Minister Siviwe Gwarube: Detection and management of breach in the 2025 NSC examinations

Good morning ladies and gentlemen,

The NSC examination is one of the largest and most complex national undertakings in our democracy. Outside of the General and Local Government Elections, that we undertake every 5 years respectively, there is no other national logistical undertaking that compares.

This year, over 900 000 learners sat for the NSC Matric exams. They were invigilated by thousands of invigilators. Their scripts are marked by around 51 000 trained markers, mark capturers and moderators. These markers are in 183 marking centres across the country. They work together in a collaborative manner to ensure that candidates’ scripts are marked accurately, fairly and efficiently.

It is through our markers’ diligence that we were able to detect a breach in our exams. This morning, I want to inform the country that our systems worked exactly as they were designed to do: to detect, isolate, investigate and address any manipulation of the NSC exams.

Allow me to take you through the events that have transpired.

The 2025 NSC examination cycle began on Tuesday, 21st October 2025 with the writing of Computer Applications Tech Paper 1 and they concluded on 27 November 2025. According to our national monitoring, the examinations across the country were administered efficiently and without major incidents, aside from minor administrative issues that were fully resolved using established protocols.

Around 7 000 examination centres across the country operated with precision, professionalism and a shared commitment to fairness. Millions of scripts were collected securely, transported, and sorted in preparation for marking.

We are immensely grateful to all officials, invigilators, principals, teachers, and learners who contributed to this smooth process.

How the marking process is progressing

Marking commenced on 1st December 2025 in 183 marking centres across the country. Our preliminary reports indicate that marking is progressing extremely well.

Marking is scheduled to conclude on Saturday 13 December 2025, and the capturing of marks is proceeding on schedule.

A reminder of our marking system and its strength

South Africa uses a multi-layered, quality-controlled marking system, which includes:

• the appointment of expert markers based on strict criteria;
• development of detailed marking guidelines
• hosting of marking standardisation meetings;
• training of markers;
• authorisation of markers;
• moderation across all subjects;
• compliance to a tolerance range in the marking; and
• rigorous checks for consistency and accuracy.

It is this robust system that enabled us to detect an anomaly in 6 scripts in Gauteng. Our well-trained markers were able to pick up an irregularity and without delay escalated the issue to the relevant officials. Markers are our first line of defence. Their expertise is one of the greatest strengths of our system.

Detection of the anomaly

The Gauteng Department of Education officially alerted the national Department of Basic Education, on 02 December 2025, to an unusual similarity between the answers provided by a candidate with the answer provided in the marking guideline for English Home Language Paper 2.

This raised an immediate red flag and triggered standard protocols, starting with a preliminary investigation, which confirmed that a breach had indeed occurred in respect of a few of exam scripts.

Let me be clear: This detection demonstrates the effectiveness of our system.

The breach did not come to light through rumours. It was not discovered by chance. It was detected because markers, whose training includes investigative marking, are equipped to know the difference between authentic learner responses and content that should only be accessible to markers. This skill, plus our robust marking regime which involves not less than 5 layers of quality assurance, was how we were able to pick up anomalies.

Established protocols and the preliminary investigation

Once alerted, the National Department of Basic Education and the Gauteng Department of Education assembled a joint investigation team. The team began interviewing the first group of learners whose scripts were flagged and later expanded the interviews to additional learners likely to have been exposed to the material. A total of 26 learners were identified for interviews by the National Department of Basic Education.

The purpose of these interviews was carefully defined:

• to understand whether learners accessed material that should not have been accessible to them prior to the examination;
• If so, to verify the extent of the breach;
• to assess whether the similarity in responses could be explained by legitimate means; and
• to determine which question papers, if any, had been compromised

The learners interviewed admitted having prior access to both the English Home Language Paper 2 question paper and the marking guideline. Upon studying the question paper, our investigators concluded that it could only have originated from the National Department of Basic Education’s offices. Further investigation revealed that the breach extended beyond a single paper.

What the investigation has established so far

Based on interviews conducted up to this stage, we can confirm the following:

• The breach occurred at the offices of the Department of Basic Education, where question papers are set.
• Of the 162 papers that we had set, only 3 subjects were accessed prior to the examination:
• English Home Language Papers 1, 2 and 3;
• Mathematics Papers 1 and 2; and
• Physical Sciences Papers 1 and 2.
• These papers were shared via a USB storage device.

The spread seems to be confined to identified learners in seven schools in a specific area in Pretoria.

At this stage, there is no evidence that the breach spread beyond this localised area. However, we are continuing our investigation meticulously.

Our systems are robust. They have allowed us to identify that the suspect involved is an employee of the Department of Basic Education who has a child in Grade 12. Evidence suggests that she received the question paper from another Department of Basic Education employee who works in the examination unit.

Steps now being undertaken, including the NITT

To ensure the highest level of independence and rigour of the investigation into this leak, the Director-General of the Department of Basic Education is establishing a National Investigative Task Team (NITT), which will commence its work within the next 24 hours.

