# Your online exam attempt was flagged: what happens next

**My online quiz or exam flagged my attempt: what happens next, and what should I do?** A flag on an online quiz or exam attempt is a line in a log that a person has yet to read, never a finding against you. Delete nothing, write down what happened that day, read your course rules and the misconduct procedure, answer in writing when asked, ask to see the record, bring your evidence, and note the appeal deadline.

Published 2026-10-10 by EdProcto. https://edprocto.com/guides/your-attempt-was-flagged-what-happens-next

An email says your attempt at an online quiz or exam was flagged. Or a warning crossed the screen while you worked. Start here: a flag is a line in a log that a person has yet to read. Nobody has decided anything.

This guide speaks to you, the student. The people across the table have their own: [a fair process when a student is flagged](https://edprocto.com/guides/appeals-when-a-student-is-flagged-a-fair-process).

EdProcto publishes this guide and makes the quiz tool described near the end; its page [for students](https://edprocto.com/solutions/students) is about testing yourself on your own notes. Each source was read on 10 October 2026, and "abstract read" marks a study where only the abstract was open to us. Your own institution's procedure governs, and nothing here is legal advice.

## What does it mean when an online exam flags your attempt?

It means software added a line to a record, and a person now has something to read. A flag is a record for your instructor and never proof.

A browser flag says the page reported something: the tab was hidden, full screen ended, a copy was tried. A camera flag says software lost sight of a face, heard a noise or saw a second person. Neither says why.

Respondus (n.d.), whose Monitor product rates each recording Low, Medium or High for review, tells instructors that a flag is not in itself cheating.

A flag can still carry a consequence your instructor chose beforehand, such as marks taken off. That is a setting acting, and you can ask a person to look again.

### How often does ordinary behaviour set off a flag?

Often enough that one flag says little, though the studies are few and each covers one tool.

- **A camera.** Yoder-Himes et al. (2022) had researchers watch 298 recordings that Respondus Monitor had already rated. In 12 they saw behaviour they thought might be cheating, and the software had rated 8 of those 12 Low, 2 Medium and 2 High. Our guide to [webcam proctoring](https://edprocto.com/guides/webcam-proctoring-what-it-catches-what-it-misses-and-what-students-think) takes other counts from this paper.
- **A browser.** Geinitz (2026) studied Canvas quiz logs from about 70 students in two computing courses, and calls a quiz page losing focus "behaviorally ambiguous": a look at notes, a calculator, an accessibility need, an interruption. What a browser counts as a hidden page is in [watching a live quiz](https://edprocto.com/guides/watching-a-live-quiz-who-is-in-and-what-to-look-for).
- **Your eyes.** Glenberg et al. (1998) found, in five experiments, that people look away more as questions get harder, and that it helps: "Averting the gaze improves performance." (abstract read).

## What does a published misconduct procedure give a student?

In the three we read, from New Zealand, the United States and Sweden, it gives notice of the allegation, a chance to answer, someone to support you and a way to challenge the outcome. What you are shown, and the deadlines, differ, so read your own.

| You are given | University of Auckland (2025) | Massachusetts Institute of Technology (2026) | Lund University (2026) |
| --- | --- | --- | --- |
| The allegation | Told what the misconduct is said to be | Notice of the complaint and the policies it names | Word from your department, then an email from the Legal Division |
| What you are shown | A summary of your interview, for comment | "All the relevant information available" to its discipline committee | Students reported together can read one another's statements |
| Your answer | 10 working days | A written statement within three business days of the first meeting | A statement to "explain in your own words"; a seat at the Disciplinary Board's meeting if it goes there |
| Someone to support you | A support person may come to the interview with you | One adviser of your choice; in most cases not a lawyer | Support from the student union's ombudsman |
| The decision | By the academic head | By the preponderance of the evidence, in writing | Work is usually marked in the ordinary way where cheating is not proven |
| A challenge | A review, within 20 working days of the penalty | An appeal within five business days, against the heaviest sanctions only | An appeal to the Administrative Court |

The deadlines run from five business days to twenty working days, so find yours the day the email arrives. Auckland's statute adds that the process goes ahead without your answer once the ten days pass.

