Professional training doesn't only happen during business hours.

For late-night learners, global teams and high-stakes rollouts, the ability to verify identity, track participation and prove compliance—anytime, anywhere—is essential.

That kind of access sounds simple, but in practice, it’s anything but. According to a report by Imprivata and the Ponemon Institute, just 28% of IT leaders believe their organization can adequately secure mobile devices and access to sensitive data. Meanwhile, productivity losses from downtime on shared devices add up to over 872 hours lost per week, while an average $5.45 million lost annually to missing devices alone.

What’s the takeaway in all this? In mobile-first environments, training infrastructure that can’t scale (or worse, that introduces security or usability roadblocks) quickly becomes a liability. Whether it’s healthcare, retail, or manufacturing, organizations are discovering that flexibility without oversight is just another form of risk. 

This is where scalable proctoring infrastructure becomes indispensable. The right tools ensure the right person completed their assessment, stayed engaged and left behind a clear, auditable record. All without adding friction, requiring installs or generating costly IT overhead.

Built to keep pace with your workforce

When training is essential to doing the job, whether for safety compliance, regulatory credentials or global certifications, systems have to perform under pressure. And in enterprise environments, that pressure isn’t occasional. It’s constant.

Organizations today are rolling out training to workforces that span shifts, regions and roles. That means late-night modules, onboarding from the field and recertifications happening across time zones. When those sessions hit a technical snag, the impact ripples.

• One failed login can delay an entire shift.
• One broken identity check can stall a recertification deadline.
• One missing audit trail can escalate into a compliance liability.

Since many of these programs run on shared devices or in BYOD environments, complexity compounds fast. In mission-critical industries like healthcare and manufacturing, delays don’t just impact productivity, they raise safety risks. In manufacturing, unplanned downtime can cost an average of $260,000 per hour, with equipment failure responsible for nearly 70% of these incidents. These failures can often stem from human error, such as when employees skip steps or misuse machinery due to poor training or rushed onboarding.

That’s where reliable, verifiable training becomes essential. When organizations can prove not just that training was assigned, but that it was completed, understood and monitored, they reduce the likelihood of mistakes that lead to breakdowns. When those assessments are delivered without delay—across shifts, regions, and devices—they help keep production lines moving and compliance risk in check.

When training tools fail to keep pace, it’s not just learners who lose time. It’s the entire system.

What breaks when your training system can’t scale

It’s not always obvious when a platform isn’t built for high volume, then it gets pressure-tested—and the cracks start to show. Here’s what can go wrong when your training infrastructure falls short:

• Help desks get overwhelmed. Minor friction points turn into major support backlogs when hundreds (or thousands) of users run into the same issue at once.
  
• Learners abandon or delay training. If systems are slow, confusing or inconsistent across devices, users will disengage, especially in mobile or after-hours environments.
  
• Compliance teams lose visibility. Without clear, verifiable records of participation and identity, oversight becomes fragmented and audit risk increases.
  
• Delays derail productivity. In critical operations, even short disruptions can stall onboarding, extend downtime or delay recertifications.
  
• Reputation takes a hit. When learners, regulators or partners experience unreliable systems, it reflects on the credibility of your credentials or compliance program.

Consider a medical training provider issuing certifications for frontline healthcare roles. If their assessment platform fails to detect impersonation or AI-generated responses during a critical exam, what’s going to happen? The risk isn’t limited to the individual who cheated. It undermines the perceived value of every credential issued through that system.

So aren’t most assessment security tools built for scalability? Well..many can handle volume on paper. But far fewer are designed to maintain reliability, oversight and integrity when tested in the real world—under pressure, across time zones, and on a range of personal devices.

What real-world scale actually looks like

Picture this: A national safety organization announces a recertification deadline that affects thousands of frontline workers. In a single week, training volume spikes to more than 20 times the usual load.

Learners log in from job sites, personal phones and public Wi-Fi. Some are in rural areas with limited bandwidth. Others are squeezing assessments in between overnight shifts. On top of it all, every single session has to be secure, compliant and verifiable—because the stakes are high, and regulators are watching.

These are the conditions modern training systems need to meet to ensure admin and support teams don’t burn out. And so the integrity of every credential holds up under pressure.

Online proctoring built for the pressure

At Integrity Advocate, scalability isn’t a feature, it’s a standard. Our platform supports organizations where training never stops, learners are always on the move and there’s no room for downtime.

