There’s a difference between an algorithm saying “these two images match” and a trained person saying “I reviewed this ID and confirmed it.” One is a data point. The other is evidence. When a result gets challenged, you need evidence. Here’s something worth knowing about online proctoring vendors: they all say they verify identity. What they don’t all mean is the same thing. And that gap, between capturing an image and actually confirming who someone is, is where a lot of programs are quietly sitting on risk they haven’t fully thought through. If you’re currently evaluating proctoring platforms, or you’re starting to wonder what your current vendor actually does when a test taker shows up to an exam, this is for you. We’re going to cover what identity verification in online assessment actually looks like, where automated-only systems run into trouble, and what it takes to produce a result that holds up when it counts. What identity verification actually means in an online exam context

‍
The basics are simple. Identity verification confirms that the person taking your assessment is the person who enrolled for it. Most platforms handle this by asking test takers to hold a government-issued ID up to their camera, capturing a live photo, and comparing the two. What varies, a lot, is what happens after those images are captured. In a fully automated system, an algorithm makes the comparison and moves on. In Integrity Advocate’s human-reviewed system, a trained reviewer examines the ID and live photo after the session is completed, verifying both that the ID is a genuine match and that the same person was there for the entire assessment. That’s a meaningfully different thing.

‍

‍

That might sound like a subtle difference right now. It won’t feel subtle when you’re sitting across from an accreditor, or responding to a candidate appeal, or explaining your identity controls to a regulatory body. “Our algorithm flagged it” and “a trained reviewer verified the ID match and confirmed the same person was present for the entire session” don’t carry the same weight in that room.

The actual threats identity verification is meant to stop

Before you evaluate any solution, it’s worth being clear about what you’re actually protecting against. Identity verification in online assessment is mainly a defence against three things.

Candidate impersonation

Someone other than the enrolled candidate sits the exam. Could be a friend, a sibling, or a professional impersonator hired through a contract cheating service. In high-stakes contexts, professional certification, regulatory licensing, safety-critical credentials, the consequences go well beyond academic dishonesty. They touch public trust in the credential itself. That’s a different kind of problem.

Proxy testing and contract cheating services

Proxy testing is impersonation at scale, and it’s growing. The same infrastructure that made remote work possible made organized contract cheating more accessible too. Professional exam-sitters exist. They’ve been around for years and they’ve gotten more sophisticated as online testing has expanded.

What makes proxy testing particularly hard to catch with automation is that the person attempting the ID check is often well-prepared. They may have a convincing fake or borrowed ID. They may have done this before, for other clients, on other platforms. An algorithm looking for obvious facial mismatches isn’t going to catch someone who’s specifically prepared to pass that check.

{{post-stat-highlight}}

Manipulated or non-standard identity documents

Automated systems compare images. They measure how closely two images match. They’re not built to assess whether a document looks legitimate, whether something about it seems off, or whether the context around the ID presentation is consistent with someone who is genuinely who they say they are.

If you need a recent illustration of just how thin that defense is: a UK nonprofit surveyed around 1,300 children aged 9 to 16 and found that about half believe online age verification checks are easy to bypass. One documented method was drawing a fake mustache on their face with a makeup pencil. A 12-year-old was verified as 15. It worked. Other workarounds included pointing webcams at video game characters and making unusual facial expressions until the software stopped trying. TechCrunch covered it in May 2026.

These are AI systems built specifically for facial verification. A makeup pencil broke them. In an exam context, where a candidate may have a professional credential, a licence, or a career on the line, the motivation to try something is considerably higher; and the workarounds available are more sophisticated than drawn-on facial hair. Automated ID checks in high-stakes assessments face the same fundamental vulnerability, with significantly higher consequences when something slips through.

Beyond outright manipulation, non-standard ID documents from other countries are a real operational headache for automated systems. A document that an algorithm can’t parse correctly – because it looks different from its training data, often gets flagged for the wrong reasons. Not because anything is wrong. Just because it looks unfamiliar. That’s a fairness problem as much as it is a fraud one.

