A no-nonsense guide for safety and compliance teams adapting to ANSI/ASSP Z490.1-2024

The rules have changed. And if you’re in charge of keeping workers safe, delivering training or meeting compliance standards, you’ve likely felt the ripple.

The ANSI/ASSP Z490.1-2024 is no minor update. For the first time, both in-person and online Safety, Health and Environmental (SH&E) training are held to the same gold standard.

It’s no longer enough to say training was “offered.” You have to prove it was delivered, received and understood by the right person, in the right way, with a record to show for it.

The challenge? Most current systems weren’t built for that.

Here’s what this shift means for compliance, what to prioritize first and how to avoid the missteps that can cost you.

What’s actually new?

The ANSI/ASSP Z490.1-2024 update brings some big changes. It consolidates what were once two separate standards—Z490.1 for in-person training and Z490.2 for eLearning—into a single, unified standard for all Safety, Health and Environmental (SH&E) training.

That means no matter how your training is delivered, the expectations are the same.

You can’t just assign a course and call it complete. You have to:

• Verify the identity of the learner,
• Confirm the learner’s participation in the training, 
• Prevent unauthorized assistance (human or AI), 
• Communicate results promptly, 
• And have a record that stands up to scrutiny.

Regulators want to see due diligence from organizations that take safety and accountability seriously. Organizations need systems that demonstrate training was handled with care, intention and oversight.

The compliance gap: identity, participation and proof

Traditional LMS’ rely on user credentials to grant access. But usernames and passwords don’t confirm who actually completed the training or whether they were even in the room.

That’s a problem. Because when safety is on the line, assumptions can cost lives.

Training is meant to protect people and prepare them for the risks they face and the responsibilities they carry. If you can’t confirm who took the training or whether they were engaged, there’s more than just compliance at stake. You’re carrying a safety risk, a legal liability and a missed opportunity to do right by your workforce.

The updated ANSI/ASSP standard puts the responsibility squarely on the employer. In the event of an incident, “we assigned the module” won’t hold up. To truly protect your organization and your people, you need training that’s verifiable. That means:

• Identity verification that confirms the right person took the training
• Participation monitoring that confirms they were present and engaged
• Data protection that respects user privacy while keeping your records defensible

It's more than business

Safety incidents put everything under the microscope. Leadership. Processes. Credibility. It’s not just your operations on the line, it’s trust. And behind that? 

People’s lives. The ones training is meant to protect.

Common missteps in online training we’ve seen

Even with the best intentions, training programs can fall short, particularly when the systems in place weren’t built with today’s standards in mind.

If your current setup relies on a simple login and password, there may be gaps you haven’t considered. And if you’re using software that requires downloads or installations, you might be introducing friction for learners.

Here are a few areas where we often see room for improvement:

• Unverified attendance records that can’t confirm who actually completed the training
• Limited or no tracking of learner engagement
• Software installs that conflict with device security protocols
• Surveillance methods that may violate privacy laws
• No clear audit trail to support due diligence when it matters most

The good news is that these are fixable gaps. There are better, easier ways to meet compliance requirements today without compromising user experience, privacy or peace of mind.

What due diligence really looks like

No matter your industry—construction, food service, healthcare, manufacturing—safety training exists for a reason. Not to fill a quota. Not to tick a box.

We know you care about your workforce. You wouldn’t be reading this if you didn’t. But caring isn’t always enough, especially when systems are outdated, fragmented or easy to bypass.

Real responsibility means having a system that holds up under pressure. But how do you build a system like that without overhauling everything?

It doesn’t have to be complicated. The right tools do the heavy lifting quietly in the background, verifying identity and participation without interrupting the learning experience. No software installs. No extra logins. No support tickets flooding your inbox.

Just reliable, responsible training that works (because it’s built to).

How to get started without starting over

Already delivering training digitally? Great. You don’t need to scrap your system—you just need to make sure it can hold up under today’s standards.

Here are a few questions to help you evaluate where you stand:

• Can we confirm who completed each training session?
• Can we demonstrate that participants were engaged throughout?
• Could we confidently show this information to a regulator or investigator?

If any of those questions give you pause, it might be time to take a closer look.

Taking the Integrity Advocate approach

At Integrity Advocate, we don’t just provide tools. We partner with you to navigate compliance confidently, especially when standards change and the pressure’s on.

We help organizations meet the ANSI/ASSP Z490.1-2024 standard with:

✓ No-install identity verification and participation monitoring
✓ Mobile-friendly access that meets your learners where they are
✓ Privacy by Design to protect your organization and your people
✓ Human reviews for fairness, discretion and accountability
✓ Seamless integration and full support within your existing LMS

Need help interpreting what this new standard means for your organization? We’ll guide you through it. Meeting with regulators or external reviewers? We’ve been there too, and we’ll sit in right beside you.

Rethinking safety training in light of ANSI/ASSP Z490.1-2024

The latest ANSI update is the perfect moment to pause and reassess how we deliver training, protect our teams and uphold accountability.

Integrity Advocate is here to help you make this shift with confidence. From no-install record and review proctoring to industry-leading support levels, we make it easier to meet the standard. When training is verifiable, ethical and accessible, it doesn’t just check a box—it builds trust, saves time and protects lives.

