The Deloitte report in Australia: what a reference check would have caught

An independent review, commissioned by a government department, reviewed and then delivered. After publication, a researcher spots a fabricated quote and references to work that does not exist. One could see the Deloitte case in Australia as nothing more than a story about artificial intelligence. It is first a story about references: errors that passed through every review, and that a check designed upstream would have made visible before sending.

The facts

In 2025, Deloitte delivered an independent review to the Australian Department of Employment and Workplace Relations, under a contract worth around 440,000 Australian dollars. A University of Sydney researcher spotted a fabricated quote from a Federal Court judgment and references to nonexistent academic work.

The corrected version discloses the use of Azure OpenAI in its drafting. The department states that the substance of the report and its recommendations are unchanged. Deloitte agreed to refund part of the contract.

The department’s statement matters, and it makes the case more instructive still. On its account, the errors did not affect the recommendations, but the references meant to support them. For any organisation that produces reports, this is the most telling case: a deliverable whose substance is not called into question can still be caught out by its references alone.

Two ways for a reference to lead nowhere

Fabricated references are only part of the problem. The study Hallucination-Free?, carried out by researchers from Stanford and Yale and published in 2025 in the Journal of Empirical Legal Studies, separates incorrect answers from “misgrounded” ones, which state the law correctly but cite a source that does not support it.

A misgrounded answer looks entirely serious. It carries a reference, the reference exists, and only reading the passage reveals the mismatch. A check that stopped at whether the source exists would let it through.

There are therefore two errors to prevent: the reference that does not exist, as in the report delivered in Australia, and the reference that exists but does not say what it is made to say.

The check that makes the error visible

The lesson to draw from the Deloitte case concerns sources.

A system that checks that each reference exists in the corpus, then that it actually supports the claim, makes this kind of error visible before delivery.

The order matters. The first check rules out fabricated references. The second, more demanding, compares the claim with the cited passage. Such a check has to be designed and tested; it belongs to the method, beyond the mere presence of a corpus. Having the right documents is not enough: the link between each sentence and its source still has to be checked.

The counter-example: a deliverable built from sourced findings

Audit already has an answer to this kind of failure: changing the unit. You stop treating the report as a block of text and treat it as an assembly of findings, each linked to its sources down to the passage.

Take a memo to the audit committee, due in eight days. It is built block by block, from sources that are already indexed: summary, quantified exposure, findings, recommendations. A first version is drafted from the findings of the exploration, and the author approves, revises or rewrites it. Every sentence keeps the link to the passage it rests on.

Oversight is proportionate to risk. A finding about two continuity incidents rests on a single set of minutes; in the spirit of the auditing standard, a finding that will weigh on a decision deserves corroboration. The author finds the logistics department’s incident report, and the finding now rests on two sources. Rigour takes a few minutes.

Review changes in nature too. The lawyer reviews finding by finding, opens the passages of interest and asks for a precise rewording where needed. Every change is tracked. In committee, when a board member asks where a figure comes from, the source opens on screen with the query and the period.

In the Deloitte case, fabricated references passed through every review until an outside reader spotted them after publication. A deliverable built from sourced findings, with systematic reference checks, makes it possible to catch before sending a reference that leads nowhere. It becomes verifiable by someone who took no part in writing it: precisely the check an outside reader ended up making in Australia, but too late.