• We've supported rollouts with 20x traffic spikes—without service disruption
• Our support rate remains under 0.58%, even at scale
• We’ve done it all with no installs, no downloads and no added risk

Whether you're certifying workers across shifts, regions or regulatory jurisdictions, we help you deliver training that holds up under pressure—because in compliance-driven environments, it’s not just about training more people. It’s about protecting what that training stands for.

Scaling secure training online takes more than software, it takes a partner you can count on. So count us in.

{{post-cta}}

For too long, online training and assessment have been held down by rigid systems restricted to desktops.  

Dedicated testing spaces, clunky installs and inflexible tech have created barriers that slow down progress. But today’s workforce isn’t confined to cubicles—and their training tools shouldn’t be either.x

Welcome to the era of mobile-first proctoring - any device, anywhere, anytime. 

From friction to freedom: why mobile-first matters

It’s 2025. AI is everywhere. Everyone has a pocket computer. Yet, far too many training platforms still treat mobile access like an afterthought.

For frontline workers, remote teams and field-based professionals, mobile-friendly training is how work gets done. They rely on it to learn new procedures, complete compliance modules and stay up to date on safety protocols without having to hunt down a desktop or deal with complicated installs.

That kind of accessibility matters—but it’s only half the equation.

Training also needs to meet the same security, compliance and accountability standards as traditional setups.That’s why mobile-first can’t mean adapting desktop-first tools with clunky plugins or limited features.

Who benefits from mobile training?

In an always-on world, learners need tools that meet them where they are, not where the infrastructure happens to be. A mobile-first approach empowers:

• Rural learners and remote communities who can’t rely on fast internet or modern hardware
• Field employees in industries like construction, oil and gas, or transportation who need on-the-go compliance training
• Gig workers and seasonal staff without access to company-issued devices or secure corporate networks
• Global organizations with learners across time zones, bandwidth and language requirements

This isn’t hypothetical. 

When a new recertification mandate shot test volumes over 20x the normal level, Smart Serve Ontario needed a solution that could scale and support thousands of mobile learners on demand. They chose Integrity Advocate. By removing tech barriers such as installs or plugins, mobile-first proctoring helps ensure every worker can stay certified and every organization compliant.

Mobile doesn’t mean compromised

Let’s be clear: a robust, mobile-first platform designed from the get-go isn’t a watered-down version of real proctoring. It's a full-featured experience that includes:

• Identity verification to ensure the right person is taking the test
• Participation monitoring to confirm engagement throughout the session
• Human-reviewed record and review options for flagged behavior
• Privacy-by-design technology that works without storing unnecessary personal data

A DHS study and AT&T’s Global State of Cybersecurity survey found that more than half of organizations experienced data breaches due to mobile devices. The culprit? Not always hackers—often the users themselves. Personal devices running outdated software, sideloaded apps or insecure networks introduced vulnerabilities companies never saw coming.

That’s why Integrity Advocate takes a different approach.

Our platform runs in-browser, requires no downloads and doesn’t rely on third-party apps—removing a major attack surface. It’s fully managed, with no storage of unnecessary personal data, and doesn’t leave organizations at the mercy of end-user behavior or mobile device configuration. You get the accessibility of mobile-first training with the control of enterprise-grade compliance.

Why compliance leaders are embracing the shift

Training organizations, safety councils and global certifiers are already moving toward mobile-first assessment. Why? Because it aligns better with modern operations, cuts administrative burden and helps protect both reputations and results.

{{post-stat-highlight}}

When a construction worker completes required safety training between jobs, or a health care trainee verifies their identity during a break, the organization gets more than just a completed module. They get proof of participation, verifiable identity and compliance-grade oversight—all without chasing down paper records or managing one-off tech issues.

At scale, the business case grows even stronger. Companies that switch to BYOD smartphones can save up to $341 per employee while enabling access across time zones, connection types and devices. With the global BYOD market projected to reach US $331.6 billion by 2030, it’s clear this is the future of modern testing and credentialing.

The future of professional training is untethered

As professional training evolves, one thing is clear: it’s no longer tied to testing centers, corporate networks or traditional devices. But with that freedom comes responsibility.

In a mobile, BYOD-enabled world, security, verification and data privacy can’t be afterthoughts. Compliance doesn’t pause just because someone’s on a job site or logging in from a phone.

That’s why Integrity Advocate was built differently.

No installs. No third-party apps. No unnecessary data collection. Just seamless, compliant, secure assessments—anytime, anywhere, on any device.