We believe compliance can be better. And when we work together, it is.

{{post-cta}}

Online proctoring collects sensitive personal information — names, government-issued ID, facial images, behavioral data. That means any organization using a proctoring platform in Canada isn't just making a technology decision. They're making a privacy decision. And under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), that decision carries real accountability.

This guide breaks down what PIPEDA requires, how it applies to online proctoring specifically, and how Integrity Advocate is built to meet every one of its 10 principles so your program can operate with confidence.

What Is PIPEDA and Who Does It Apply To?

PIPEDA is Canada's federal private-sector privacy law. It governs how organizations collect, use, and disclose personal information in the course of commercial activity. For educational institutions, certifying bodies, and training providers using online proctoring, PIPEDA applies to any personal data collected from test takers, including biometric data, session recordings, and identity verification images.

Non-compliance isn't just a legal risk. It's a trust risk. When test takers don't trust how their data is handled, confidence in your program erodes, and that's a problem no assessment result can fix.

The 10 PIPEDA Principles and How Integrity Advocate Meets Each One

PIPEDA is organized around 10 fair information principles. Here's how Integrity Advocate addresses each:

1. Accountability

An organization is responsible for the personal information under its control. Integrity Advocate maintains a clearly defined data governance structure and designates responsibility for PIPEDA compliance internally. Clients receive documentation to support their own accountability obligations.

2. Identifying Purposes

The purposes for collecting personal information must be identified before or at the time of collection. Integrity Advocate collects only the data required to verify identity and monitor assessment sessions, nothing more. Collection purposes are communicated clearly to test takers before any session begins.

3. Consent

Individuals must give meaningful consent for the collection, use, or disclosure of their personal information. Test takers are informed of what data is collected and why before they begin, and consent is obtained as part of the session onboarding process.

4. Limiting Collection

Personal information collected must be limited to what is necessary. Integrity Advocate follows a minimal data collection model. Sensitive data, including facial images and government-issued ID, is deleted within 24 hours of session completion unless retention is required for dispute resolution.

5. Limiting Use, Disclosure, and Retention

Data must not be used or disclosed for purposes other than those for which it was collected, and must be retained only as long as necessary. Session data is used solely for the purposes of assessment integrity. Integrity Advocate does not sell, share, or repurpose personal data for any secondary use.

6. Accuracy

Personal information must be as accurate, complete, and up-to-date as necessary. Integrity Advocate's human review process ensures that session flags are assessed by a trained reviewer, not an algorithm alone, before any outcome is recorded. This reduces the risk of inaccurate findings based on automated misclassification.

7. Safeguards

Personal information must be protected by appropriate security safeguards. Integrity Advocate uses 256-bit encryption in transit and at rest, stores data on AWS infrastructure in Montreal by default, and has maintained zero data breaches across 12+ years of operation.

8. Openness

Organizations must make their privacy policies and practices readily available. Integrity Advocate's privacy practices are documented and available to clients and test takers. Organizations deploying Integrity Advocate can point test takers to clear, accessible privacy information before their session begins.

9. Individual Access

Individuals have the right to access their personal information held by an organization. Integrity Advocate supports client organizations in responding to data access requests in accordance with PIPEDA requirements.

10. Challenging Compliance

Individuals must be able to challenge an organization's compliance with these principles. Integrity Advocate provides the documentation and audit trail that organizations need to respond to any compliance challenge, including detailed session records and human reviewer notes, not just automated flags.

Why Human Review Matters for PIPEDA Compliance

One PIPEDA principle that automated proctoring platforms often struggle with is accuracy. Fully automated systems issue flags based on algorithmic pattern detection. If that flag is wrong, and automated systems do produce false positives, the data on record is inaccurate, the outcome may be unfair, and the organization is exposed.

Integrity Advocate's human review model addresses this directly. Every flagged session is reviewed by a trained person before any decision is recorded. That means the information your organization acts on is accurate, defensible, and consistent with what PIPEDA requires.

Built for Privacy From the Ground Up

PIPEDA compliance isn't a feature Integrity Advocate added. It's reflected in foundational design decisions:

• Minimal data collection, only what's required for the session
• 24-hour deletion of sensitive identity data post-session
• No secondary use of personal data for advertising, research, or resale
• Data stored in Canada, AWS Montreal by default
• SOC 2 certified for four consecutive years
• GDPR and PIPEDA compliant, designed for organizations operating across jurisdiction

Your Program Deserves a Proctoring Partner You Can Stand Behind

Choosing a proctoring platform means trusting a vendor with your learners' most sensitive personal information. That trust needs to be backed by more than a checkbox. It needs to be backed by architecture, policy, and a track record.

Integrity Advocate has operated for 12+ years with zero data breaches and 98% client retention. We're built to be the partner your compliance team can point to with confidence.

{{post-cta}}

If your organization is a university, college, hospital, or designated agency in Ontario, the Freedom of Information and Protection of Privacy Act applies to every vendor you work with that handles personal information, including your online proctoring platform.

