# Appeals when a student is flagged: a fair process

**What is a fair process when an online quiz has flagged a student or reduced their marks?** A fair process after an online quiz has flagged a student treats each logged event as a record, never a finding. Read the record and the script, rule out innocent explanations, show the student the evidence and hear them before anyone decides, judge the whole picture, write down the reasons, restore marks a setting took off wrongly, and say how to appeal.

Published 2026-10-10 by EdProcto. https://edprocto.com/guides/appeals-when-a-student-is-flagged-a-fair-process

An online quiz has flagged a student: three lines in a log, and perhaps marks already taken off by a setting. A fair process from here is mostly a matter of order. The record is read, the student is heard, and only then does anyone decide.

This guide is for the lecturer, head of department or exams officer who runs that process or writes it down.

EdProcto publishes this guide and makes the quiz tool whose [integrity settings](https://edprocto.com/integrity) are described below as they run today. Every source was read on 10 October 2026. Law appears only as a regulator or a university writes it; nothing here is legal advice, and your own institution's procedure governs.

## Why is a logged event a record and not a finding?

Because it says what a browser reported and nothing about why. The event may be accurate; the inference drawn from it is where cases fail.

Leaving the page is ordinary. Wilcox and Pollock (2019) put a script into physics concept tests that 1,595 students in twelve university courses sat online in their own time, for credit that did not depend on the score, told to work in one sitting with no outside resources. About half had the test window hidden for more than four seconds at least once: 46% of 1,287 introductory students and 52% of 308 in upper-division courses. Only about a tenth copied any text, and over three-quarters of those copy events were followed within five seconds by a hidden window, the trace a web search would leave. So one event marked half the room, and the pattern that suggests looking up marked at most a tenth. The authors add that even a copy does not by itself show a search. These tests were unsupervised with little at stake, so the shares are no rate for an exam.

The maker of one learning platform says as much of its own log. Instructure (n.d.) tells instructors that Canvas quiz logs are for investigating a student's problems with a quiz and "should not be used to validate academic integrity or identify occurrences of cheating". [Watching a live quiz](https://edprocto.com/guides/watching-a-live-quiz-who-is-in-and-what-to-look-for) reports that warning at second hand and explains what a browser counts as a hidden page; we read the guide itself.

We found no study of whom browser events fall on most; for camera flags, where that has been measured, see [webcam proctoring](https://edprocto.com/guides/webcam-proctoring-what-it-catches-what-it-misses-and-what-students-think).

## What do published procedures ask for before a finding?

Six things, in different words: notice of the allegation, sight of the evidence, a chance to respond, a decision-maker who did not raise the case, a stated standard of proof, and a route of appeal.

### Three published texts

- **An ombuds framework.** The Office of the Independent Adjudicator for Higher Education (n.d.), the student complaints ombuds for England and Wales, publishes a good practice framework for disciplinary procedures. The provider carries the burden of proof: "The student should not have to disprove the allegation." The student is told in writing at the start which offence is suspected and why, receives the supporting evidence, and answers before any decision. Decisions and appeals go to people with no earlier part in the case, and reasons are recorded. It suggests finishing the formal stage inside 60 days and hearing an appeal inside 30.
- **A Canadian code.** At the University of Toronto an instructor with reasonable grounds must tell the student at once, give reasons and invite a discussion, and nothing said there may be used as evidence at a later hearing. An instructor satisfied that no offence took place says so, and the matter ends. At the tribunal the prosecutor must prove the offence "on a balance of probabilities" (University of Toronto Governing Council, 2025).
- **An American charter.** Stanford's charter presumes a student not responsible until a finding, picks panel members without the investigator, and allows an appeal within 20 days (Stanford Office of Community Standards, 2023).

### Where they disagree: the standard of proof

The ombuds framework says cases are normally decided on the balance of probabilities: more likely than not, and still on evidence. Stanford asks for clear and convincing evidence at its middle level of review and proof beyond a reasonable doubt at its highest. Find the standard in your own academic misconduct procedure before weighing a log against it.