We make training accessible. We make compliance effortless. And we make sure the only thing learners carry with them is confidence.

Any device, anywhere, anytime. 

Curious how mobile-first proctoring could work for your team? Let’s talk about your training goals—and how we can help you meet them.

{{post-cta}}

There is a difference between monitoring and surveillance. Most programs running online assessments haven’t thought carefully about which one they’re actually doing, and that gap is where trust starts to erode.

Monitoring confirms that the right person completed the assessment, stayed engaged, and followed the rules. Surveillance collects everything it can, flags anything it doesn’t recognize, and leaves the program to sort out what any of it means.

One produces a defensible result. The other produces liability.

If your proctoring tool accesses the file system of a personal device, stores recordings your team will never review, or generates hundreds of automated flags with no human judgment behind them, it’s not monitoring. It’s surveillance. And your learners know the difference.

What monitoring is actually supposed to do

Every program administering online assessments has the same core need: confirm identity, verify participation, and produce a result that holds up to scrutiny.

That’s it.

You’re not trying to catalog everything that happens in a candidate’s home. You’re not trying to build a behavioral profile. You’re trying to answer three questions:

1. Was this the right person?
2. Did they complete the assessment under appropriate conditions?
3. Can you stand behind the result if it’s challenged?

A well-designed proctoring approach answers all three. An over-engineered one tries to answer questions nobody asked, and in doing so, creates new problems. More data. More noise. More privacy exposure. And a test-taking experience that generates complaints before a single result is issued

Where surveillance starts

Privacy-first proctoring is not a softer version of security. It’s a more precise one.

It starts with a design principle: collect only what is necessary to confirm identity and verify engagement. Nothing beyond that scope. No recordings stored by default. No system-level device access. No behavioral data used outside the bounds of the specific assessment.

In practice, that looks like this:

No downloads or extensions. The assessment runs in a browser. No software installs, no hidden permissions, no access to personal files or background applications. A test taker can sit the exam on any device without IT involvement or configuration.

Proportionate data collection. Every feature and every data point collected should have a clear answer to the question: why does this make the result more defensible? If the answer is “it doesn’t,” it shouldn’t be collected. Surveillance produces volume. Monitoring produces clarity.

Data minimization by design. The only data collected is what’s needed to produce a defensible result: identity verification, participation confirmation, and a reviewable record of any flagged behavior. Sensitive data, including ID images, is deleted within 24 hours.

Compliance built in, not bolted on. GDPR, PIPEDA, FERPA, and SOC2 compliance aren’t checkbox items. They reflect a commitment to proportionate data collection, the kind of approach that holds up when regulators or institutional counsel start asking questions.

Human review is what makes the result defensible

Here’s what automated flags can’t tell you: whether a behavior was actually a problem.

An algorithm can detect that a second face appeared in the frame. It cannot tell you that the second face belongs to a child who walked in, not an accomplice. It can flag an unusual eye movement pattern. It cannot determine whether that pattern indicates academic dishonesty or a medical accommodation. It can detect a background sound. It cannot decide whether that sound matters.

Those determinations require a person.

At Integrity Advocate, every flagged session is reviewed by a trained human reviewer before any outcome is issued. Not as a premium tier. Not as an add-on. As the standard, at every price point.

That’s the difference between a defensible result and an automated flag you have to explain to a grievance committee.

Programs that rely on automated proctoring alone are producing outcomes they cannot fully stand behind. When a result is challenged, and eventually one will be, “the algorithm flagged it” is not a sufficient answer. A documented, human-reviewed decision is.

The question your program should be asking

Before your next contract renewal or platform evaluation, ask this: what does your current proctoring tool collect, and who reviews it before a result is issued?

If the answer is “a lot” and “no one,” that’s the surveillance model. It may feel thorough. It isn’t defensible.

Privacy-first online proctoring isn’t about doing less. It’s about doing exactly what’s necessary, with human judgment behind every decision that matters. That’s what produces results your program can stand behind. It’s what earns trust from your learners. And it’s what holds up when the stakes are highest.

Integrity doesn’t require surveillance. It requires precision.

{{post-cta}}

Previously on the blog, we’ve made the case for treating online proctoring as an investment — in the safety of your learners, and the integrity of your testing. We’ve detailed some of the emerging threats against fair, secure online assessments, and we’ve shown what can happen when these threats aren’t taken seriously. 

