The problem here was poor consideration of requirements and inadequate governance, and there's really no substitute for just flat out doing a better job at those. After all, nobody is stopping someone developing an open suite of exam software, it's not against the law or anything. It's all very well saying that's what we need, but somebody has to actually buckle down and do it.
Especially when you deal with exam takers in the thousands.
It shouldn't require a CTO for that, IMHO.
These are the same folks who accidently leaked all of their confidential discipline records because of a "database flaw" that was automatically scraped.