Where automated identity verification falls short

Speed and scale, those are the real advantages of fully automated ID verification. They’re genuine. The problem is that optimising for speed and scale means accepting trade-offs that start to matter the moment your results have any real consequence attached to them.

It produces a log, not a defensible record

When a fully automated system approves an identity check, what it creates is a timestamp and a confidence score. That score tells you how closely two images matched according to the model. It doesn’t tell you that a human looked at the documents and made a judgment call.

The moment an outcome is challenged, that distinction is everything. There’s a big difference between “our algorithm scored the match at 94.3%” and “a trained reviewer examined the ID and the live photo and confirmed the identity match.” One is data. The other is documentation. If you’ve ever had to respond to an accreditor asking about your identity controls, you know which one you want to be holding.

Edge cases aren’t actually that rare

Facial recognition systems are trained on datasets. Those datasets have gaps, and those gaps don’t affect all test takers equally. People with darker skin tones, older candidates, people with facial differences or disabilities, and test takers presenting documents from underrepresented countries, these populations consistently get worse outcomes from automated systems.

In a program serving thousands of test takers across many countries, these aren’t rare edge cases. They’re a predictable share of your assessment cycle. A system that handles them badly is a system that consistently disadvantages specific groups of people. That’s both a fairness problem and a real compliance exposure under frameworks like WCAG and AODA.

Accommodations are invisible to algorithms

A lot of programs serve test takers with documented accommodations. Some of those accommodations affect how a test taker looks at the identity check stage. A test taker with a visual impairment may present their ID differently. Someone with a facial difference may not match their ID photo the way an algorithm expects.

An automated system has no way to know an accommodation exists. A human reviewer can, because that information can be passed to them before the check happens. They apply the context, the check goes smoothly, and the test taker isn’t penalized for something their program already knew about and approved.

What human-reviewed identity verification actually adds

Human review at Integrity Advocate isn’t a fallback for when automation fails. It’s the standard for every single check. That changes what the whole process produces, and what you can do with the results.

Judgment, not just pattern matching

A trained reviewer looking at an ID document and a live photo is doing something different from what a facial recognition model does. They’re not just asking “do these two images match?” They’re assessing whether the identity claim is plausible, taking in the quality of the document, the context of the photo, whether something feels off. That’s judgment. It’s not something you can fully replicate with a model.

It also means programs can explain what happened. Not just cite a score. “A trained reviewer examined the ID and the live photo and confirmed the match” is a sentence a human can understand, investigate, and stand behind.

A record that travels with the session

At Integrity Advocate, every identity check creates a time-stamped record permanently attached to the session. What was verified, when, and by whom. If an outcome from that session ever gets challenged, the identity verification record is already part of the documentation, not sitting in a separate system you have to dig through.

Appeals rarely come with advance warning. Programs that have a complete, human-confirmed record don’t have to reconstruct anything after the fact. The evidence was created at the moment of verification. It hasn’t changed.

Deterrence, not just detection

Here’s something that doesn’t get talked about enough: people behave differently when they know a human is watching. A test taker who knows their government-issued ID will be examined by a trained reviewer before the exam starts isn’t approaching that check the same way as someone who knows it’s algorithmic.

Programs that shift from automated-only to human-reviewed verification consistently see a change in the behaviour of the small slice of candidates who were willing to try something. The check itself becomes a deterrent. You catch less because less gets attempted.

‍

What to look for when you’re evaluating

If you’re shopping around, or starting to question what your current vendor actually does, here are the questions that cut through the noise.

Is a human involved in every check, or just the flagged ones?

A lot of platforms say “human review.” What they mean is that a human reviews AI-flagged sessions only, and only when the algorithm decides something is worth escalating. At Integrity Advocate, a trained reviewer looks at every session after it’s completed, verifying the ID match and confirming the same person was present throughout. That’s the question to ask: is every session reviewed, or only the ones the algorithm flags?

