How to Stop Exam Malpractice with CBT Software: A Practical Guide for Principals

Methodology note: This is a practical guide, not a lab test of software. Every statistic below is dated and sourced (WAEC's Lagos results announcement, August 2026; JAMB's weekly bulletin, 31 August 2026). Feature descriptions are taken from vendors' own published documentation and tutorial videos, checked in September 2026. Where a claim couldn't be independently verified, we say so.

In August 2026, WAEC announced that the results of 167,486 candidates — 8.59% of everyone who sat the 2026 WASSCE in Nigeria — were withheld over suspected exam malpractice. That's a slight improvement on the 9.7% withheld in 2025, but read the other way: roughly one in twelve candidates sat an exam whose result is now in doubt. And malpractice isn't getting less creative. JAMB disclosed that its 2025 investigations uncovered 4,251 cases of fingerprint blending (a biometric manipulation technique), 192 cases of AI-assisted impersonation using photo-morphing technology, and "mercenary" candidates paid up to ₦1 million to write exams for others.

In response, JAMB announced in its weekly bulletin of 31 August 2026 that it will introduce facial biometric verification in partnership with NIMC, eventually replacing fingerprint authentication within two to three years. The biggest examination bodies in Nigeria are now betting on technology to defend exam integrity. This guide explains what technology can actually do — and what it can't — so your school can use CBT software to close the cheating routes that are genuinely closable, instead of buying false confidence.

The short version (for skimmers)

How students and staff cheat	What good CBT software does about it	The limitation
Question paper leaks before the exam	Papers live only inside the system; questions can be randomised from a large bank per student	Staff with access to the question bank can still leak questions — control admin access
Copying from neighbours	Each student gets a different question order (and option order); one question on screen at a time	Side-by-side copying is reduced, not eliminated — invigilators still matter
Impersonation ("mercenary" writers)	Individual logins; student name, class and passport photo displayed on screen during the exam (a feature FLUXTECH and others document)	Biometric verification at JAMB's scale is beyond most school software; photo checks depend on invigilator vigilance
Invigilator-assisted cheating	Timed, auto-submitting exams; answers saved to a central server; digital audit trails	WAEC itself arrested invigilators in 2026 for aiding malpractice — software can't fix staff who aid cheating
Tampering with answer scripts	Objective questions auto-marked; no physical scripts to swap or alter	Anyone with admin database access could alter records — demand deletion/modification logs
Phones and foreign materials	Lockdown/kiosk mode blocks other apps; timed screens give less window to search	Offline LAN exams need network discipline; some students will still try
Question repetition across terms	Rotate and grow the question bank; generate fresh variants each term	Only works if teachers actually build the bank — a bank of 30 questions per subject is no bank at all

Bottom line: CBT software removes the cheap, easy ways to cheat — leaked papers, wholesale copying, script tampering. It does not remove the expensive ones — colluding staff, hacked networks, organised fraud. Principals should buy software for the first, and policies for the second.

Why paper exams are so easy to compromise

Before judging what CBT fixes, be clear about what it replaces. Paper-based exams in Nigeria have five classic failure points:

• Printing and distribution. Papers are printed, bundled, stored and moved — every handoff is a leakage opportunity. Nigeria's most famous malpractice scandals have started in this chain, not in the exam hall.
• Identical papers for everyone. Every candidate in a hall sees the same questions in the same order, which makes copying efficient and answer-sharing scripts ("runs") profitable.
• Human marking. Scripts pass through hands — collectors, markers, recorders. Marks can be changed, scripts swapped, "special" scripts inserted. This is why objective papers are the first things schools digitise.
• Weak identity checks. A tired invigilator with 200 photo ID cards cannot reliably catch an impersonator. JAMB's own data — 4,251 fingerprint-blending cases in one year — shows even biometrics have been gamed.
• Invigilator dependence. WAEC confirmed in August 2026 that supervisors and invigilators implicated in aiding malpractice had been arrested and would face disciplinary action. The human in the hall is both the defence and a vulnerability. CBT attacks failure points 1–4 directly. It cannot attack 5 — and any vendor who tells you otherwise is selling to you.

