PSI TCQR Stage 3 common mistakes
PSI TCQR Stage 3 · Understand the traps and how to avoid them.
When a candidate's ID looks altered, the administrator admits them provisionally and 'keeps an eye on them' rather than stopping admission and starting the identity-resolution process before the candidate enters the testing room.
Administrators want to avoid conflict and delay at the front desk, and they assume a suspicious ID can be sorted out after seating. This inverts the control order: once the candidate is at a workstation with a live exam, the secure state is already lost and the only remaining options are reactive.
What to do instead
Memorise the sequence: no admission until identity is affirmatively established. Practise a scripted, neutral hold ('I need to verify this before we continue') and know the escalation contact and the documentation fields (ID type, discrepancy observed, time, decision, supervisor notified) that must be completed before any admission decision is recorded.
Treating the secure-storage and chain-of-custody rules for test materials as paperwork to complete after the session, reconstructing times and signatures from memory at the end of the day.
The custody log feels administrative next to the visible work of admitting and proctoring candidates, and backfilling is faster in the moment. Candidates underestimate that a reconstructed log is evidentially worthless and is itself a reportable irregularity.
What to do instead
Learn the rule that custody records are contemporaneous by definition: each transfer is signed and timed by both parties at the moment it happens. Drill the full material lifecycle (receipt, count, seal check, secure storage access, opening, return, reconciliation) as a timed sequence, and treat any gap as something to report rather than to paper over.
Relying on a single check at check-in (for example, ID inspection only) and not performing the subsequent identity confirmation at the workstation before the exam is launched.
The check-in feels like the identity event, so the second confirmation looks redundant, especially under queue pressure. This misses the window in which a candidate could be swapped or reseated between the front desk and the room.
What to do instead
Map the full identity chain for the exam you administer (registration match, check-in document inspection, biometric or photo comparison where used, workstation confirmation, launch authorisation) and be able to state what each step catches that the others do not. Answer scenario questions by identifying the earliest control that was skipped, not the most dramatic one.
Handling a candidate who is caught with a prohibited item by confiscating it quietly and letting the candidate continue, without documenting or escalating because 'nothing actually happened'.
Staff reason that a near-miss with no proven benefit to the candidate does not warrant the escalation burden, and they fear unfairly disrupting the candidate. This conflates the decision to act with the decision to sanction, which belong to different roles.
What to do instead
Separate detection, containment, documentation, and adjudication in your head: the administrator detects, secures, records, and escalates; the adjudicating authority decides. Learn the reporting threshold (what must be reported regardless of apparent impact) and the required report contents so you can describe a complete, defensible report rather than a judgement call.
Describing an irregularity report in vague summary terms ('candidate was disruptive', 'technical issues occurred') instead of recording observable facts, times, locations, persons present, and actions taken.
Reports are often written from memory hours later, and writers default to conclusions because conclusions are shorter. Candidates also confuse a narrative that reads well with a record that survives review.
What to do instead
Practise converting conclusions into observations: not 'candidate cheated' but what was seen, when, where, by whom, and what was said and done. Memorise the standard report skeleton (who, what, when, where, witnesses, immediate action, evidence retained, notifications made) and apply it to sample scenarios until it is automatic.
Escalating to the wrong level or in the wrong order during a live incident, for example contacting a technical helpdesk about a suspected impersonation, or waiting for a supervisor before taking an urgent containment step.
Under pressure, staff reach for the contact they know best or the one most likely to answer, and they default to deference rather than to the pre-agreed authority matrix. The result is delay on the urgent thread and noise on the wrong thread.
What to do instead
Study the escalation matrix as decision rules, not a phone list: classify the event (security, identity, technical, conduct, safety), identify which classifications permit immediate action without prior approval, and know the notification timeframes and who must be informed versus who decides. Rehearse two or three mixed scenarios where the classification is ambiguous.
Assuming that because a procedure was performed, the quality-assurance requirement is satisfied, and skipping the self-audit, checklist sign-off, or discrepancy reconciliation that proves it was performed correctly.
Compliance is intuitively equated with doing the task, and the verification step feels like duplication. Candidates also underestimate how often the audit question is about evidence of control rather than the control itself.
What to do instead
Learn to answer in terms of evidence: what record demonstrates the control operated, who reviews it, at what frequency, and what happens when a discrepancy is found. Distinguish first-line checks, supervisory review, and independent audit, and be able to say which one a given scenario is describing.
Treating a pattern of small, individually explainable deviations (repeated late starts, recurring minor overruns, the same staff member repeatedly alone with materials) as unremarkable rather than as a trend requiring analysis and corrective action.
Each event has a plausible excuse, so no single event triggers the reporting instinct, and trend analysis is seen as a management task disconnected from daily work. This is exactly how systemic weaknesses stay invisible until a serious breach.
What to do instead
Study the corrective-action cycle (identify, contain, root cause, action plan, effectiveness check, closure) and practise naming the root cause rather than the symptom. Learn which indicators are monitored as trends and be ready to describe what a finding, an observation, and an opportunity for improvement each are.
Answering supervision questions by describing the supervisor's personal trustworthiness or experience rather than the specific supervisory controls (direct observation, recording review, sign-off, spot checks) and their required frequency.
Supervision is experienced as a relationship, so candidates describe it that way. Exam items, however, test whether you know which activities require direct supervision, which can be delegated, and what must be verified and recorded.
What to do instead
Build a table of tasks by supervision level: what a trainee may never do unsupervised, what requires post-hoc review, and what requires documented sign-off. Pair it with the professional-conduct rules on conflicts of interest, confidentiality, and reporting a colleague's misconduct, and practise distinguishing a training gap from a conduct issue.
Treating test-center security as a set of physical measures (locks, cameras, signage) and failing to connect them to the information controls: workstation lockdown, credential handling, access logs, and secure destruction of candidate materials.
Security is visualised as doors and cameras, while data-handling obligations live in a different part of the procedure and are skimmed. Candidates then miss items about who may access candidate data, how long it is retained, and what happens to scratch paper and session records.
What to do instead
Learn the security domain as layered controls covering people, physical space, and information. For each layer, be able to state the control, its purpose, the record it generates, and the failure it prevents. Pay particular attention to access-log review, credential custody, and documented destruction, since these are the most commonly under-studied.