### What goes wrong, in published casework

The process around the log goes wrong, on our reading of two anonymised summaries the same ombuds body published in February 2023 (Office of the Independent Adjudicator for Higher Education, 2023a, 2023b).

- **A fast finish.** Log-in records showed a student finishing an online exam in under four minutes. Others as quick admitted that questions had gone round a group chat; this student said they had prepared draft answers and were in no such group, and their tutor agreed they kept apart from the cohort. Two untrained officers sprang a mock exam on the student, left the explanation unexplored, and set a heavier penalty because the student had not "confessed". The complaint was upheld, with an apology, £6,000 and removal of the finding recommended.
- **Evidence nobody probed.** A panel expelled a postgraduate on what the ombuds body called confusing and misleading evidence about IP addresses, some of which the student never had the chance to answer. It recommended reinstatement.

### What an accusation does to a student

It causes severe distress, and more the longer it runs. Curtis and White (2026) asked 771 students at two Australian universities whether they had ever been investigated for academic misconduct; 22 had. More than half of the 22 reported extremely severe anxiety during the investigation, only three sat in the normal range for depression, anxiety and stress, and a higher share than among other students did not have English as a first language. This is the authors' own account of a paper we could not open, about a small group who chose to answer. Students accused over chatbots are in [what research since 2023 says](https://edprocto.com/guides/what-the-research-says-about-cheating-in-online-exams-since-2023).

## What fair process should a department adopt when a quiz flags a student?

Seven steps, each finished before the next. They are our reading of the texts above, not a tested protocol.

1. **Read the record.** Which events, how many, when, and with what consequence. In [EdProcto](https://edprocto.com/) the results page shows "3 events" or "clean" beside each student under "Integrity", and the attempt's page lists "The record of this attempt" line by line.
2. **Read the script.** Mark it before you weigh the log, as [the remote exam checklist](https://edprocto.com/guides/remote-exams-a-checklist-for-the-instructor) advises. Then ask whether the answers after an event are better or faster than those before.
3. **Rule out the innocent explanations.** A tapped notification, a screen lock, a stray key, a reload after a lost connection. Check your notes from the sitting.
4. **Talk to the student before deciding.** Say in writing what the record shows, and send it. Ask what happened and listen; spring no test.
5. **Decide on the whole picture.** The burden is yours, at your institution's standard. You may close a matter in the student's favour yourself; a finding against them belongs to someone who did not raise it.
6. **Write it down.** The record, the explanation, the decision and its reasons, whatever the outcome.
7. **Say how to appeal.** To whom, by when, on what grounds, and that someone new will hear it.

A record can end at step 3 or 4, and should when the innocent explanation fits. Until then keep the scores back: with "Show the score" at "When released", no score or mark reaches a student before you press "Release the scores".

## What do you do about marks a setting has already reduced?

Treat the deduction as provisional, run the seven steps, and restore the marks wherever the record does not support it.

### What the two automatic consequences do

With "Reduce the score", EdProcto's server takes a tenth off the attempt's earned points for each such event, on the total and not on any one mark, and never more than half: one event leaves nine tenths, five or more leave half. With "End the quiz", the attempt is handed in on the spot and marked on the answers given so far, and its record gains a line naming the measure and the event. Both act before any person has read anything, which is why a department may prefer "Log it" or "Flag for review" for work that counts.

The UK Information Commissioner's Office (n.d.) tells organisations that where software alone takes a decision with a serious effect on someone, that person needs an easy way to ask for a human to look again or to contest it. It does not say whether a quiz deduction is such a decision, and neither do we.

### Putting a deduction right

Open the student's attempt from the results page. A card headed "Reduction for security events" says how many events reduced the score, what was earned and what the score counts. Each answer below it shows the points it earned: the reduction is taken from the total, never from a mark. Type the reason under "Why you are lifting it (kept on the record)" and press "Lift the reduction". The score is then the points earned, and "Put the reduction back" undoes it. Where a quiz was ended, decide whether the sitting stands; if not, give the paper again on a copy made with "Duplicate this quiz".