But we haven’t done a deep dive into the actual cost of online proctoring. Different providers have different billing models; the specific features you need — ID verification, participation monitoring, recorded vs. live proctoring, etc. — as well as the anticipated volume of exams, will all determine your top-line numbers. And while those numbers are important, they don’t tell the whole story. To really understand the potential cost of remote proctoring, you need to understand the ‘shadow costs’ — hidden expenses that can crop up if you focus exclusively on pricing when making your decision. 

(ps. If you're looking for Integrity Advocate's pricing, we recommend contacting our sales team, as our services are generally customizable based on your needs.)

Hidden Cost #1: Support 

The number one complaint we hear from prospective customers coming to Integrity Advocate from a competitor is the high cost of support required to get learners set up and running with other solutions. When an online proctoring tool requires learners to install an application or browser plug-in, or make changes to system settings, support rates may be between 30-40%.

Let’s break that down and look at the numbers. If you run 1000 proctored exams a session, and approximately 30% of those require a support call, that’s 300 support calls/session. If each support call takes 10 minutes to resolve, that’s 3000 minutes, or 50 hours, of tech support required on top of the cost of your proctoring service.

Hidden Cost #2: Reviewing (and Re-reviewing)

Another hidden cost of online proctoring involves resolving disputes and correcting ‘false positive’ violation flags. Many of the cheapest online proctoring tools rely heavily on AI to identify rules violations. If these aren’t followed up with a human review, innocent test-takers can easily be penalized. Even putting aside the more insidious biases of AI facial recognition, the technology is still too unreliable to be the final arbiter of ethical behavior in an online exam. AI proctoring systems can — and have — mistakenly identified facial patterns in things like wallpaper and houseplants, leading to false positive rules violations. 

And what’s the cost of this? Some proctoring services charge for exam retakes, others don’t. Even if there is no additional fee involved, consider the admin time required to investigate learner complaints and clear violations that have been falsely flagged by low-cost, automated online proctoring tools. 

Hidden Cost #3: Accessibility

One underrated question worth asking when considering an online proctoring system is: ‘how easy is it to accommodate my learners’? Especially when running online testing, accommodation is about more than extra time or support: it’s about adapting a system — generally one built with one very specific user/use case in mind — to meet the unique needs of your program. 

Most online proctoring tools are built for a higher ed audience. But we’re seeing more and more clients come from food and alcohol server certification, skills trades/health and safety training, and professional certification. On everything from LMS integration, to rule sets, to participation monitoring, these systems may require extensive customization — and additional time and money — to accommodate the unique user base, environmental and technical requirements of a non-higher ed audience. 

Hidden Cost #4: Liability

All of the hidden costs we’ve spotlighted before involve, in one way or another, the effort required to get a remote proctoring system working perfectly.  But what about when things go wrong? Ultimately, the design and implementation of a proctoring system must take into consideration the worst case scenario. 

By this we mean, consider the potential cost of a nightmare scenario — say, for example, an employee on a construction site, who has received health and safety certification from your organization, causes an accident on the job. What are the legal, regulatory or reputation implications if you are unable to prove they participated in the training and completed the requirements fully? 

The bottom line is that, ultimately, online proctoring systems aren’t something to cheap out on. This doesn’t mean buying the most expensive option on the market, of course — it means doing your research, and considering the full costs and potential implications of your choice.

{{post-cta}}

When a proctoring tool violates a participant's privacy, who is responsible? The software vendor? The organization that deployed it? Both?

Recent legislation and court decisions from Canada, the UK, and the United States have answered this question with increasing clarity: the liability rests with the organization running the testing, not the software provider. For anyone deploying online proctoring, this is not an abstract legal point. It is a direct operational risk.

The Core Issue

Organizations that deliver online training and testing have a legitimate need to confirm who is taking their assessments and that participants are engaging in good faith. Meeting that need often requires collecting sensitive personal data: ID images, biometric verification, session recordings, and audio. The question of who bears legal responsibility for how that data is handled has been answered by courts and regulators in ways that most organizations have not fully reckoned with.

The consistent finding across multiple jurisdictions is that the data-collecting organization, not the software vendor, is the accountable party.

CASL: The Canadian Perspective

Canada's Anti-Spam Legislation was created in 2014 to reinforce best practices in electronic communications and combat spam and related cyber threats. Among its provisions, CASL requires organizations to obtain consent and written acknowledgement before using invasive computer programs, and to provide users with assistance in removing such programs afterwards.

