The Outsourced Proctoring Provider and Unclosed Integrity Cases
A distance university has 18,000 learners in 12 countries. It outsources online proctoring and first-line academic-integrity case handling to ProctorNow. The contract requires ProctorNow to 'investigate suspected cheating and report outcomes.' The university's EOMS procedure for externally provided processes says providers are selected on price, with no approval criteria, performance monitoring, or re-evaluation. In the audit sample, you find 27 integrity flags from the last semester; ProctorNow closed 19, sent 8 to the university, and the university closed 3. Six cases have no disposition after 90 days. The registrar says, 'ProctorNow owns the process; we just receive reports.' A faculty member says the same provider also writes some exam questions. You have access to the contract, the procedure, and the case log.
1. Which ISO 21001 requirements are most relevant, and what audit evidence would you seek before deciding on a nonconformity?
Read the worked answer
The relevant requirements are 8.4 for control of externally provided processes, products or services; 8.5.1 for control of provision; 8.7 for nonconforming outputs; and 9.1 for monitoring, measurement, analysis and evaluation.
The procedure's price-only selection and lack of performance monitoring is direct evidence of weak 8.4 control. But before writing the finding, verify the contract's actual allocation of responsibilities, whether ProctorNow is approved and re-evaluated, whether the university reviews case reports or KPIs, whether the six unresolved cases are within the university's control, whether learners were notified and appeals handled, and whether the provider writing exam questions creates an assessment conflict.
Sample the case log and contract. If the university has no monitoring and cannot show that unresolved integrity cases were dispositioned, that is objective evidence that the outsourced process is not controlled. The finding should focus on the university's failure to control the outsourced process, not merely on the provider's performance.
2. How would you classify and write the finding if the six unresolved cases are confirmed, and what would you sample next?
Read the worked answer
If confirmed, I would classify based on risk and systemicity, not the count alone. Six unresolved integrity cases after 90 days for a provider handling assessment integrity is likely a major nonconformity if it shows a systemic failure to control the outsourced process and nonconforming outputs. It could be minor if isolated and contained, but the lack of any monitoring suggests a systemic issue.
The finding should state the requirement, for example 8.4 and 8.7, the objective evidence (27 flags, 19 closed, six open beyond 90 days, no monitoring records), and the consequence (assessment outcomes may be unreliable). I would avoid prescribing a specific software fix.
Next I would sample other externally provided processes such as exam question writing and platform hosting, learner appeals, assessment records for affected cohorts, management review inputs, and corrective actions from previous audits. I would also check whether the provider's question-writing role was risk-assessed. Confirm the finding with the auditee before closing.