How CBT changes the game: seven mechanisms that actually work

1. Every student gets a different paper

This is the single most powerful anti-malpractice feature in school CBT software, and it needs almost no hardware. Instead of one printed paper, the software draws each student's questions from a question bank in a different random order — and shuffles the answer options too. The iCBT tutorial for Nigerian schools documents "question shuffling — maintain exam integrity with randomized questions" as a headline feature; GO Digitech's CBT software lets schools "configure tests to shuffle answers to every question and select a limited number of test questions in random order." If you set an exam of 50 questions drawn from a bank of 200, no two students sit the same test in the same order.

Why it matters: It kills the economics of "runs" (pre-prepared answers). An answer key for question 1 doesn't exist when question 1 is different for every student.

The catch: Randomisation only works with a real question bank. Fifty questions drawn from a bank of fifty-five is cosmetic. Schools should build toward at least 3–4x the number of questions per exam before claiming this benefit — and teachers must stop reusing identical papers term after term.

2. Strict, server-controlled timing with auto-submit

CBT exams run on a countdown. When time expires, the exam auto-submits — the iCBT software explicitly documents this feature, and it's standard across the market. Students can't "just finish this last question" while an invigilator looks away, and they can't stall while someone feeds them answers.

The catch: Auto-submit punishes students with slow machines or typing difficulties as hard as it punishes cheaters. Run a dry-run with the actual equipment, and keep a small time buffer policy for genuine technical faults.

3. Lockdown of the exam device

Proper CBT software runs the exam in a locked-down window: no switching to a browser, no opening files, no copy-paste. Independent security tools for exams go further (blocking USB drives, disabling shortcuts like Alt+Tab), but for school LAN exams, a fullscreen kiosk mode plus an invigilator who can see all screens is the practical standard.

The catch: Lockdown only covers the exam device. The student's other device — the phone in their pocket — is a policy problem, not a software one. JAMB still confiscates phones at centres despite full lockdown software; your school should too.

4. Named, photo-identified logins

CBT software like FLUXTECH's displays each student with their name, class and passport photo on screen while the test is ongoing, and flags who is logged in from the admin dashboard. This makes impersonation visible: the person at the keyboard is continuously identified, not just checked at the door. Admin logins are separately protected (FLUXTECH uses a double-protected admin login with password plus security key).

The catch: School CBT software is not JAMB's facial-biometric verification system. Photo-on-screen helps an attentive invigilator spot a substitute; it won't catch one if nobody's watching. Enrolment discipline — capturing real photos at registration — is where this starts.

5. No physical scripts to tamper with

Objective questions are marked by the machine, instantly, and scores go straight to the server. There is no bundle of scripts to intercept, no marks to alter in transit, no "result blackout" period where grades can be quietly adjusted. FLUXTECH goes further on the audit side: deleted results are recorded in a log showing which admin deleted them — "to promote transparency." Demand this feature from any vendor: every modification or deletion of a score should leave a log entry naming the staff member.

The catch: Digital records can be altered by whoever controls the database. Ask vendors: who can edit scores after marking, and does the system record it? If the answer is vague, assume the worst.

6. A live invigilator dashboard

Good CBT software shows the exam administrator, at a glance, who is logged in, who has started, who is idle, and who has submitted — FLUXTECH's admin homepage shows total questions, exams, admins and students in one view. Some platforms log per-question timestamps and flag suspicious activity patterns (e.g., a student answering 50 questions in 90 seconds).

The catch: Dashboards don't invigilate themselves. The value is that one invigilator can now monitor what used to require three — but someone must actually watch.

7. Question-bank rotation kills paper recycling

On paper, schools often reuse the same exam questions year after year — and students know it. A digital question bank makes it cheap to generate a fresh paper each term: pick 50 random questions from 200, shuffle options, and last term's paper is worthless as a "runs" document.

The catch: This is the one mechanism that costs teacher time, not money. Budget a question-writing session each term, or the bank goes stale.

What CBT cannot stop — read this before you buy anything

Here are the cheating routes that software barely touches:

Colluding staff. WAEC's 2026 announcement included arrested invigilators. If teachers or invigilators are willing to help students cheat — shouting answers, allowing phones, "looking away" — no software stops it. CBT raises the price of this corruption (it's harder to be subtle when every answer is timestamped), but it doesn't prevent it. Staff integrity, rotation of invigilators, and consequences for caught staff are policy work.

