eSAM - After the exam: integrity reports

Every attempt at a secure exam has an integrity report: what the student's PC did during the exam, in one page. You read it when you have a question about an attempt and, ideally, not otherwise.

Finishing an exam properly

1. On the live dashboard, choose End exam for all. This submits every open attempt and releases each PC.
2. Then choose Finalise reports. This closes off the evidence and prepares the report for each attempt.

You will often find the report is already there. An attempt's summary is sent to Moodle by itself as the attempt finishes, so Finalise reports is a way of making sure rather than the only way it happens. There is also Send report to Moodle on an individual student's page, for when you want one attempt's report now.

Finding a report

1. Open the quiz.
2. Choose eSAM integrity reports from the quiz menu.
3. You get every attempt, newest first, with the student, when they finished, and whether a report has arrived.
4. Choose Open on the attempt you want.

If an attempt says Not sent yet, open it and choose Ask the server for it now. If the service has nothing yet, the page says so plainly rather than pretending.

What the report tells you

Session facts

When the exam started and ended, why it ended, the screen mode, the version of eSAM, and how much was collected screenshots, events, messages.

Pre-flight checks

What eSAM found before the student began: a virtual machine, extra monitors, Teams not running. Each with its result and the detail the student saw.

Alert timeline

Every alert raised during the attempt, in the order it happened, with its severity, how many times it recurred, whether it was acknowledged or dismissed, who by, and any note the invigilator left. A repeated problem is one entry with a count, so read the count as well as the alert.

Release codes

If an invigilator read the student a release code to let them out of a stuck PC, it is on the record: when, and by whom. A release code in a report is normally the explanation for an odd ending, not a problem in itself.

Legal hold

Whether this attempt's evidence is being kept beyond the usual retention period.

The report also carries a standing note about what eSAM can and cannot see. Read it before drawing a conclusion: eSAM records what happened on the PC, not what happened in the room.

Reading one fairly

A report is evidence, not a verdict. Some honest cautions:

• A focus alert is not cheating. A notification, a dropped connection or an allowed calculator all take focus. Look at what happened around it.
• A virtual machine warning is common and often innocent a student running Windows on a Mac, for instance.
• Lost contact usually means the network, not the student.
• Look at the screenshots around the moment rather than the alert alone.
• An invigilator's note beats reconstruction. This is why acknowledging alerts with a note while the exam runs is worth the ten seconds.

If you are taking a report into an academic misconduct process, follow your college's procedure and tell whoever administers eSAM early the underlying evidence can be held rather than deleted on the normal schedule.

How long it is kept

Screenshots, events and messages are deleted on your college's retention schedule. The report summary stays with the attempt in Moodle. If an attempt is under a legal hold, its evidence is kept until the hold is released, and a privacy deletion request will skip it and say so.

If a student asks what was recorded

They are entitled to ask, and the answer is not a secret: screenshots of their screen, which window was in front, events, and messages between them and the invigilator. Point them at the student article What to expect, and pass a formal request to whoever handles data protection at your college.