Computerised Passenger Reservation System of the Indian Railways

1.1 Highlights Railways did not set out clear milestones or targets for the switch over from BSNL channels to their own OFC network. Even where the zonal railways had chalked out action plans, these were not adhered to and the progress of switch over was very slow. Railways continued to largely rely on hired BSNL channels with recurring expenditure towards hiring of the channels even though there were frequent and extensive failures of BSNL channels, disrupting the PRS services. There were also no service level agreements between the Railways and BSNL explicitly setting out the minimum guaranteed efficiency and penalties for failure and as a result the Railways did not have a structured redressal mechanism against BSNL. (Para 1.6.2) The PRS had design deficiencies necessitating manual interventions during program terminations and link failures. The Current Day Reservation System also posed problems and reservations to intermediate stations were not possible. The Coaching Refund System was not integrated with the PRS. (Para 1.6.3) General controls comprising system documentation, sound IT security practices, change management and structured disaster recovery policy were inadequate. There were deficiencies both in physical access and logical access controls. The total number of users with supervisory privileges was very high and booking clerks were also routinely assigned supervisory privileges, creating a risk of possible misuse of the powers associated with the privileges. The mechanism of change management was inefficient and policy changes were not incorporated in the system software in a timely manner. There was no structured disaster recovery policy and the maintenance and protection of infrastructure as well as the data was inadequate. Application controls were weak and a number of tickets were booked on fictitious details, indicating bogus/proxy booking in advance and thereby decreasing the availability of seats to genuine passengers.