### What does an ombuds body tell students to do?

Finish your institution's own process first, and keep its last letter. The Office of the Independent Adjudicator for Higher Education (n.d.) reviews student complaints in England and Wales and publishes summaries of its cases. Its framework for providers is in the guide for instructors. Its page for students says it normally expects you to follow the internal procedures to their end, that the provider should then issue a Completion of Procedures Letter, and that a complaint must reach it within 12 months of that letter's date. It can look at disciplinary matters, and not at academic judgment.

### How do students experience an accusation?

As one of the hardest things in their studies, whether or not they did what was alleged. Pitt et al. (2021) interviewed students at an Australian university who had faced allegations of contract cheating, a far heavier charge than a quiz flag. Their first theme was "the most challenging experience of the student's life"; others were keeping it from family, and stress over every later submission (abstract read; it gives no count of students).

So feeling wrongly accused before anyone has accused you is no sign of guilt. Lund's page sends reported students to its Student Health Centre: tell someone.

## What should you do, in order, after a flag?

Seven things, in this order.

1. **Do not panic, and delete nothing.** Leave messages, files and browser history as they are.
2. **Write down what happened that day.** Tonight, while you remember: where you sat, which device, who was in the room, what interrupted you and roughly when. Date the note.
3. **Read the rules.** The test's own rules, for what was allowed. Then your institution's misconduct procedure: who decides, what you are given, every deadline.
4. **Answer when asked, in writing, plainly.** Reply by the date given. Say what happened in order, and write "I do not remember" where that is true.
5. **Ask to see the record.** The logged lines with their times, and any recording. After an [EdProcto](https://edprocto.com/) quiz that is the list headed "Security events" on your instructor's page for your attempt.
6. **Bring the evidence you have.** A connection log or your provider's outage notice, a screenshot of an error, the time on a notification, your rough paper, a note from whoever was in the room.
7. **Know the deadline for an appeal.** Find it before the outcome arrives.

## What should you not do after a flag?

Nothing that changes the record, or your account of it.

- **Do not invent or improve an explanation.** A log line is small. A false statement about it is not.
- **Do not ignore the email.** One procedure above goes ahead without you.
- **Do not agree with classmates on what to say.** Two papers that look alike raise a different question: see [collusion in online quizzes](https://edprocto.com/guides/collusion-in-online-quizzes-timing-and-answer-pattern-evidence).
- **Do not accept an untrue account to make it end, or hide a true one.** If you did break a rule of the test, say so. Nothing in this guide is a way round that.
- **Do not look for ways to avoid the log next time.** Ask what is allowed, close what interrupts you, and sit the test.

## What does an honest explanation look like?

A few plain sentences that answer the lines in your record: what happened, about when, what you can show, and what you do not know.

### Four common cases

- **The page reloaded.** "At about 14:10 the page froze. I reloaded it and carried on in the same browser. I opened nothing else."
- **A notification took you out of the window.** "A calendar reminder appeared at about 14:20. I tapped it away, and the quiz was behind another window for a few seconds. My phone shows the reminder."
- **You looked away to think.** "I look up, or down at my rough paper, when I work something out. My working for questions 4 and 6 is attached."
- **Your connection dropped.** "My connection went at about 14:31 for two minutes. The router's log is attached. I opened the same link again and continued."

Each gives a time, a cause and something to check.