Under CASL, software is considered invasive if it interferes with the user's control of their computer system by opening programs, printing, or accessing files without their knowledge, or if it changes system settings, preferences, or commands without their knowledge.

Online proctoring tools that block restricted sites, monitor web use, require camera access, or install browser extensions clearly fall within this definition. And most proctoring plugins do not provide uninstall assistance, remaining active by design after the session ends to reduce support overhead for the vendor.

The risk for organizations: CASL violations carry regulatory penalties of up to $10 million per violation. If your proctoring system leaves you liable to CASL noncompliance, that exposure belongs to you, not your vendor.

GDPR: The Global Standard That Places Liability on the Data Owner

The EU's General Data Protection Regulation has established a universal standard for data privacy that reaches any organization handling the personal data of EU residents, regardless of where that organization is based.

Under GDPR, the organization running the testing is the data controller, while the proctoring tool is the data processor. Fines for inappropriate collection, storage, transfer, or deletion of personal data fall on the data controller, not the data processor.

Ireland's Data Protection Commission made this distinction explicit in a judgment against Slane Credit Union Limited, stating that processors cannot be used by controllers as a legislative safety net, and that it is essential that due diligence is carried out to ensure the protection of personal data.

GDPR fines can reach 20 million euros or 4% of a company's total worldwide annual revenue, whichever is higher. The liability for how a proctoring vendor handles learner data belongs to the organization that chose to deploy it.

BIPA: The Illinois Warning

American organizations are increasingly coming under regulatory scrutiny for proctoring practices. Illinois' Biometric Information Privacy Act is one of the most consequential examples.

BIPA places liability on organizations when biometric data is collected or used in a way that violates participant privacy, including failing to secure written consent and failing to publish a retention schedule outlining when data will be permanently destroyed.

Two landmark cases illustrate how serious this exposure can be.

BNSF Railway Co. was subject to a $228 million jury verdict for scanning the fingerprints of truck drivers without consent. The case was eventually settled for $75 million. The third-party vendor that provided the scanning technology was not implicated in the charges.

White Castle System Inc. faced a separate BIPA lawsuit in which the Illinois Supreme Court ruled that claims accrue with each individual finger scan, exposing the restaurant chain to a potential liability in the billions of dollars. White Castle ultimately settled for approximately $10 million. Again, the vendor supplying the technology was not the party held accountable.

The pattern across both cases is consistent: the organization that deployed the biometric technology bore the liability. The software vendor did not.

Cleveland State: A Fourth Amendment Violation

In 2022, a federal court found that Cleveland State University's remote testing requirement of a room scan constituted unreasonable search and seizure in violation of students' Fourth Amendment rights.

Cleveland State used two separate proctoring providers to facilitate these scans. Both were named in the decision. Neither was fined. The university bore the consequences.

This case illustrates two important points. First, the room scan requirement itself was the violation, regardless of which vendor implemented it. Second, choosing a proctoring tool that conducts room scans does not transfer the legal risk to the vendor. The organization that required the scan is the one that faces the consequences when that requirement is found to violate participant rights.

What This Means for Online Training and Testing Providers

These cases are not outliers. They reflect a consistent and accelerating trend in privacy legislation globally: organizations are responsible for the actions of any third-party software, plugins, or services they deploy. Vendor liability does not substitute for organizational accountability.

For organizations delivering online training and testing, this has direct implications for vendor selection. The question is not just whether a proctoring tool works. The question is whether deploying it creates liability for your organization under CASL, GDPR, BIPA, or other applicable legislation.

The steps that reduce that liability are straightforward: choose a vendor with documented privacy practices, confirm that data handling complies with the legislation applicable to your jurisdiction and your learners' jurisdictions, require clear data deletion timelines, and ensure that any software deployed on learner devices complies with consent and removal requirements.

How Integrity Advocate Approaches This

Integrity Advocate is designed to reduce the compliance exposure that comes with deploying a proctoring tool, not to add to it.

No installation is required in most cases, which eliminates CASL's invasive software provisions entirely for the majority of deployments. Data is collected only for its stated purpose and deleted by default within 24 hours of session completion. Consent is obtained before any data collection begins. Data is stored in GDPR-designated jurisdictions. Room scans are optional rather than mandatory, and can be enabled or disabled based on the organization's assessment of their necessity and proportionality.

These are not policy commitments. They are architectural decisions built into how the platform works.