## How do you tell students beforehand what is logged and what follows?

In three sentences, in the course outline and again before the quiz: what is logged, what a logged event leads to, and how to contest an outcome. Our wording: "This quiz logs it if you leave the tab. I read a logged event and ask you about it before anything else happens. If you disagree with the outcome, write to [name] within [days]."

EdProcto's start screen repeats the first part. A box headed "Monitoring" reads: "During this quiz your activity in the browser is logged. What is recorded is kept with your attempt for your instructor to review." Under "House rules" each measure that is on has a line with its consequence, such as "Leaving the tab: your score is reduced.", and the student ticks a sentence of agreement before beginning. Your process is not on that screen, so state it yourself; the research on notices is in [what to tell students before a monitored test](https://edprocto.com/guides/telling-students-the-truth-about-monitoring-consent-that-builds-trust).

## What does each kind of logged event call for?

A look first, and a conversation only where a pattern and the script point the same way. The table is our working rule, written against the lines [EdProcto](https://edprocto.com/integrity) writes.

| In the record | Rule out first | Then |
| --- | --- | --- |
| "Left the quiz’s tab", once or twice | A tapped notification, a screen lock | Note it; nothing more unless the script adds something |
| "Left the quiz’s tab" many times, each before an answer | A laptop that keeps locking | Compare the answers and their times; talk to the student |
| "Tried to copy" or "Tried to paste" | Moving one's own text between boxes | See which question; ask |
| "Left full screen", "Opened the menu", "Used a keyboard shortcut", "Tried to print" | The Escape key, a spell-check menu, a reflex | Nothing by itself |
| "Reloaded the page", "Asked to open on another device", "Reopened on another device", "Handed in after the time ran out" | A frozen page, a dead battery, a lost connection | Match it to your notes and your late rule; a device fault is no misconduct |

The count beside a student takes in every line, the server's own among them, so "3 events" may be a reload, a second device and a late hand-in.

## What does the process look like for one flagged attempt?

Like this. The student is invented for illustration and has no name; the marks follow EdProcto's marking rule.

A second-year statistics quiz has ten questions of two points, a pass mark of 60%, "Leaving the tab" set to "Reduce the score" and scores held at "When released". One attempt shows "3 events": "Left the quiz’s tab" at 14:07:12, 14:12:40 and 14:21:05, each marked "reduce". The student got eight questions right: 16 of 20, or 80%. Three reductions leave seven tenths, so each right answer reads "right · 1.4/2", the total is 11.2 and the score is 56%. A setting has turned a pass into a fail.

The lecturer reads the script: the answers after 14:07 are no faster and no better than those before. She sends the student the three lines and asks what happened. The student replies that the laptop locked twice during calculations on paper, and that a calendar reminder was tapped later. Nothing in the script contradicts this. She sets the eight answers back to 2 points each with the note "Restored after review of the record", files the exchange, and tells the student the outcome and how to appeal. The score reads 80% when she presses "Release the scores". Next term that measure is set to "Log it".

## What does EdProcto record, and what can you do with it?

EdProcto records events from six measures that act in the browser, and each event is a line for you to read. It is the best tool for a department that wants its written process and its software to agree, because every consequence is the instructor's choice, the student is shown that choice before beginning, and a mark the software moved can be set back by hand.

- **The measures**, under "Security and proctoring": "Leaving the tab" and "Full screen", and four that switch something off: "Copy and paste off", "Right-click off", "Keyboard shortcuts off" and "Printing off". No camera, microphone or screen recording runs.
- **The consequences**, each with the words the student is shown: "Log it" ("noticed and logged"), "Warn the student" ("you are warned"), "Reduce the score" ("your score is reduced"), "End the quiz" ("the quiz ends") and "Flag for review" ("the attempt is flagged for review").
- **What is kept of an event**: its kind, its time, a line saying what happened and its consequence, up to 2,000 an attempt. Each event carries the server's time, and what it does is read from the quiz's own settings. The record only grows.
- **What you can do**: "Lift the reduction" on the attempt, "Add a note, or set the points by hand" on any marked answer, "Release the scores", and "Hold them back again".