## What was logged, and what does it usually mean?

Usually something dull. The table sets the wording of an [EdProcto](https://edprocto.com/integrity) record beside what often lies behind such a line, in our view.

| In the record | What it records | What often lies behind it |
| --- | --- | --- |
| "Left the quiz’s tab" | The browser reported the page hidden | A tapped notification, a minimised window, a screen that locked while you worked on paper |
| "Left full screen" | Full screen ended | The Escape key, a system message |
| "Tried to copy", "Tried to paste", "Opened the menu", "Used a keyboard shortcut", "Tried to print" | A copy, a paste, a right-click, or Ctrl or Cmd with a key, was stopped and noted | Moving your own words between boxes, a spell-check menu, a reflex save |
| "Reloaded the page" | The attempt was opened again part-way, with full screen on | A frozen page, a lost connection |
| "Asked to open on another device" | A start under an email address whose attempt was still open | A dead battery, a failed laptop |
| "Handed in after the time ran out" | The hand-in came more than two minutes late | A slow connection |

## What does the week after a flag look like for one student?

Like this. The student is invented for this guide and has no name; the record's wording is EdProcto's.

- **Monday.** The lecturer writes: Thursday's quiz shows three events on your attempt, so tell me what happened by Friday. That night, a dated note: laptop on battery, a flatmate cooking, the screen locking twice during long sums on paper, a message tapped away near the end.
- **Tuesday.** They read the module's rules and the university's procedure, note the days allowed for a reply and the right to bring someone, and ask for the record. It comes that afternoon: "Left the quiz’s tab" at 19:12:40, 19:18:05 and 19:25:31, each marked "log".
- **Wednesday.** A reply of four sentences, with a photograph of the rough paper, a screenshot of the message's time and two lines from the flatmate.
- **Thursday.** A short call, with an adviser from the students' union listening. Asked to talk through question 6, the student can.
- **Friday.** The account fits the record and the script, nothing further follows, and the score stands.

It ended well because the account was true and could be checked.

## What does an EdProcto quiz record, and what are you told beforehand?

EdProcto records events from the measures your instructor switched on, and tells you which are on before you begin. It is the best tool for a student who wants to know where they stand: its start screen names every measure that is on, with its consequence, and it keeps a short list of timed lines for a person to read.

- **Before you begin.** A box headed "Monitoring" says: "During this quiz your activity in the browser is logged. What is recorded is kept with your attempt for your instructor to review." Under "House rules" each measure has a line, such as "Leaving the tab: noticed and logged." The other endings are "you are warned", "your score is reduced", "the quiz ends" and "the attempt is flagged for review". You tick: "I understand that during this quiz my activity in the browser is logged, and that what is recorded is kept with my attempt for my instructor to review." Under the button: "Your answers are saved as you go. If your connection drops, open the same link in this browser and you continue where you were."
- **The measures.** Six act in the browser: "Leaving the tab", "Full screen", "Copy and paste off", "Right-click off", "Keyboard shortcuts off" and "Printing off". The camera, the microphone, a shared screen and an ID at the start run only where your instructor switched them on, and the start screen says so.
- **When an event is logged.** With "Warn the student" a bar reads, for example, "Leaving the tab: Left the quiz’s tab. This is logged." With "Reduce the score" it ends "Your score is reduced.", and at hand-in a tenth of the points you earned comes off for each such event, never more than half. With "End the quiz" the attempt is handed in on the spot, marked on the answers given so far, and the screen moves to your result page. With "Log it" or "Flag for review" a line is added and your screen stays as it was.
- **A reload or a second device.** Back after a reload with "Full screen" on, you first read: "This quiz runs in full screen. Your answers are saved, and the clock has kept running." On a quiz that asks for an email address and limits retakes, a start elsewhere while your attempt is open is answered: "This quiz is already open under that email address. Carry on in the browser you began in, or ask your instructor to let you back in."
- **What is kept, and what your instructor sees.** Each event keeps its kind, its time, a line saying what happened and its consequence, and the record only grows. Your instructor's page for your attempt lists "Security events": the time, the line and one word for the consequence (log, warn, reduce, end or flag). "Flagged" on your own screen is another matter: it counts questions you marked "Flag to come back to".