"Special centres." Schools whose business model is guaranteed passes will find ways around any system. If your goal is genuine integrity, this is a market-positioning decision, not a software purchase.

Network-level fraud. JAMB's 2025 investigations found syndicates hacking into test centre networks to remotely control candidates' computers, and centres using hidden "strong rooms" to pipe outside network access into exam halls. An offline LAN-based CBT setup (the kind covered in our offline CBT guide) removes the internet attack surface, but physical network security is still the school's job: lock the server room, control the switches, don't let "technicians" nobody vetted touch the lab.

Question-bank leaks by insiders. The person who types questions into the system can photograph or copy them out. Limit question-bank access to a small, named group; change admin credentials each term.

A final caution on vendor claims: JAMB's 2025 experience — 4,251 fingerprint-blending cases, AI photo-morphing, hacked centre networks — is proof that determined, funded fraud defeats national-scale security systems. Any CBT vendor that promises your school "100% malpractice-free exams" has not read the news. What good software does is make cheating harder, rarer, and more detectable — which, at school level, is usually enough.

The features to demand: a principal's checklist

When evaluating any CBT software — Marksheet's or anyone else's — ask these questions. A vendor that answers clearly is a vendor you can work with.

Feature	Why it matters for malpractice	What to ask the vendor
Question & option randomisation	Different paper per student kills copying and "runs"	"Can each student get a different order? Different options? Can I draw 50 random questions from a 200-question bank?"
Timed exams with auto-submit	No stalling, no overtime "finishing"	"What happens exactly when time expires? Can a student re-open a submitted exam?"
Lockdown/kiosk exam mode	Blocks other apps, tabs and copy-paste during the exam	"Can a student Alt-Tab out of the exam? What happens if they try?"
Individual student logins with photo	Continuous identity check, not just at the door	"Does the student's photo show on screen during the exam? Who can create logins?"
Auto-marking with server-side scores	No scripts to tamper with in transit	"Where are scores stored? Who can change a score after marking, and is the change logged?"
Admin activity logs	Deters insider tampering; names who changed what	"Show me the log of a deleted or edited result. Does it name the admin?"
Offline/LAN capability	Removes internet-based attacks and "strong room" tricks	"Can the exam run with the internet completely disconnected?"
Live monitoring dashboard	One invigilator sees the whole hall's status	"Can I see who is logged in, idle, or submitted, in real time?"

Two features schools routinely undervalue: activity logs (mechanism 5's audit trail) and per-term question rotation (mechanism 7). Both are free once the software exists — they just need discipline.

A principal's exam-day playbook

Software is half the defence. Here's the operational half, in the order you'd use it:

Before the term:

• Build (or grow) the question bank to at least 3–4x questions per exam per subject. Assign this as a term deliverable, not a favour.

• Restrict question-bank and admin access to named staff. Change admin credentials each term.

• Run a mock exam on the actual lab equipment. Time it, break things, fix them. Exam week:

• Collect phones at the door — every student, every paper. JAMB does this at centres with full lockdown software; your school should too.

• Seat students with space between them and vary seating by exam (randomised seating defeats pre-arranged copying pairs).

• Verify logins against real enrolment photos. One impersonator caught publicly deters ten.

• Disconnect the lab from the internet during exams if your software runs offline (see our offline CBT setup guide). Lock the server/switch room. During the exam:

• Keep the invigilator-to-student ratio as stated, and rotate invigilators between halls. Watch the monitoring dashboard for idle logins and impossibly fast submissions.

• Enforce the auto-submit. No extensions without the principal's sign-off, logged. After the exam:

• Review the logs: who logged in late, whose answers came in bursts, which admins touched scores. Investigate anomalies the same week, not next term.

• Publish the integrity stats to parents: "This term, 412 students wrote CBT exams; 3 impersonation attempts were caught at login." Transparency is a deterrent and a marketing asset.

Where Marksheet fits in

Disclosure: this guide is published by Marksheet, and Marksheet is one of the CBT products available to Nigerian schools.

Marksheet is built for exactly the school-level scenario this guide describes: exams run on the school's own network, with or without internet, and the strongest anti-malpractice mechanisms — randomised papers from a real question bank, timed auto-submitting exams, individual photo-identified logins, instant machine marking, and admin activity logs — are the core of the product. If you're comparing options, our CBT software comparison reviews eight products on the same evidence standard.

