Why examination data needs custody, not just a password
A password decides who can open the register. Custody decides who held it, what they changed, and who agreed to the change. Only one of those survives a challenge from a parent or a regulator.
Most institutions protect marks the way they protect a bank login. Strong password, limited user list, a locked room for the answer scripts. That protects against the wrong person getting in. It does not answer the question that actually gets asked when a result is disputed: this figure changed between the examiner’s sheet and the transcript, so who changed it, and on whose authority?
Access control is a gate. Custody is a chain. An examination system needs both, and the chain is the part usually missing.
Access answers who. Custody answers what happened.
A shared departmental login is the clearest example of the difference. It satisfies access control, because only staff know the password. It destroys custody, because every action is attributed to a role rather than a person, and no entry in the log can be traced to a hand.
The same failure appears in gentler forms: a spreadsheet emailed between examiners, a marks column corrected during a phone call, a total recalculated after the seal because the formula was wrong. In each case the mark is defensible and the history is not.
Four states, and what each one permits
A mark should never be simply editable or locked. It moves through states, and each state changes both who may act and how much of that action is recorded.
| State | Who may act | What is permitted | What the trail keeps |
|---|---|---|---|
| {{ s.k }} | {{ s.who }} | {{ s.can }} | {{ s.trail }} |
An edit and an override are different acts
This is the distinction most systems collapse, and the one an auditor cares about most.
A correction made while the register is still open, by someone whose role includes correcting it. The previous value is kept, but no approval is needed. Normal work.
A change to a sealed value. It requires an approver, a stated reason and a policy clause. It stays visible on the record permanently. Rare by design.
If your system lets a sealed mark change without naming an approver, it has no override. It only has editing that happens to be inconvenient. Overrides should be permitted, visible and countable, because a system that forbids them entirely will be worked around with a phone call.
Four pairs of duties to keep apart
Custody depends on separation. Each of these pairs, held by one person, removes the independent witness that makes the record trustworthy.
{{ d.d }}
Six questions to ask of your own system
Take one published result from last term and try to answer these from the system alone, without asking a colleague. Anything that needs a conversation is a gap in custody.
A password keeps the wrong people out for as long as it stays secret. A custody chain holds even after the password is shared, the examiner leaves, and the term is three years past. That is the difference worth building for.
See the custody chain on your own examination cycle.
A consultant walks the four states with your controller of examinations, using your regulations and your moderation rules.