No setting makes cheating impossible, and a score is your instructor's to release, never a grade by itself. What a start screen owes you is in [what to tell students before a monitored test](https://edprocto.com/guides/telling-students-the-truth-about-monitoring-consent-that-builds-trust).

## Quick questions

### Does a flag mean I have been accused of cheating?

No. Software recorded something, and a person has yet to read it. The maker of one proctoring tool says the same of its own flags (Respondus, n.d.).

### Can I see what was logged about my attempt?

Ask your instructor. After an EdProcto quiz it is the "Security events" list on their page for your attempt, each line with its time ([integrity](https://edprocto.com/integrity)).

### How long do I have to reply, and to appeal?

As long as your own procedure says. In two we read, a reply was due in three business days or 10 working days, and a challenge in five or 20.

### What does an EdProcto quiz tell me before I start?

Which measures are on, what each leads to, and that the record is kept for your instructor to review. To revise before the next one, start at EdProcto's page [for students](https://edprocto.com/solutions/students).

## References

- Geinitz, S. (2026). Do online quiz-taking behaviors matter? An event-level log analysis in computer science courses. In A. Botelho, M. M. T. Rodrigo, A. Singla, H. Ogata, H. So, & Y. H. Cho (Eds.), *Proceedings of the 19th International Conference on Educational Data Mining* (pp. 642–646). International Educational Data Mining Society. [https://doi.org/10.5281/zenodo.21040117](https://doi.org/10.5281/zenodo.21040117)
- Glenberg, A. M., Schroeder, J. L., & Robertson, D. A. (1998). Averting the gaze disengages the environment and facilitates remembering. *Memory & Cognition, 26*(4), 651–658. [https://doi.org/10.3758/BF03211385](https://doi.org/10.3758/BF03211385)
- Lund University. (2026, September 1). *Cheating, plagiarism and other disciplinary offences*. [https://www.lunduniversity.lu.se/current-students/student-rights-and-responsibilities/cheating-disruption-and-harassment](https://www.lunduniversity.lu.se/current-students/student-rights-and-responsibilities/cheating-disruption-and-harassment)
- Massachusetts Institute of Technology, Committee on Discipline. (2026, October). *Committee on Discipline rules*. [https://cod.mit.edu/rules](https://cod.mit.edu/rules)
- Office of the Independent Adjudicator for Higher Education. (n.d.). *Can you complain to us?* Retrieved October 10, 2026, from [https://www.oiahe.org.uk/students/can-you-complain-to-us/](https://www.oiahe.org.uk/students/can-you-complain-to-us/)
- Pitt, P., Dullaghan, K., & Sutherland-Smith, W. (2021). 'Mess, stress and trauma': Students' experiences of formal contract cheating processes. *Assessment & Evaluation in Higher Education, 46*(4), 659–672. [https://doi.org/10.1080/02602938.2020.1787332](https://doi.org/10.1080/02602938.2020.1787332)
- Respondus. (n.d.). *Respondus Monitor: Understanding proctoring results*. Retrieved October 10, 2026, from [https://web.respondus.com/monitor-review](https://web.respondus.com/monitor-review)
- University of Auckland. (2025, October 15). *Student Academic Conduct Statute*. [https://www.auckland.ac.nz/en/about-us/about-the-university/policy-hub/education-student-experience/academic-conduct/student-academic-conduct-statute.html](https://www.auckland.ac.nz/en/about-us/about-the-university/policy-hub/education-student-experience/academic-conduct/student-academic-conduct-statute.html)
- Yoder-Himes, D. R., Asif, A., Kinney, K., Brandt, T. J., Cecil, R. E., Himes, P. R., Cashon, C., Hopp, R. M. P., & Ross, E. (2022). Racial, skin tone, and sex disparities in automated proctoring software. *Frontiers in Education, 7*, Article 881449. [https://doi.org/10.3389/feduc.2022.881449](https://doi.org/10.3389/feduc.2022.881449)