FIPPA has governed Ontario institutions since June 10, 2006. It establishes a uniform regulatory framework for how personal information is collected, used, disclosed, retained, and destroyed. For online proctoring, which collects identity data, session recordings, and behavioral information from learners, FIPPA compliance is not optional. It is a condition of operating within Ontario's public sector ecosystem.

This guide walks through FIPPA's seven key principles and explains exactly how Integrity Advocate meets each one.

What Is FIPPA and Who Does It Apply To?

The Freedom of Information and Protection of Privacy Act serves two purposes. First, it gives individuals the right to access information held by Ontario government institutions. Second, and more relevant to online proctoring, it protects the privacy of individuals by limiting how institutions and their service providers collect, use, and disclose personal information.

FIPPA applies to all Ontario government ministries and any agency, board, commission, corporation, or other body designated as an institution under the regulations. In practice, this includes Ontario universities, colleges, hospitals, and a broad range of publicly designated organizations.

When an Ontario institution uses an online proctoring platform, the vendor handling learner data becomes accountable to FIPPA standards. Choosing a vendor that does not meet those standards creates compliance risk for your institution.

Why FIPPA Compliance Matters for Online Proctoring

FIPPA places emphasis on Privacy by Design, meaning privacy protections must be built into information systems from the ground up, not layered on after the fact. For proctoring platforms, this means the architecture itself must reflect the principles of collection limitation, purpose restriction, and timely data destruction.

Organizations using proctoring vendors that collect more data than necessary, retain it longer than required, or share it without appropriate controls are exposed to FIPPA investigations, Information and Privacy Commissioner findings, and reputational risk with learners who have a right to know how their data is handled.

FIPPA's Seven Key Principles and How Integrity Advocate Meets Each One

1. Authority to Collect and Manner of Collection

FIPPA limits the collection of personal information to authorized activities and requires that collection come directly from the individual except in limited circumstances.

Integrity Advocate collects only what is required to verify a learner's identity and monitor their session. If a learner is not permitted to access other browser tabs during their assessment, Integrity Advocate monitors exactly that and nothing more. Other proctoring providers routinely collect browsing history, desktop file lists, and program inventories that go well beyond what any assessment requires.

The only data Integrity Advocate receives from sources other than the learner directly is the learner's first name, last name, and email address, which comes from the Learning Management System solely for the purposes of identity verification and session communication.

2. Notice Requirements

FIPPA requires that individuals be informed of the collection of their personal information before it occurs.

Integrity Advocate presents its privacy policy to every user at the start of every session. Users must actively accept the policy before any personal information is collected. The privacy policy and session instructions are available in dozens of languages to ensure that consent is genuinely informed, regardless of the learner's primary language.

3. Proper Use and Disclosure

FIPPA limits the use and controls the sharing of personal information to authorized activities only.

Integrity Advocate provides a full human review service specifically designed to limit what gets shared with client organizations. When a session produces no violations, no session media is shared. When a session is flagged, only the minimum information required to document the specific concern is shared, with unrelated personal information redacted. This is the opposite of how most proctoring platforms operate, where full session recordings are routinely handed over to institutions regardless of whether a violation occurred.

4. Accuracy

FIPPA requires that processes be in place to keep personal information accurate.

Integrity Advocate session findings represent a documented snapshot of what occurred during a specific assessment. Because findings are based on human review rather than automated algorithmic flags, the information recorded is assessed for accuracy before it becomes part of any record. Session data does not change over time, which eliminates the risk of drift or corruption that can affect systems relying on ongoing data updates.

5. Retention

FIPPA requires that individuals be able to obtain access to their own personal information for a defined period.

Integrity Advocate eliminates the need for learners to submit formal access requests by proactively notifying every user by email after their session is completed and reviewed. The notification details what information was retained beyond the session and what conclusions were drawn. Learners know exactly what is on file about them without having to ask.

6. Security

FIPPA requires that personal information be kept secure and confidential.

Integrity Advocate uses 256-bit encryption for all data in transit and at rest, stores data on AWS infrastructure in Montreal by default, and has maintained zero data breaches across 12 or more years of operation. The platform holds SOC 2 certification, providing independent third-party verification of security controls. Compliant user identification images and session media are deleted within 24 hours of session completion. Personal data that does not exist cannot be breached.

7. Disposal and Destruction

FIPPA requires that the disposal and destruction of personal information be authorized and secure.

Every piece of personal data collected by Integrity Advocate carries a programmatically applied time-to-live setting. When a session is complete, deletion occurs automatically and exactly as communicated to the learner. There is no manual process, no exception handling, and no risk of data persisting beyond its intended retention period.

Built for Ontario Institutions

FIPPA is one of several privacy frameworks that Ontario institutions need to navigate. Depending on the nature of your program and the location of your learners, PIPEDA, PIPA, GDPR, and FERPA may also apply. Integrity Advocate is built to support compliance across multiple frameworks simultaneously, with the same foundational Privacy by Design architecture underlying each.

For Ontario institutions specifically, Integrity Advocate provides the documentation, audit trail, and data handling practices your compliance and legal teams need to demonstrate that your proctoring vendor meets FIPPA's standards.

‍

{{post-cta}}