Free takes thirty students a quiz, Tutor 100, Educator 500 and the full analysis: see [pricing](https://edprocto.com/pricing) and the page [for universities](https://edprocto.com/solutions/universities). The marks are made on the server ([why it is built this way](https://edprocto.com/why)). No setting makes cheating impossible, a flag is a record and never proof, and a score is yours to release, never a grade by itself.

## Quick questions

### Is a logged event proof of cheating?

No. It shows that a browser reported something. In one study about half of the students sitting an unsupervised test left its window at least once (Wilcox and Pollock, 2019).

### What standard of proof applies to an academic misconduct allegation?

Your institution's own. The ombuds body for England and Wales says cases are normally decided on the balance of probabilities; Stanford's charter asks for more.

### Can I give back marks that a setting took off?

Yes. In [EdProcto](https://edprocto.com/integrity), open the attempt, give your reason and press "Lift the reduction".

### How long should the process take?

As short as fairness allows. The ombuds framework suggests 60 days for the formal stage, and Curtis and White (2026) report more distress where a process dragged on.

## References

- Curtis, G., & White, A. (2026, September 7). New research shows students experience extreme anxiety when accused of academic misconduct. Unis can do more to help them. *The Conversation*. [https://theconversation.com/new-research-shows-students-experience-extreme-anxiety-when-accused-of-academic-misconduct-unis-can-do-more-to-help-them-291141](https://theconversation.com/new-research-shows-students-experience-extreme-anxiety-when-accused-of-academic-misconduct-unis-can-do-more-to-help-them-291141)
- Information Commissioner's Office. (n.d.). *Rights related to automated decision making including profiling*. Retrieved October 10, 2026, from [https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/)
- Instructure. (n.d.). *How do I view a quiz log for a student?* Instructure Community. Retrieved October 10, 2026, from [https://community.instructure.com/en/kb/articles/661037-how-do-i-view-a-quiz-log-for-a-student](https://community.instructure.com/en/kb/articles/661037-how-do-i-view-a-quiz-log-for-a-student)
- Office of the Independent Adjudicator for Higher Education. (n.d.). *Good practice framework: Disciplinary procedures*. Retrieved October 10, 2026, from [https://www.oiahe.org.uk/resources-and-publications/good-practice-framework/disciplinary-procedures/](https://www.oiahe.org.uk/resources-and-publications/good-practice-framework/disciplinary-procedures/)
- Office of the Independent Adjudicator for Higher Education. (2023a, February). *Academic misconduct: CS022305* [Case summary]. [https://www.oiahe.org.uk/resources-and-publications/case-summaries/academic-misconduct-cs022305/](https://www.oiahe.org.uk/resources-and-publications/case-summaries/academic-misconduct-cs022305/)
- Office of the Independent Adjudicator for Higher Education. (2023b, February). *Academic misconduct: CS022311* [Case summary]. [https://www.oiahe.org.uk/resources-and-publications/case-summaries/academic-misconduct-cs022311/](https://www.oiahe.org.uk/resources-and-publications/case-summaries/academic-misconduct-cs022311/)
- Stanford Office of Community Standards. (2023). *Stanford Student Conduct Charter of 2023*. Stanford University. [https://communitystandards.stanford.edu/stanford-student-conduct-charter-2023](https://communitystandards.stanford.edu/stanford-student-conduct-charter-2023)
- University of Toronto Governing Council. (2025, June 24). *Code of Behaviour on Academic Matters*. [https://governingcouncil.utoronto.ca/secretariat/policies/code-behaviour-academic-matters-0](https://governingcouncil.utoronto.ca/secretariat/policies/code-behaviour-academic-matters-0)
- Wilcox, B. R., & Pollock, S. J. (2019). Investigating students' behavior and performance in online conceptual assessment. *Physical Review Physics Education Research, 15*(2), Article 020145. [https://doi.org/10.1103/PhysRevPhysEducRes.15.020145](https://doi.org/10.1103/PhysRevPhysEducRes.15.020145)