What does the record actually contain?

Ask to see a sample identity verification record. If the answer is a confidence score and a timestamp, that’s an automated log. A defensible record includes the ID image, the live photo, the match determination, who made it, and when. If you can’t show an accreditor a complete documentation trail, the check isn’t giving you what you actually need.

How does it handle non-standard IDs and accommodations?

Ask specifically what happens when a test taker shows up with an ID from a country with an unfamiliar format, or when an accommodation affects how they look at the check stage. If the answer is vague or relies heavily on “the algorithm handles it,” that tells you something important about how these scenarios were thought about when the product was designed.

Where does the privacy risk sit?

Identity verification collects sensitive data. Ask specifically what’s collected, how long it’s retained, and whether it’s used for anything beyond the identity check. If you have GDPR, FERPA, or PIPEDA obligations, and most programs doing anything at scale do, you need clear answers here before you commit.

‍

The bottom line

Automated identity verification is better than nothing. That’s true. But if your program issues results that actually mean something, credentials that affect career progression, licences that protect public safety, certifications that carry professional weight, “better than nothing” isn’t where you want to land.

What you need is a check that creates a record you can stand behind. Something that answers not just “did the algorithm approve this?” but “can we show that a qualified person verified this person’s identity before the exam began?” Those are different questions, and they get different responses from the people who ask them.

The cost of getting identity verification wrong doesn’t show up at the time of the exam. It shows up later, when results are challenged, when accreditors start asking questions, when credential fraud surfaces somewhere down the line. By then, piecing together what happened is hard. Having a complete record from the moment of verification isn’t.

{{post-cta}}

Your organization spent money on an online safety training program. Employees completed it. You have completion records. You feel confident that if something goes wrong, you can demonstrate due diligence.

You may be wrong.

Courts and regulators are increasingly drawing a distinction between online training that can be verified and online training that cannot. If your platform cannot confirm who completed the training and whether they actually participated, that training may not count when it matters most.

The Standard Has Changed

Workforce training moved from the classroom to the screen gradually, then all at once. The cost savings are real, the scheduling flexibility is genuine, and for many organizations online training is now the only practical option for reaching a distributed workforce.

But the shift to online created a problem that classroom training never had: how do you prove that the right person completed the training, and that they actually engaged with it rather than clicking play and walking away?

In a physical classroom, an instructor can confirm attendance and participation. Online, without the right technology, you cannot. And in high-risk industries, that gap has real legal consequences.

What the Courts Have Said

The landmark case of R. v. Rose's Well Services Ltd. made this problem impossible to ignore. During the investigation, an employee admitted to completing online training on behalf of other employees. The employer had training records. The employer had completion data. None of it mattered, because the records could not demonstrate that the right people had actually done the training.

Courts determining fault in workplace incidents use due diligence as a central test. Did the employer take all reasonably practical steps to prevent the incident? Providing online training that cannot be verified does not satisfy that test.

The legal counsel of a multinational energy company put it plainly:

"Making our safety orientation and training available on the web and requesting that personnel take the training without the ability to provide documented evidence that personnel had actually completed the required safety orientation and training would, in my opinion, not be reviewed positively in an analysis of whether a company had satisfied its due diligence requirements in the event of an incident. Due diligence is a company's only defense against a strict liability offense."

That is not a hypothetical risk. It is a legal opinion from inside a major organization that had already thought carefully about what their online training program would look like in front of a judge.

The Three Risks Unverified Online Training Creates

Someone else completes the training

Without identity verification, there is no way to confirm that the person who registered for the training is the person who completed it. The Rose's Well Services case is not an isolated incident. Proxy completion is a known problem in workplace training, particularly for mandatory compliance courses that employees view as a checkbox rather than a learning opportunity.

The learner clicks through without engaging

Completion records show that a course was finished. They do not show that anyone watched it, read it, or absorbed any of it. A learner who clicks play, leaves the room, and returns to click through the assessment has a completion record identical to one who engaged with every module. In a regulatory investigation, that distinction matters.