{{post-cta}}

Not all proctoring tools work the same way. Before you compare features, pricing, or integrations, the most important decision is the model underneath the platform. If you get that wrong, everything else falls apart.

There are three approaches to online proctoring. Each has a legitimate use case. Each has a real trade-off. And one of them is consistently misunderstood as the safe middle ground when, in practice, not all hybrid models are equal.

As the market scales, programs are under more pressure than ever to choose the right model. Here is what each one actually means and what it means for your program.

The Three Proctoring Models

1. AI-Only Proctoring

AI-only platforms monitor sessions using algorithms. They track eye movement, audio patterns, browser behavior, and screen activity. When the system detects something outside expected parameters, it flags it. The report goes to your institution. Your team decides what to do with it.

The appeal is real. These tools are low cost, highly scalable, and require minimal vendor involvement. For programs running thousands of low-stakes assessments, that efficiency matters.

49% of students globally participated in online learning by March 2025 — driving demand for proctoring that scales without sacrificing accuracy. Source: Business Research Insights, 2026

The risk is also real. AI-only platforms typically flag 15 to 20 percent of all sessions. Many of those flags are not genuine integrity violations. Without a human reviewing the flag before it reaches your inbox, your team is doing that work. The savings on the tool often do not account for the time your staff spends sorting through incidents.

"When a result is challenged, the answer 'the algorithm flagged it' is not a defensible audit trail."

For programs where outcomes carry weight, that gap is a liability.
AI-only works when stakes are low, volume is high, and your institution has capacity to review flags internally.

2. Live Human Proctoring

Live proctoring puts a trained human proctor in the session in real time. The proctor monitors the exam as it happens, can communicate with the test taker, and can intervene if something goes wrong.

The accuracy is high. The human judgment is present. The audit trail is strong. For high-stakes licensing exams, certification bodies with regulatory requirements, and professional credentials where disputes are foreseeable, live proctoring has historically been the answer.

The trade-offs are scheduling and cost. Test takers need to book a time slot. Proctors need to be available. Per-session pricing adds up quickly at scale. For programs delivering hundreds or thousands of exams across flexible windows, the logistics become unworkable.

48% Of students expressed discomfort with webcam-based monitoring during exams — a signal that the model you choose directly affects learner trust in your program. Source: Business Research Insights survey, 2023

Live proctoring is also more intrusive for the learner. Being watched in real time creates anxiety that can affect performance. For programs that care about the experience of their test takers, that friction is worth accounting for.
Live proctoring works when stakes are high, volume is manageable, scheduling is structured, and real-time intervention is a non-negotiable requirement.‍

3. Hybrid Proctoring: The Model That Varies Most

Hybrid proctoring combines AI monitoring with human review. In principle, it offers the best of both approaches. In practice, it depends entirely on one question: when does the human review happen, and is it mandatory?

Many platforms that describe themselves as hybrid use AI for detection and offer human review as an optional tier or a paid escalation. That is not a genuine hybrid. It is AI-only with an appeal process.

Integrity Advocate is built on this model. Human review is not an upgrade.

Hybrid proctoring with mandatory human review delivers scale without shifting the review burden to your institution.

The Question to Ask Every Vendor

When a flag is raised, who reviews it, and when?

If the answer is your team reviews it, or a human reviews it if you escalate, you are looking at AI-only with extra steps. If the answer is our reviewers examine every flag before it becomes an outcome, you are looking at a genuine hybrid. That question takes 30 seconds and tells you more than a 90-minute demo will.

{{post-cta}}

Corporate training serves many purposes. Meeting regulatory requirements. Building workforce capabilities. Demonstrating due diligence. But across all of these purposes, the same assumption is made: that a training completion record is proof that training happened.

It is not.

A completion record is proof that training was accessed. It is not proof of who accessed it, whether they engaged with it, or whether the person on record is the person who actually completed it. In a regulatory investigation or legal proceeding, that distinction matters enormously.

The PricewaterhouseCoopers Case

PricewaterhouseCoopers is one of the Big Four accounting firms and the second-largest professional services network in the world. In a published regulatory investigation conducted by the Canadian Public Accountability Board, fines of over one million Canadian dollars were assessed after it was found that junior staff, managers, directors, and partners of PwC shared answers to internal training courses on auditing, accounting, and professional independence.

The regulator found that PwC had failed to establish policies and procedures to provide the firm with reasonable assurance that its workforce was completing required training as intended.

