Record integrity within academic integrity investigations

The present attention to record integrity within academic integrity investigations follows the public availability of generative AI tools and requires a careful distinction between public commitment, institutional practice and demonstrated result. A decision concerning the relevant requirement should recognise that interpretation should begin with the intended outcome, then identify the controls and evidence needed to show that the outcome is achieved across the declared scope. The proportionality test should consider both the identified risk and the consequences of the control for affected learners.

Purpose and present context

The intended substantive result should remain the starting point for review. Oversight of record integrity within academic integrity investigations should reflect the principle that education information should be collected for a defined purpose, protected in proportion to its sensitivity and retained only for an authorised period. Inputs and formal commitments should be distinguished from demonstrated operation and outcome. Implementation evidence should be sufficient to identify unequal consequences and assign corrective responsibility.

• Provide accessible correction and complaint routes before it is relied on for a decision with material effect.
• Control third-party processing before it informs a consequential decision.
• Verify accuracy where information affects learners within a defined period and review the result.
• Minimise collection, including material exceptions and unequal effects.
• Assign accountable data owners before it informs a consequential decision.

The substantive quality question

The historical reference basis is the public availability of generative AI tools. Its relevance to record integrity within academic integrity investigations should be assessed against the affected jurisdiction, learner population and form of provision. International developments provide context; decisions affecting learners require evidence that is current and representative of the setting concerned.

The analysis of the matter under review should make its decision rule explicit. The analysis of the relevant requirement proceeds on the basis that a reliable record should identify what occurred, when it occurred, who was responsible, the authority for the action and any later correction. Records should remain protected against unauthorised alteration while legitimate amendments remain visible. Comparable evidence should be assessed against criteria settled before the result is known.

Testing implementation and effect

A proper review of record integrity within academic integrity investigations should establish the intended outcome before selecting controls or indicators. Oversight of the matter under review should reflect the principle that a provider should be able to trace the expectation from approved policy through implementation, monitoring, identified exceptions and corrective action. The basis for selection, authority for exceptions and timing of reassessment should remain traceable.

The principal risks in relation to the stated expectation are excessive access to learner information, inaccurate data affecting decisions, uncontrolled supplier access or transfer, and secondary use without adequate authority. Separate treatment would overlook how a failed control may prevent detection or operation of another safeguard. A reliable conclusion requires examination of the connected decision record, not a series of separate document checks.

• Are partner records subject to equivalent controls?
• Is the record attributable?
• Are access rights proportionate?
• Can an amendment be distinguished from the original?
• Can records be retrieved throughout the required period?

Proportionality and exceptions

Relevant evidence for record integrity within academic integrity investigations will normally include retention and secure disposal evidence, a register of information assets and purposes, lawful authority and consent records where relevant, incident response and notification records, and supplier and transfer arrangements. Evidence should be current for the reference period, attributable and representative of the conclusion's stated scope. An unresolved contradiction is a limitation on the conclusion and should be reported as such.

For operational review of the relevant requirement, authorities and providers should proceed in a defined sequence. Review of the stated expectation should specify mandatory fields, source ownership, access rights, retention and correction procedures. Test a sample from creation through use, amendment, reporting and disposal, including records created during disruption or by a delivery partner. A finding must identify its evidential basis, reach and required response, without giving informal observations a status they do not have.

Public reporting and corrective action

Interpretation of record integrity within academic integrity investigations should produce a test that another competent reviewer can apply to comparable evidence. The test should separate mandatory conditions, recommendations and illustrative methods. A finding should describe the evidence and affected scope; it should not rely on undefined terms such as adequate, appropriate or effective without explaining the basis of judgement.

The analysis of the assurance matter should remain within the limits of the evidence. For the assurance matter, interpretive guidance should not create an obligation that is absent from the governing instrument or applicable law. Oversight of the relevant requirement should reflect the principle that security, privacy and data quality are related but distinct. A secure record may still be inaccurate or used without adequate authority, and a lawful use may still be poorly governed. Material uncertainty should result in further enquiry or an expressly limited finding.

Records relating to the matter under review should preserve both the conclusion and its limits. The correction record should state what the new evidence changes and which earlier conclusions or decisions require review. This is material where learners, authorities or institutions relied on information that cannot be corrected by replacing the current text alone.

Where the relevant requirement involves partners, suppliers or several public bodies, responsibility should be mapped across the complete service. The division of responsibilities should cover records, communication, escalation and the power to require correction. Learner safeguards should remain continuous where provision is delivered by several bodies.

Assessment of the relevant requirement should reconcile more than one source of evidence and control. Assurance should be based on the combined legal or policy basis, operating evidence and learner effect, not on one element alone.