The record cannot be defended

Even if training was completed legitimately, an employer who cannot provide documented evidence of who completed it and how they participated is in a weak position. Regulators and courts do not give credit for training that cannot be verified.

What Some Organizations Have Done in Response

Some organizations, including Spectra Energy, have responded to this problem by removing online training from high-risk content categories entirely, citing security concerns around confirming student attendance. That is a significant operational step backward.

The Chartered Professionals in Human Resources of Alberta has taken a different position, advising that technology exists that mitigates the issues facing compromised training by verifying both the identity and participation of trainees.

That technology exists. The question is whether your organization is using it.

What Verifiable Online Training Looks Like

Verified online training confirms three things that unverified training cannot:

• Identity — the person who registered is the person completing the training
• Participation — the learner was present and engaged throughout the session, not just logged in
• Documentation — a record exists that can be produced in a regulatory investigation or legal proceeding and withstand scrutiny

Integrity Advocate has worked with organizations across construction, mining, oil and gas, and other high-risk industries to help hundreds of thousands of personnel complete training online in a way that meets regulatory standards and holds up as evidence of due diligence.

The difference between online training that counts and online training that does not is not the content of the course. It is whether you can prove who did it and that they were there for it.

The Choice Every Employer Needs to Make

Organizations running online workforce training face a straightforward decision. Implement training without identity verification and participation monitoring, and accept the legal and regulatory exposure that comes with it. Or implement training with the technology to verify both, and be able to demonstrate due diligence if it ever matters in court.

With Integrity Advocate, that second option does not require rebuilding your training program. It works with your existing LMS and course content, adding the verification layer that transforms a completion record into a defensible document.

{{post-cta}}

Automation promises speed. But in compliance, speed without accuracy can be devastating.

AI is now woven into training and certification. It monitors test-takers, flags anomalies, and produces reports at a pace no human could match. For compliance leaders facing relentless pressure, it looks like the ideal solution: scalable, efficient, impartial.

But here’s the catch: AI doesn’t grasp the stakes of being wrong.

• A missed harness check on a construction site isn’t just noncompliance, it can mean a fatal fall.
• An overlooked question in food safety training isn’t just a technicality, it can trigger a life-threatening allergic reaction.
•  A nurse credentialed without proper oversight isn’t simply a paperwork error, it’s a direct risk to patient safety.

AI-powered online proctoring software can detect patterns, but it can’t weigh consequences. It can’t tell the difference between distraction and dishonesty. It can’t stand in front of an accreditor or regulator and defend a decision.

And compliance leaders know the stakes. 64% of frontline workers say injuries they’ve experienced or witnessed could have been prevented with better training, according to a YouGov survey of more than 2,000 workers in Australia, the UK, and the US. When proctoring systems prioritize speed over judgment, gaps spill from the classroom into the workplace.

{{post-stat-highlight}}

That’s why proctoring can’t be left to automation alone. Judgment, accountability, and defensibility require a human in the loop.

AI’s blind spots

For all its processing power, AI often misses the context, fairness, and consequences behind the data.

Pattern vs. context

AI can spot anomalies, but it can’t understand people. To the algorithm, a student glancing away as their child enters the room looks no different than someone searching for an answer. Without human judgment, honest learners get flagged, reputations suffer, and trust in the system erodes, all while true violations can still slip by unnoticed.

Risks of misjudgment

The real danger isn’t just inaccuracy, it’s the consequences. A nursing candidate wrongly flagged can lose months of progress, along with trust in the system meant to support them. Meanwhile, a missed violation on a commercial driving exam could place an unqualified driver behind the wheel of your company’s vehicle, endangering both reputation and public safety.

Bias and accessibility

AI models are not neutral. From lighting conditions to facial recognition inaccuracies, automation can inadvertently disadvantage test-takers with disabilities, those in non-standard testing environments, or individuals from diverse cultural backgrounds. This creates inequities that undermine the fairness of certification processes. At Integrity Advocate, we work to eliminate these inequities, making the certification process seamless, accessible, and fair for every test-taker.

