A graduation ceremony celebrates years of work. The degree handed to a student is also a promise: that the achievement it represents is real and can be trusted by employers, families and the public.
That is why the recent announcement from the University of Professional Studies, Accra, deserves the attention of every Ghanaian. At UPSA's 18th Congregation, Vice-Chancellor Professor Kwaku Mensah Mawutor said an investigation had identified more than 500 altered academic results involving 178 students. He said some students admitted paying people to change results, while others confessed to collecting money from colleagues. UPSA has withheld the graduation of some students implicated in the matter while investigations and disciplinary processes continue.
The public reporting does not establish how access was gained or the precise role of each person. Those questions should be answered through a careful investigation. But the case already makes one point clear: digital records are only as trustworthy as the people, processes and systems that protect them.
I write from more than two decades of experience in security, cybersecurity and incident management. In my work, I have seen security failures begin with something as ordinary as a permission that gives someone more access than they need—or with a trusted person misusing the access they were given. A technical problem rarely stays confined to technology. It can become a test of leadership, accountability and public confidence. Restoring a system is important; restoring trust often takes longer.
Security is a leadership responsibility
Cybersecurity is too often treated as the responsibility of an IT department—a firewall, a software platform or a technical team. That view misses the stakes.
When a university stores examination scores, student identities and qualifications in digital systems, protecting those records is part of protecting the institution's credibility. A university does not simply issue certificates. It assures the public that those certificates reflect the required work and standards.
That assurance depends on practical safeguards. Who can change a grade? Does a change require independent approval? Is the reason recorded? Can the institution determine who made the change and when? Are unusual changes reviewed and reconciled against authoritative records?
Controls such as limited access, multi-factor authentication, reviewable logs and separate approval for grade changes can reduce risk and help reveal abuse. Independent checks of official records can help identify discrepancies. Backups are essential for recovery after information is lost or damaged, but they do not prevent an unauthorized change from being made in the first place.
The reports of payments connected to the altered results point to the human dimension of security. Institutions must account for the possibility of misuse by people as well as technical weaknesses, while investigators establish how this case occurred.
Honest students must not carry the blame
Students who earned their results honestly may now face doubts they did nothing to create. Employers may question credentials; families may worry that years of sacrifice have been devalued.
UPSA has said some graduations are being withheld while the process continues. The university should be able to verify affected records and explain, in measured terms, what safeguards it is strengthening. At the same time, people identified during an investigation should not be treated as finally responsible before the relevant process is complete. Fairness and accountability must move together.
The Vice-Chancellor also described results manipulation as not entirely new to the university, while calling the latest case significant in scale. That raises a necessary question for institutional leaders: what changed after earlier cases, and how will the university know whether the new safeguards are working?
A public explanation need not reveal sensitive security details. It should give students and the public confidence that records are being checked, the investigation is credible, and prevention is being addressed—not just the immediate case.
The lesson extends beyond higher education. Banks, hospitals, public agencies and businesses all rely on digital records to make consequential decisions. The more important a record is, the greater the need to control who can change it and to detect changes that should not have occurred.
There is also a responsibility on individuals. Knowingly paying for a changed grade harms honest students and weakens confidence in every qualification issued by the institution. The people who offer and knowingly purchase such a service both contribute to that harm.
The UPSA case is a cybersecurity matter, but it is also about governance and integrity. Seeing it that way does not diminish cybersecurity. It explains why cybersecurity matters. Ghanaian institutions should treat the protection of their records as part of their duty to the people who rely on them. Leaders should not assume their controls work; they should ask for evidence that they do.
Technology can be repaired. Institutional trust is harder to restore. Trust is the real credential every institution must earn.
About the author: Kwesi Armah, MBA, CISSP, is the founder of CyberTumi, a Ghana-focused cybersecurity company. He has more than two decades of experience in cybersecurity, governance, risk and compliance, and incident management. Learn more at CyberTumi.com.