Between 2015 and 2025, a network of tour guides and two Louvre employees executed a systematic fraud. They reused valid entry tickets, rotating up to 20 Chinese tour groups daily through the same physical entries. The scheme exploited a known operational weakness: the museum’s difficulty in verifying online tickets. Two Louvre staff accepted cash bribes to facilitate entry. The financial damage is quantified at €10-12 million over a decade. Police seized €957,000 in cash and €486,000 from bank accounts, with proceeds invested in real estate in France and Dubai. Nine arrests were made by Paris police in February 2026, following a judicial investigation opened in June 2025.
The Risk
The liability is not abstract; it is a precise calculation of governance failure. The presence of two internal employees as defendants creates a direct line from operational fraud to boardroom oversight. For a decade, the revenue leakage averaged €1-1.2 million annually. This represents a persistent, material failure in financial controls. Under the New Zealand Companies Act 1993, directors have a duty to exercise reasonable care, diligence, and skill. A failure to implement adequate internal controls to prevent a multi-million euro, decade-long fraud may indicate a breach of this duty. The museum’s own admission of a ‘resurgence and diversification of ticket fraud’ demonstrates awareness of the systemic vulnerability, yet controls remained inadequate. The financial loss is only one component. The concurrent security failures, highlighted by a $102 million jewel heist in 2025, suggest a pattern where leadership prioritised capital projects over safeguarding assets. This creates a compound liability risk where financial mismanagement intersects with a failure of duty under health and safety principles to protect institutional assets.
The Control
The strategic solution is a forensic recalibration of the control environment. It requires moving from passive revenue collection to active transaction integrity assurance. This involves implementing a closed-loop digital audit trail for every ticket, from purchase to entry, with biometric or cryptographic validation at the gate to prevent reuse. Financial reconciliation must shift from periodic to real-time, with algorithms flagging anomalies in group entry patterns and fee avoidance. Most critically, internal audit must be empowered and resourced to conduct unannounced, deep-dive forensic tests on high-risk revenue streams, treating them not as administrative functions but as primary guardians of asset protection.
The Challenge
These are the critical questions you should be raising at the board table:
| What is the quantified annual leakage tolerance in our high-volume, low-margin transaction systems (like ticketing), and what forensic audit evidence do we have that we are operating within it? | |
| Precisely which internal control—preventative, detective, or corrective—would have failed to halt a scheme of this scale and duration in our organisation, and what is the cost-benefit analysis of remediating it? | |
| When our internal audit plan was last challenged to sacrifice ‘urgent, less visible work’ for a high-profile capital project, what was the financial value of the control risk we accepted, and where is it recorded in our board minutes? |