This was not a small organization with limited resources. This was one of the most sophisticated professional services firms in the world, with dedicated compliance infrastructure. And still, the internal training program failed to verify that the right people were completing the right training.

If it can happen at PwC, it can happen anywhere.

What Regulators Actually Require

Conversations with private company leaders reveal a consistent gap in understanding. Regulators generally do not stipulate specific oversight requirements for how training must be delivered or verified. They specify the outcome: that the workforce is trained.

The assumption that providing access to online training satisfies that outcome is where organizations get into trouble. Online training records are proof of training accessed, not training completed, and not by whom. Company leadership often has no evidence of individual workers' participation, and no process in place to obtain it.

When a regulatory investigation or legal action follows a workplace incident, that gap becomes the story.

Why Insurance Does Not Solve This Problem

When facing regulatory or legal action, many organizations turn to insurance protection as a backstop. It is worth understanding what insurance does and does not cover.

Insurance policies do not cover bad faith or gross negligence. The argument that company leaders have demonstrated gross negligence rests on the definition established in Hart v. Kline (1941): gross negligence as an indifference to a legal duty of care. An organization that provided training access without any mechanism to verify who completed it, or whether they engaged with it, may find that argument difficult to counter.

A completion record that cannot confirm identity or participation is not a defense. It is evidence of the gap.

What Verified Internal Training Looks Like

Integrity Advocate works with organizations to close that gap by verifying the identity and confirmed participation of internal personnel in every training session. The result is a record that demonstrates not just that training was accessed, but that the right person completed it and was present throughout.

This eliminates the exposure that comes from unverifiable training records in regulatory investigations, legal proceedings, and insurance disputes.

As one client senior leader put it: "How we deliver information to our personnel is indicative of the importance of that information to them."

The way an organization approaches training verification sends a signal about how seriously it takes what it is training people to do. For compliance training, safety training, and any instruction with regulatory or legal weight, that signal matters.

{{post-cta}}

When an organization faces legal scrutiny over a workplace incident, one of the first questions asked is whether employees received proper training. The second question is whether that training can be verified.

Industry regulators and standards bodies set the benchmarks courts use to determine due diligence. If your organization's training practices fall short of what industry associations define as reasonable, that gap becomes a liability. And across multiple industries, those associations are now saying the same thing: online training must include identity verification and proctoring to count.

Here is what five major industry bodies have said, and what it means for your organization.

Why Industry Standards Shape Legal Outcomes

Courts do not invent the definition of "reasonable" from scratch. They look to the standards published by recognized industry organizations to determine whether an employer took all practically reasonable steps to prevent harm.

That means the training practices your industry association recommends are not just best practices. In the event of an incident, they become the benchmark against which your organization is measured.

As more training moves online, those standards increasingly address a specific question: how do you know the right person completed the training, and that they actually participated?

What Five Industry Bodies Require

Human Resources Professionals

HR professionals use online training to address ethics, harassment, violence prevention, and job-specific compliance. In 2017, the Chartered Professionals in Human Resources (CPHR) issued an alert to members conducting online training of regulatory, due diligence, or operational significance:

"Some organizations have already responded by not accepting online training for high-risk activities, while others have mandated the utilization of technology that verifies both the identity and the participation of personnel completing online training that is legally and/or operationally critical. Technology exists that mitigates the issues facing compromised training by verifying both the identity and participation of trainees."

Industry Associations

Organizations in high-risk operational sectors use online training to manage safety and emergency preparedness. The Canadian Association of Petroleum Producers (CAPP) has stated directly that it is vital that employers can verify that the intended personnel received the online training and that they participated in it as intended.

Health and Safety Associations

Health and safety bodies are responsible for defining what counts as reasonable risk control for their sectors. In the IOSH Alberta Industry best practice guidelines, they state that identity verification and proctoring technology is particularly critical when organizations use web-enabled educational materials as part of risk control strategies.

Professional Accreditation Entities

Organizations that issue Continuing Education Units (CEUs) have a direct stake in confirming that the person who registered for training is the person who completed it. The IACET Standard for Continuing Education and Training, category 8.1, states that the provider shall have a process verifying that the learner who registers and participates in the learning event is the same learner who receives IACET CEU.

Standards-Setting Bodies

Standards bodies provide the technical requirements that regulators and industry groups reference. The ANSI/ASSE Z490 standard specifies that each trainee being evaluated shall be properly identified, and that delivery records for each training event shall identify the trainee's participation in the training.

