CAG points out gaps in rail IT

The Comptroller and Auditor General of India has pointed out some deficiencies in the software developed by the Ministry of Railways and said it did not meet the standards of good IT practice.

The software had been developed without taking into account important conditions governing the calculations of pay, allowances, advances, etc, it said.

"Though Prime (pay roll and independent modules) met the railways' objectives partially, the application did not conform to normal standards of good IT practice," the CAG said.

In its report for 2005, the CAG suggested that the railways needed to draw up a full-fledged IT policy, implementation plan, adequate documentation and security policy in respect of application systems and physical storage of data.

The railways also needs to strengthen the standards of IT control such as segregation of duties, logical access controls and change management control to ensure the transparency and integrity of the database, which are lacking in the system.

Since the system is run in a poorly-controlled environment with inadequate documentation and has major deficiencies regarding restricting the processing of pay, allowances, advances and recovery with relevant rules, the risk of reliance upon the system in its present form was high.

Besides, absence of proper security policy and access control mechanisms coupled with absence of audit trail makes the system vulnerable to manipulations, it said.

The CAG suggested that the railways should bring out a proper plan including fixing a suitable target date so that Prime can be implemented with proper validation checks in a controlled environment.

Prime should be modified and upgraded to include additional data validation in order to eliminate the drawbacks pointed out in the system, it said.

The CAG, which went into the functioning of the Eastern Railway, found IT governance environment lacking in timely and proper implementation of major IT initiatives.

The software applications were customised without obtaining users' requirements which led to modifications of the system with added cost.

"The system could not be implemented within the stipulated period due to poor functioning of the task force responsible for implementation of the project, non-procurement of specified hardware and modifications of software," it said.

Considering these facts, the CAG recommended that the railways needed to ensure adequate planning and provision of required hardware to avoid further delay in implementation of the application and additional expenditure.

Users' requirements should be invariably taken into account for development and customisation of software, it suggested.

On the computerisation of the system, the CAG said though it had brought about some improvements in inventory management, material objectives were not fully achieved as the stability of the systems was in doubt owing to lack of adequate controls.