No sense of consequences

Perhaps the greatest blind spot is this: AI doesn’t “understand” what a mistake means. It cannot connect a failed harness safety check to a potential fall on a job site. It doesn’t grasp that mishandled food safety could trigger an allergen outbreak. Without that ethical and practical awareness, AI remains a tool that must be guided by human oversight.

Certifications in focus: why proctoring integrity matters

The stakes of proctoring reach far beyond academia. They’re practical and sometimes life-or-death. 

Consider a few high-stakes examples:

• Nursing exams and clinical credentials ensure healthcare workers can safely treat patients.
• Electrical licenses confirm that workers can install and maintain systems without risking fires or electrocution.
• Commercial Driver’s Licenses (CDL) certify drivers who transport goods and passengers across public roads.
• ServSafe and OSHA certifications guard against foodborne illness and workplace hazards.

These certifications aren’t just personal milestones. They validate competence in roles that protect lives and communities. Without trustworthy proctoring, credentials lose credibility. Organizations risk liability, and the public loses trust in the professionals meant to safeguard them.

AI-Only Proctoring Falls Short

When the stakes are high, oversight must be more than automated pattern recognition. AI can monitor, record, and flag, but it cannot fully understand context or consequences. Relying on AI alone risks undermining the very certifications designed to protect lives and communities.

ANSI and accreditation frameworks: compliance by design

The updated ANSI/ASSP Z490.1-2024 standard sets clear expectations for safety, health, and environmental (SH&E) training. 

For compliance leaders, a few key takeaways stand out:

• Reliability and fairness are non-negotiable.
• Oversight and defensibility must be built into training and assessment.
• Documentation and accountability are essential in the event of an audit or incident.

These requirements go beyond what automation alone can provide. Standards demand human verification, ethical review, and the ability to defend every certification decision.

Beyond ANSI: ISO and NCCA

International standards like ISO/IEC 17024 and U.S. frameworks like the National Commission for Certifying Agencies (NCCA) reinforce the same principle: defensible certification requires human oversight. Without it, organizations risk failed audits, loss of accreditation, and legal exposure.

Hybrid Online Proctoring: AI Detection + Human Discretion

The answer is not to reject AI, but to integrate it thoughtfully. The most effective approach is AI plus human oversight, where technology enhances efficiency, but people ensure fairness, context, and compliance.

Scalable monitoring with human review

AI can monitor at scale, flagging potential anomalies. But those red flags should be reviewed by trained human proctors who can interpret context and make defensible decisions.

Audit trails and documentation

Human oversight is essential for building robust audit trails. When compliance checks or regulatory audits arise, organizations must show that their proctoring process was fair, valid, and defensible. Documentation reviewed and validated by people is far more credible than machine logs alone.

Automation accelerates, human judgment protects

AI has transformed training and monitoring with unprecedented speed and scale. Yet in safety-critical industries, automation is a tool, not a safeguard. True protection comes from human judgment, ethical oversight, and alignment with compliance standards.

With standards like ANSI/ASSP Z490.1-2024 raising the bar for defensibility, organizations must recognize that proctoring isn’t just a technical step, it’s a compliance-critical safeguard that protects lives, preserves trust, and ensures training fulfills its purpose.

Smart systems drive efficiency. Human oversight delivers safety. Together, they make compliance simple, scalable, and defensible.

Online proctoring software built for compliance and trust

When compliance is defensible, organizations, and the people they serve, are safer. That’s why proctoring must go beyond automation.

At Integrity Advocate, we combine AI efficiency with human oversight to ensure every training program is verifiable, fair, and aligned with the latest standards. That means:

• Confirmed identities
• Monitored participation
• Defended credentials

No guesswork. No blind spots. Just compliance you can stand behind.

Ready to safeguard your compliance? Let’s leverage the combined power of AI and human oversight, together.

{{post-cta}}