When Regulators Make It Law

Industry standards inform expectations. But in some jurisdictions, those expectations have become legal requirements.

For OSHA training in New York City, only in-person training and actively proctored online training will be accepted. The standard is explicit: unproctored online training does not meet the requirement.

In November 2020, Transport Canada added requirements for online Dangerous Goods training stating that the person's identity has been confirmed prior to or at the time of the training, and that training is completed by the person whose identity has been confirmed prior to or at the time of the assessment.

These are not suggestions. They are compliance thresholds. Organizations that cannot demonstrate identity verification and active participation monitoring for regulated training are exposed.

What This Means for Your Organization

The direction is clear across every sector examined here. Online training without identity verification and participation monitoring is increasingly unacceptable, both to industry bodies and to regulators. The organizations that recognize this now are the ones that will be able to demonstrate due diligence if it ever matters in court.

Integrity Advocate works with organizations across training, certification, and compliance sectors to verify learner identity and confirm participation in online safety training, so the record your organization holds is one you can stand behind.

{{post-cta}}

As children, most of us were told never to talk to strangers. The reasoning was straightforward: not everyone can be trusted, and the risk of getting it wrong is too high.

That lesson served us well offline. Online, we seem to have forgotten it entirely.

Every day, people install applications, plugins, and browser extensions onto their devices without giving it much thought. A productivity tool here, a proctoring extension there. What most people do not realize is what can come along for the ride.

What Unfamiliar Software Can Actually Do

The risks of installing unfamiliar software range from inconvenient to serious. Depending on what is embedded in the code, a plugin or extension can:

• Infect a device with viruses or malware
• Steal personal information stored on the device or entered through the browser
• Damage or destroy the operating system
• Remotely control the device, including the webcam, without the user's knowledge

That last one is not a hypothetical.

The Cassidy Wolf Case: When a Plugin Becomes a Surveillance Tool

Miss Teen USA Cassidy Wolf was among the first public figures to experience what happens when a device is compromised through an inadvertent software installation. Her computer was infected with a Remote Administrative Tool, commonly known as a RAT, which gave a hacker complete control of her webcam without her knowledge or consent.

She was not alone. More than two dozen women had their computers compromised by the same individual. An extensive FBI investigation ultimately resulted in the hacker, a student at the time, being sentenced to prison.

The case was a turning point in public awareness about the risks of software installation. But the threat has not gone away. If anything, the volume and sophistication of malicious extensions has grown significantly since then.

Why Proctoring Extensions Deserve Extra Scrutiny

Online proctoring software sits in a uniquely sensitive position. It is installed on personal devices, often by students or workers who have no real choice in the matter. It accesses the webcam, microphone, and in some cases the full contents of the device. And it typically operates in the background, with limited visibility into what it is actually doing.

That is a significant amount of access to grant to any software, let alone software from a vendor whose code has not been independently reviewed.

There is no shortage of cases where browser extensions have caused serious harm, and proctoring extensions are not immune. Organizations that require test takers to install proctoring software are asking them to accept a level of risk that most people do not fully understand when they click install.

A Different Approach: No Download Required

Integrity Advocate was built to avoid this problem entirely.

In most cases, Integrity Advocate requires no plugin, extension, or application installation to use the service. The platform is browser-based and accessible via any secure browser, on any device, at any time. There is nothing to install, nothing running in the background, and no code sitting on a test taker's machine after the session ends.

For use cases that do require a lockdown browser, Integrity Advocate takes a fundamentally different approach than most providers:

• All code is open source, meaning anyone can inspect what it does
• The program does not send data from the device beyond what is required for the session
• The program does not receive updates after installation, which eliminates the most common vector for malicious code injection

This matters because the majority of install-based risks come from updates pushed after the initial installation, often without the user's awareness or explicit consent. Removing that vector removes most of the risk.

Applying the Lesson We Were Already Taught

We still tell children not to talk to strangers online. The same instinct that underlies that advice applies to software. If you would not hand a stranger the keys to your house, you should think carefully before granting an unfamiliar application access to your webcam, microphone, and file system.

Organizations choosing a proctoring provider have a responsibility to apply that same scrutiny on behalf of the people taking their assessments. The question is not just whether the software works. It is whether the people required to install it can trust what it does.

Want to see how a no-download proctoring solution works in practice?
Book a Demo →

{{post-cta}}