India Aadhaar audit: UIDAI findings and response

What the audit found

The performance audit examined UIDAI operations from 2014-15 to 2018-19, with updates through March 2021 in selected areas. Its seven chapters covered enrolment and updates, authentication, finances and contracts, information-system security and grievance handling ^1,2.

The CAG reported that UIDAI had not worked out the number of pre-July 2016 Aadhaar records lacking paired identity documents. UIDAI had made inline scanning mandatory from July 2016. The audit recorded 37,551 Aadhaar numbers deactivated by 1 November 2019 over disputed identity documents ³.

The report made recommendations on resident-status checks, biometric de-duplication, data quality, authentication partners, contract management, security controls and complaint resolution. These were audit recommendations, not findings that a person or supplier had committed a crime ².

The official response

UIDAI's replies appear beside the audit observations. On missing identity documents, UIDAI agreed in October 2020 and said it would examine ways to fill the gaps without avoidable inconvenience to Aadhaar holders. The Ministry of Electronics and Information Technology agreed with UIDAI's replies in June 2021 ³.

Other responses accepted some recommendations, described existing controls or set out proposed work. The CAG retained findings where it considered the reply incomplete or the control gap unresolved ².

Parliament

The CAG sent Report No. 24 of 2021 to the government on 2 February 2022. It was tabled in Parliament on 6 April 2022 as a Union government performance audit in the information and communication sector ¹.

No committee report closing each recommendation was identified in the official sources reviewed. The tabling date confirms parliamentary receipt, not implementation of every recommendation ^1,2.

Follow-up audits and recommendations

The CAG report is the main recommendation record reviewed for this page. It gives UIDAI and ministry replies but does not assign a later closed or open status to every item ².

UIDAI's 2024-25 annual report describes the authority's functions, services, accounts and operating controls. It is not a CAG follow-up audit and does not present a recommendation-by-recommendation closure table for Report No. 24 of 2021 ⁴.

Courts, tribunals and investigations

The audit's background chapter notes the Supreme Court's 2018 Aadhaar judgment, which predates this report. The court case concerned the statutory scheme and constitutional questions, not a ruling on the CAG's 2022 audit findings ².

No later court judgment deciding the audit recommendations was identified in the official sources reviewed as of 20 October 2026. The audit record does not establish criminal liability ^1,2.

Where it stands now

UIDAI continues to operate Aadhaar and publishes annual reports under section 27 of the Aadhaar Act. Its 2024-25 report covers enrolment, authentication, security, administration and audited accounts ⁴.

The reviewed official sources do not show that every 2022 recommendation has been closed. This page keeps the case at follow-up pending until a CAG or other official record supplies item-level implementation status ^1,4.

Timeline