CAG calls for comprehensive overhaul of IFMS

Flags decade-long delay in implementation

Irfan Tramboo

Srinagar, Oct 2: The Comptroller and Auditor General (CAG) has called for a comprehensive overhaul of Jammu and Kashmir's Integrated Financial Management System (IFMS), flagging a more than decade-long delay in implementation, loss of Rs 11.88 crore in central assistance and serious weaknesses in access controls, data validation, transaction tracking and disaster preparedness.

Follow the Daily Excelsior channel on WhatsApp

The findings are contained in the Report of the Comptroller and Auditor General of India for the period ended March 2023 tabled during the autumn session of the Legislative Assembly.

The audit found that only four of the 12 proposed IFMS modules were fully operational as of March 2023, with the CAG describing the implementation as marked by "various deficiencies and significant delays".

The CAG attributed the loss of Rs 11.88 crore in central assistance to the failure to revise the Detailed Project Report (DPR) as directed by the Government of India and the non-achievement of prescribed milestones under the MMP-Treasury computerisation guidelines.

The audit also found that the Government of J&K had not constituted a Core Consultant Group by March 2023 to incorporate user requirements into the implementation of IFMS.

Security controls came under particular scrutiny, with the CAG recommending "role-based access control and Multi-Factor Authentication" and strict compliance with guidelines governing user authentication, data submission and financial transactions.

The audit found that Maker and Checker functions were being operated through the same user IDs with different passwords.

It also found that passwords of 1,010 TreasuryNet users had never been changed as of January 2024, while multi-factor authentication was not in place.

The CAG recommended strengthening the password-management policy through "auto password expiry and password recovery options", along with maintaining a complete audit trail of all transactions and data modifications.

The audit also found serious shortcomings in BEAMS and JKPaySys, including inadequate client-side and server-side validation that allowed erroneous and incomplete data to be submitted.

Poor integration between BEAMS and TreasuryNet affected seamless data transfer and, according to the CAG, left the system susceptible to unauthorised modification of bill particulars, including bill amounts, DDO codes, Major Heads, Detailed Heads, scheme codes and treasury voucher numbers.

The audit further found that the system did not maintain a complete trail showing who inserted or modified records, creating opportunities for unauthorised access and manipulation of sensitive information.

The CAG also flagged the absence of a comprehensive Disaster Recovery and Business Continuity mechanism and recommended a formal Disaster Recovery Plan with backup strategies, recovery-time objectives and recovery-point objectives.

The infrastructure supporting IFMS also came under criticism. Instead of upgrading the State Data Centre for hosting and storage of IFMS applications, NIC hosted the applications at its Mini Data Centre in Jammu without a supporting backup site, while the funding intended for the upgrade remained misutilised.

The audit found that User Acceptance Testing (UAT) had not been carried out, raising concerns over whether the software fulfilled user requirements and functioned effectively.

The department had also failed to obtain certification from the Standardisation Testing and Quality Certification (STQC) agency, which the CAG said indicated that the project had not adhered to industry standards for quality assurance, risk assessment and management certification.

The CAG recommended comprehensive Business Process Re-engineering and Requirements Analysis, timely integration of IFMS applications and a clear timeline and dedicated task force for completing the remaining eight modules.

It also called for involving end-users and stakeholders in the design and development of the remaining modules.

The audit further noted that administrative control of IFMS had not been taken over by the DGAT even after more than 12 years, resulting in continued exposure of sensitive data.

Overall, the CAG's findings point to shortcomings across IFMS planning and implementation, financial controls, cybersecurity, data management, testing, infrastructure and institutional oversight, prompting recommendations for stronger security, accountability and operational resilience.