Yes, the CQI and IRCA ISO 27001 Lead Auditor online exam is remotely proctored. The service photographs your identification and your face, then records your webcam, microphone and screen for the whole sitting. Afterwards it matches the images and analyses the recording for unexpected sounds, movements, objects or people, flagging anything it finds to CQI for a person to review.

What does remote proctoring mean for the CQI IRCA ISO 27001 Lead Auditor exam?

What CQI and IRCA describe is recording and later analysis rather than live invigilation, and the rules for approved partners say in terms that there is no requirement for a provider to invigilate an online exam. Nothing published describes a proctor watching in real time or interrupting you mid-paper. Sit on the assumption that everything is captured and examined afterwards.

That does not make the arrangement a light one. The whole sitting is captured and can be examined in detail afterwards, which is a different proposition from a person glancing across a room.

What follows comes from CQI and IRCA’s online examination regulations and guide for learners, both issued to you before the course, and from their malpractice, appeals and reasonable adjustment policies.

The three things recorded in the CQI IRCA ISO 27001 online exam

CQI and IRCA name their assessment platform SARAS and their proctoring service Easy Proctor. Between them they do three distinct things.

• Two still images at the start — one of your photo identification, one of your face — which are compared afterwards.
• A recording of you for the duration, through your webcam and your microphone.
• A recording of your computer screen for the duration.

The screen recording is the one people do not expect. It is also what makes the ban on searching the internet for answers enforceable rather than aspirational: opening a browser tab is not something the system has to infer from your behaviour. For the same reason, close everything on the machine except your copy of the standard — and your notes, if your provider permits them — so that nothing else can arrive on screen mid-paper.

What happens to the recording of your ISO 27001 Lead Auditor exam?

Two things happen to it after sitting.

The identification image is compared to the facial image, which is the check that the person who sat the examination is the person registered for it.

Then the recording is analysed for anomalies. The published description is broad: unexpected sounds, movements, objects or people. When something is found, the incident is flagged to CQI and a human being decides what it was.

Software raising a flag is not a finding of misconduct. It is a request for someone to look. What you want is to give it nothing to raise.

Conduct rules during the CQI IRCA ISO 27001 exam sitting

Most of the rules exist because of the recording, and read more sensibly once you see them that way.

• Your webcam and microphone stay on for the whole sitting. Turning either off is named misconduct, as is positioning the camera so that your face is not always clearly in shot.
• Your face stays visible and clearly in shot for the whole sitting. Keep your head centred in the image and face the camera squarely; positioning the webcam so that your face is not always visible, or obscuring it, is called misconduct. The photo identification page covers head coverings and lighting.
• You stay silent. Reading aloud to yourself is a habit worth breaking before the day, because the microphone does not know why you are talking.
• You stay alone. Nobody else in the room, and no communication with anyone in person or electronically. This is why telling the household the time matters.
• You stay in the room except for the one permitted break, which must be taken through the on-screen button so the platform logs it. Leaving any other way is recorded as an absence and flagged.

The gaze rule, which catches people out

One item in the published list of misconduct behaviours is about you rather than about objects: continuously looking around in any direction, or looking at your wrist.

The system analyses where you are looking, not only what is on the desk. Two ordinary habits become risks. Thinking with your eyes on the ceiling is one. Checking a watch is the other, and a smart watch is a prohibited device in any case, so take any watch off, put it out of the room, and use the clock on screen.

The published wording is continuously; an occasional glance away is not the behaviour described. But if you work with your eyes anywhere but the screen, practise a paper without it.

Devices: why the recording makes the rule absolute

Possession of a prohibited device is treated as malpractice whether or not you use it, and the recording is why the rule can be written that way: a phone in shot is a fact rather than an inference, so intent never has to be argued about. Put yours in another room rather than in a drawer.

The room rules page, linked below, carries the full list of what may and may not be on the desk.

What else counts as misconduct in the CQI IRCA ISO 27001 exam?

The published examples go beyond devices, and the ones that carry the heaviest consequences are about the examination content itself.

• Disclosing, copying, photographing, recording, downloading or transmitting any examination question, answer or content, by any means. This is why sites offering “real” questions hold material somebody breached these terms to obtain.
• Holding examination questions or answers in advance of the sitting.
• Misrepresenting your identity, impersonating someone else, or arranging for someone else to sit in your place.
• Giving or receiving help, in person or online.
• Using the internet to research answers.

What happens if your CQI IRCA ISO 27001 exam sitting is flagged?

Being flagged is not the same as being found guilty of anything. The flag sends the incident to a human review under CQI’s malpractice and maladministration policy.

Where malpractice is found, the consequence is severe. A learner found guilty of malpractice receives a disqualified result whether or not they passed the paper, and CQI’s policy also allows it to bar a learner from future CQI examinations, for a fixed period or indefinitely.

There is an appeal route. CQI’s appeals policy covers appeals against a malpractice decision, malpractice is decided on the balance of probabilities, and an appeal is reviewed by a senior member of CQI staff not previously involved in the case. The deadline is 14 calendar days from receiving the decision, and there is no further appeal after the review, so if you intend to appeal, tell your provider at once and ask for the current policy.

Privacy and the recording of your ISO 27001 Lead Auditor exam

You are being recorded through your own camera, with your screen captured. That is a real intrusion and it is reasonable to think about it rather than wave it away.

Practically: choose the room and the machine with the recording in mind — a neutral background, a closed desktop, nothing in shot you would not show a stranger.

Now the honest part, because this readership will notice if it is fudged. The policies issued to learners do not state who holds the recording, for how long, where, or on what basis. What they describe is the proctoring service capturing it, analysing it and flagging incidents to CQI. If the answer matters to you — and for people who audit information security for a living it reasonably might.

If you have a concern about who reviews the recording, that is a different question with a published answer: CQI’s reasonable adjustment policy recognises requests of this kind. They are made through your provider before the course starts, and the walkthrough of the sitting sets out how.

Frequently asked questions about CQI IRCA ISO 27001 exam proctoring

Where to go next: more ISO 27001 Lead Auditor exam preparation

Photo ID rules for the online exam cover the check at the start, the online exam IT requirements cover the camera and connection the recording depends on, and the online exam room rules cover what may be on the desk while it runs.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.