The NITT will include:

• an independent chairperson;
• Umalusi;
• Universities South Africa;
• Teacher Unions;
• SAQA;
• DBE officials; and
• A private forensic investigator.

The mandate of the NITT is comprehensive:
1. Confirm the exact source of the breach;
2. Confirm that the spread is indeed localised and limited to 3 subjects;
3. Identify all learners who accessed the question papers;
4. Recommend measures to safeguard the credibility of the 2025 NSC; and
5. Recommend steps to prevent future breaches.

In addition, the following investigative mechanisms will be deployed:

• appointment of an independent forensic investigator;
• investigative marking, which is a technique we utilise where specially trained markers conduct an audit of the scripts looking out for any anomalies in the answers provided by a candidate;
• verification of scripts;
• interviews with learners and invigilators;
• statistical analysis and comparative performance analysis; and
• correlation of exam marks with school-based assessment results. In this area, we are looking to identify any unexplained spikes in performance in a learner’s performance between their exams and the school assessments throughout the year.
  These tools allow us to triangulate and verify information scientifically and effectively.
  Informing Umalusi and protecting the credibility of results
  Umalusi, the Quality Assurance Council, has been formally notified and briefed on the breach.

We want to reassure the country that:

• No results have been finalised;
• No certification processes have begun; and
• A preliminary report will be provided to the National Examination Irregularities Committee on 29 December 2025, and the final report will be submitted to both the Minister and Umalusi on 31 December 2025.
  As Minister, I will work with the team to study the report to ensure that we are ready to announce the results on 12 January 2026.

Our investigations show that this incident was limited to a few individual learners in 7 schools. There is no evidence of systematic and widespread breaches and as such we don’t expect it to affect the credibility of the NSC.

The transparency we are ensuring today is not an announcement of system failure. It is a demonstration of the strength of our systems. Even though we mark around 11 million scripts, our systems can detect breaches of the nature outlined here this morning.

This is because our exam system is designed with multiple layers of protection, including:

• secure setting and printing;
• strict distribution protocols;
• locked storage;
• trained invigilators;
• multi-tiered marking by skilled markers;
• moderation; and
• advanced statistical verification.

Breaches are exceedingly rare. But when they occur, as they may in any system with human interaction, our protocols are clear, established and effective.

The fact that only a limited number of scripts triggered our alarms; that markers escalated their observations as per their training; and the system responded immediately and in full force, demonstrating that our system is functioning and able to address the matter immediately.

This sends a clear message to the public: You cannot cheat the NSC system and get away with it. We will detect it; we will investigate it; and there will be consequences.

Next steps for the affected learners and communities

I want to reassure parents, learners, and teachers in the Pretoria area:

• We will communicate directly with the schools involved;
• The DBE staff members suspected of involvement have been immediately suspended;
• Learners who are implicated will be afforded due process and treated in accordance with established prescripts;
• We are not making assumptions about guilt – each case will be individually assessed; and
• We have reported this incident to the South African Police Services for the criminal aspects of this case to be investigated, as the preliminary investigation also suggests the deliberate possession of stolen state property.

We follow a zero-tolerance approach to cheating in the NSC exams and are committed to supporting innocent learners who worked hard and played no part in this breach.

Let me state this firmly: Any individual who attempts to manipulate the NSC exam system, whether learner, official, or outsider, will be detected. Our system is designed to pick up irregularities in:

• Responses;
• Writing patterns;
• Statistical outliers; and
• Centre-level performance trends.

Those who try to cheat the system will not succeed.

We will leave no stone unturned. And we will not compromise the future of thousands of honest learners because of the actions of a few.

I want to end with a message to the young people of South Africa: Your matric certificate is a symbol of your effort, your resilience, and your integrity. When you cheat, you not only break the rules but you undermine your own future.

Our society thrives when young people believe in and uphold the importance of fairness and hard work. I want every learner to know: You never need to cheat to succeed. You are capable. You are talented. You can achieve your ambitions honestly.

To the thousands of learners who wrote their papers with honesty, we honour you by detecting those who cheated. This investigation is being conducted to protect you, your achievements, and the value of your NSC certificate.

In closing:

• Our trained markers detected a breach;
• Our established protocols have contained it;
• It is being investigated with the highest rigour;
• Umalusi, our quality assurer has been informed;
• The National Investigative Task Team will begin work immediately to establish the full facts;
• This has been isolated to a few learners in 7 schools in the Pretoria area;
• The officials suspected of being involved have been placed on suspension with immediate effect; and
• The matter has been reported to SAPS for investigation.

South Africa can rest assured that any cheating in the NSC examinations will be detected. Our systems are strong, our professionals are vigilant, and we will always act to protect the integrity of our national examinations.

Thank You.

Media enquiries:
Terence Khala – Media Relations Specialist:
Cell: 081 758 1546

Lukhanyo Vangqa – Media Liaison Officer:
Cell: 066 302 1533

#GovZAUpdates