Our limitations, stated plainly:

• Marksheet is not a biometric proctoring system. JAMB's facial-verification programme is a national-identity project; school CBT software, including ours, identifies students by login and photo — which is a meaningful step up from a paper register, but not the same thing.
• Hardware and network security are the school's. We can run exams fully offline on your LAN, which closes the internet attack surface, but someone has to lock the server room and control the switches. That's you, not us.
• Staff conduct is outside any software's reach. Our logs will show you exactly which admin changed a score and when — but the decision to act on that information is a management decision.
• Question banks need feeding. The randomisation that kills "runs" only works if teachers keep adding questions. We'll make it easy; we can't make it automatic. On pricing and total cost of running CBT exams, see our 2026 pricing guide. And if you want to see how these mechanisms look in a real exam hall, book a demo at https://www.marksheet.top — we'll run a live malpractice-resistance walkthrough on your own questions.

Frequently asked questions

Can students still cheat in a CBT exam?

Yes — less, but yes. CBT removes the easy routes (leaked papers, copying identical papers, script tampering) but can't stop colluding staff, phones smuggled into the hall, or impersonation if invigilators don't check. Treat software as one layer, not the whole defence.

Does CBT stop impersonation?

It raises the bar significantly: individual logins, photos on screen during the exam, and per-student login records make substitution visible. It does not match JAMB's new facial-biometric verification, which cross-checks against NIMC's national database. For school exams, photo-on-screen plus attentive invigilation catches most cases.

Do we need internet to run malpractice-resistant CBT exams?

No — and offline is arguably more resistant to the network-hacking attacks JAMB uncovered in 2025. LAN-based exams with no internet connection have no remote-attack surface at all. See our offline CBT guide for setup details.

What happens if the power fails mid-exam?

On any serious CBT software, answers are saved continuously (or per-question) to the local server, so a power cut loses at most the current question — students log back in and continue. Ask your vendor to demonstrate this before you buy; it's the most common exam-day failure in Nigeria.

How many questions do we need for randomisation to matter?

As a rule of thumb: a bank of at least 3–4 times the exam length per subject. Fifty questions drawn from a bank of 200 gives meaningfully different papers; fifty drawn from sixty does not. Build the bank over several terms if needed — start with your most-cheated subjects.

Can teachers still leak questions?

Yes — anyone with question-bank access can copy questions out. That's why admin access should be limited to a small named group, credentials changed termly, and every admin action logged. Software can't fix trusted-insider leaks; access control and consequences can.

Is CBT actually cheaper than paper exams?

Over time, usually yes: no printing, no paper logistics, no manual marking labour. But the first term carries setup costs (devices, question-bank building, training). Our 2026 pricing guide breaks down real naira figures.

What about students who've never used a computer?

This is a real equity concern, especially in junior classes. Run practice/mock exams before the first graded CBT — familiarity with the interface is the biggest predictor of fair results, and it also familiarises invigilators with the system. Don't let a student's first CBT sitting be a high-stakes exam.

Can results be changed after the exam?

On paper, yes — easily. On good CBT software, changing a score requires admin access and leaves a log entry naming who changed it and when. When evaluating vendors, ask to see this log. If the software has no modification log, treat score integrity as unverified.

Will CBT alone fix our school's malpractice problem?

No — and beware any vendor who says yes. CBT is the strongest single tool a principal has, but it works inside a system: strict invigilation, phone bans, seating discipline, admin access control, and consequences for caught cheaters. The schools with the cleanest exams use all of it.

The bottom line

WAEC withheld 167,486 results in 2026. JAMB is moving to facial biometrics because fraudsters defeated fingerprints. The cheats are getting more sophisticated — and so are the defences. For a school principal, the practical conclusion is simple: digitise the parts of your exam process that paper makes fragile (identical papers, physical scripts, anonymous halls), and govern the parts that software can't reach (staff, phones, network access). Do both, and malpractice in your school becomes rare, expensive, and detectable — which is the most any system can promise.

Ready to see it in action? Book a demo at https://www.marksheet.top — we'll walk your team through a live exam with randomised papers, timed auto-submit, and full activity logging, using your own questions.