch.
The worksheet
Use the template below on this page, or grab the fillable PDF to print and share with your team.
Confirm each of these exists in writing and is findable by a student before you act on a single flag.
- A published academic integrity policy that names online and proctored assessment explicitly
- Language in the syllabus and the exam start screen telling students what is monitored and recorded
- A stated retention period for proctoring recordings, flag data, and review notes
- A written rule on who may view a session recording and under what circumstances (FERPA — discipline files are education records)
- A documented accommodation and exception path for disability, connectivity, testing environment, and religious observance
- A named human decision-maker for every category of outcome — no result issued by software alone
- A student-facing appeal route with a stated deadline and a reviewer who was not part of the original decision
- An agreed definition of what counts as inconclusive, and what happens to the student's grade when a case is inconclusive
- A record of where flag data lives, who administers it, and how it is deleted at end of retention
One row per flag type your tools actually produce. Be specific: name the signal, not the category. The example row shows the level of detail to aim for.
| Flag type / signal | Tier (1-3) | First reviewer (role) | Evidence required beyond the flag | Decision authority |
|---|---|---|---|---|
| Browser focus lost, under 15 sec, single event | 1 | Course instructor | None — note in gradebook only | Instructor, no referral |
Delay is the most common source of student complaints and the hardest thing to defend later. Set target times per tier and write down what the student is told at each stage.
| Stage | Owner (role) | Starts when | Target time | What the student is told |
|---|---|---|---|---|
| Initial triage of flag | Integrity coordinator | Session report released | 2 business days | Nothing yet — no allegation exists |
Run this list for every case that reaches a formal outcome. If you cannot tick all of them, the case is not ready to close.
- The student received written notice of the specific allegation, not a generic integrity warning
- The student was told what evidence exists and had a meaningful chance to see or hear it
- The student was given an opportunity to respond before the outcome was decided
- A human reviewed the underlying evidence — not just the tool's flag summary or confidence score
- Technical and environmental explanations (bandwidth, lighting, shared housing, assistive tech) were considered and documented
- The reviewer applied the same standard used in comparable cases this term
- The outcome, the reasoning, and the appeal route were communicated in writing
- The full case file is stored in the designated system with correct access restrictions and retention date
Keep this running for one term. The pattern it reveals — which flag types never survive review, which reviewers diverge, where time is lost — is worth more than any single case.
| Case ID | Flag type | Tier | Outcome | Appealed? | Days to close |
|---|---|---|---|---|---|
Sources & further reading
- What is an education record? (34 CFR § 99.2) — U.S. Department of Education, Student Privacy Policy Office
- Goss v. Lopez, 419 U.S. 565 (1975) — Cornell Legal Information Institute
- Your rights in relation to automated decision making, including profiling (Article 22 GDPR) — Data Protection Commission (Ireland)
Want the fillable PDF version?
Download Exam Integrity Incident Response Planner (PDF)