Nineteen Minutes of Clock Drift and a Stranger in the Corridor
At the end of the month you run the security review for a 42-seat test center. The recorder clock is 19 minutes behind network time. The weekly clock-synchronization log, which policy requires a named staff member to initial, has no entries for the past three weeks, so you cannot tell when the drift began or whether it was constant. On the 14th, an irregularity report logged a restroom break for candidate R.K. at 10:47 center time. The corridor camera shows movement between 10:32 and 10:35 on the recorder clock. The door sensor, on its own clock, records the corridor door opening at 10:49 and closing at 10:52. Applying the 19-minute offset puts the two in the same window. At 10:41 recorder time, though, an unidentified person enters the corridor from the shared stairwell, stands near the door for about 40 seconds, and leaves; the door never opens and no candidate is in the corridor then. Retention is 90 days and all footage exists. The center manager wants to close the finding as "CCTV malfunction, no action" because the scores were already released.
1. Reconstruct the 14th. What does the evidence support about R.K.'s break and about the unidentified person, and what can you not conclude?
Read the worked answer
Establish the offset before arguing any timeline. A single offset value is weak evidence, so anchor it twice: compare the recorder against the badge-in event at session start and against the final submission timestamp. If both point to the same 19-minute lag, the drift is constant enough to use; if not, the recorder has been stepping and no timestamp can be trusted without re-anchoring.
With a constant 19-minute lag:
- Recorder 10:32–10:35 = actual 10:51–10:54.
- Door sensor: open 10:49, closed 10:52.
- Logged break: 10:47 out, ~10:52 back.
These agree within a one-to-two-minute tolerance for sensor and camera latency. R.K.'s absence is fully accounted for - she left, returned, and was out for roughly three to five minutes. Nothing supports an unreported absence or a candidate being in the corridor while unobserved.
What the offset does not explain is the person at recorder 10:41 (actual ~11:00): an unidentified individual inside the secure corridor, near the testing-room door, for about 40 seconds, who left without the door ever opening. That is a perimeter control failure during a live scored session.
What cannot be concluded: that this person had contact with any candidate, saw any exam content, or that R.K. was involved. The room door stayed closed and no candidate appears in the corridor at that moment. The defensible finding is "unauthorised access to the secure corridor, no confirmed candidate exposure" - not "no action" and not "breach confirmed".
2. Classify the finding, define the escalation path and preservation steps, and decide whether the released scores should be flagged for review.
Read the worked answer
Classification: two separate findings, not one.
- Security incident - unauthorised person inside the secure corridor during a live administration. This is the dominant finding and cannot be downgraded to a camera issue.
- Documentation nonconformity - three consecutive weeks without a clock-sync entry, which is what made the review inconclusive in the first place.
Escalation. A security event in a scored session goes up immediately on discovery, not at month-end close. Notify center management in writing, then submit the irregularity/incident report to PSI quality and security through the standard channel, including: the reconstructed timeline, the offset calculation and its anchors, the door-sensor extract, and the identity of the reviewer. Where a data-protection or premises-access obligation exists, the building landlord also needs notice about stairwell access.
Preservation. Place a litigation-style hold on the footage so normal 90-day overwrite does not destroy it; export the relevant clip, record a hash or checksum, and log who exported it and when. Do not let the file sit only on the DVR.
Scores. The evidence supports no candidate contact and no content exposure, so the recommendation is: flag for information, recommend that results stand, and state the basis. The disposition belongs to PSI, not the center. Reversal is warranted only if the door had opened, a candidate had been alone in that corridor, or the person was later identified as a candidate or a candidate's associate. Saying "scores were already released, so nothing can be done" is not a rationale; a post-release review is exactly what the escalation process exists for.
3. The center manager wants the finding closed without an incident report. What corrective and preventive actions do you require, and how do you handle the manager's request?
Read the worked answer
Handle the request first, on the record. Record in the audit file that closure without a report was proposed, by whom, and when, and that the reviewer declined. Avoid framing it as an accusation - managers close findings for throughput reasons - but do not let the file imply the camera simply failed. The manager's incentive to avoid a report is a conflict of interest in the audit, and the reviewer's independence is the control that catches it.
Corrective actions:
- Configure the DVR to sync to network time automatically and verify the correction against a second anchor.
- Replace initials-only sync logs with a log recording the actual device time, network time, and the delta, signed by the person who checked it.
- Restrict the stairwell-to-corridor door to badge access, add a request-to-exit sensor, and require any visitor in the corridor to be badged and escorted.
- Re-brief staff that an unidentified person in the secure area is an immediate stop-and-report event, even mid-session.
Preventive actions:
- Monthly sampling of camera timestamps against door-sensor events to detect drift early.
- Quarterly perimeter walk-test with a written result.
- Escalation-matrix refresher for all center managers, using a de-identified version of this case.
Root cause is not the camera. It is an unmonitored corridor entry point plus a lapse-check control that nobody was verifying. Effectiveness check at 90 days: sync logs complete for 12 consecutive weeks, offset under 60 seconds, zero unidentified persons recorded in corridor audits.