CAG Flags Control Gaps in Haryana e-Procurement and ₹104.86 Crore Excise IT System
The Comptroller and Auditor General of India has tabled an information-systems audit of two major Haryana government platforms, identifying weaknesses in e-procurement controls and in the State excise department's licence, liquor-production and distribution system. Government of Haryana Report No. 3 of 2026 was tabled on September 1, 2026 and is particularly relevant to internal auditors, systems auditors, finance teams and professionals working on technology-enabled compliance.
The report covers the State's e-Procurement Project and the H-eCT system used for licence management, liquor production and distribution. The official CAG overview describes both governance failures and application-control gaps, showing how weaknesses in system design can translate into procurement, tax, revenue and continuity risks.
e-Procurement audit found governance and implementation gaps
CAG said implementation of the e-procurement system was deficient because an agreement with the National Informatics Centre was not executed, the Project Monitoring Unit did not function effectively, critical functions or modules were absent, monitoring was inadequate and user training was insufficient.
The audit also observed that some activities were either not performed through the system or continued to be performed offline. From an audit perspective, that matters because a digital workflow can only deliver traceability and automated controls when material steps actually pass through the controlled system.
Tender-process controls were also questioned
The CAG overview lists several weaknesses in the tendering process. These included inadequate bid publicity, insufficient time for bid submission, non-use of tender-cum-auction functionality, lack of linkage between re-invited tenders and the original tender, and nomination of duplicate users for tender processing.
System controls were also described as insufficient to prevent practices such as very short extensions of tender periods, decryption of bids on different dates and opening bids out of sequence. For procurement and internal-audit teams, these are not merely user-interface issues: they affect the audit trail around competition, timing, access and sequencing.
Fees, EMD and GST handling created financial-control concerns
CAG reported non-compliance with financial rules in the handling of fees and earnest money deposits. The official overview refers to amounts not being transferred or adjusted correctly, erroneous refunds or non-refunds, short or excess charging of fees, non-reconciliation, and non-charging or non-remittance of GST to the Government.
This is a useful reminder for system auditors that a procurement platform should not be reviewed only for access controls and uptime. Interfaces with accounting, collections, refunds, reconciliation and indirect-tax treatment form part of the end-to-end financial control environment.
₹104.86 crore H-eCT system had critical functionality gaps
The second chapter reviews the H-eCT system for licence management, liquor production and distribution in the Excise Department. CAG states that the system was implemented at an expense of ₹104.86 crore but suffered from non-provision of critical functionality, inadequate controls to protect the Government's financial interests and deficient reporting to address risks such as misreporting or diversion.
The report says the application was not designed to maintain a repository of blacklisted liquor licensees for review before a licence is granted. It also lacked geo-tagging of liquor vends, reducing the ability to verify compliance with location-related provisions of excise policy.
Application controls affected levy calculations and traceability
CAG said weak application controls led to erroneous calculation of excise levies such as bottling fees, export duty and AED, resulting in financial loss to the State exchequer. It also identified the absence of functionality to map hologram series with batch-wise approved liquor stock.
For technology and assurance professionals, these findings illustrate two classic application-control objectives: calculation integrity and end-to-end traceability. When a system cannot reliably calculate statutory charges or link a control identifier such as a hologram to approved stock, manual review has to compensate for a risk the application should ideally prevent or detect automatically.
Business continuity and disaster recovery were missing
The CAG overview further states that the Department did not have business continuity plans or disaster recovery plans for system failures or security breaches. That point extends the audit beyond transaction processing into operational resilience.
- Internal-audit scopes should test whether critical activities bypass the system and continue offline.
- User-role design should detect duplicate or conflicting identities in sensitive procurement workflows.
- Automated calculations should be independently validated against the governing rules and rates.
- Collections, refunds, EMD balances and GST should be reconciled across system and accounting records.
- Critical regulatory systems should have tested BCP and DR arrangements, not only backup infrastructure.
Practical takeaway: the report shows why a technology project cannot be treated as successful merely because a portal is operational. Governance, workflow completeness, financial controls, calculation logic, audit trails and recovery planning all determine whether a system actually delivers transparency and control. Those are directly reusable audit themes for CAs reviewing ERP, procurement and regulatory platforms.
Official source: View the official source document
Key takeaway
The newly tabled official report offers concrete audit themes on governance, application controls, EMD, GST, system access and disaster recovery that transfer directly to CA and internal-audit work.
