External Control Layer

A report for a government department cites sources that do not exist

Deloitte’s assurance review of a welfare compliance system was delivered with fabricated citations. According to Deloitte, its internal review had corrected some errors but not all.

Date
July 2025
Kind of system
Generative model in a workflow
Outcome
Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G6 No independent evidence G7 Review in name only

What happened

Deloitte’s review of the Targeted Compliance Framework, the IT system that automates welfare penalties, was published in July 2025. Christopher Rudge, an academic at the University of Sydney, found references to works that do not exist and a fabricated quote attributed to the Federal Court’s judgment in Amato v Commonwealth, a case concerning Robodebt (entry 4).

Deloitte told the Department of Finance that its team had used generative AI tools to complete and format citations, and to further summarize a summary of the Amato proceedings for formatting. It said the output was reviewed, but “while this review corrected some errors, not all were identified.” The Department of Employment and Workplace Relations published a corrected report dated 26 September 2025, saying the substance and recommendations were unchanged, and Deloitte repaid the final installment of its fee.

What allowed the action to take effect

  • G6 No independent evidence

    The action, or the approval of it, was based on the system’s own output or on a single unverified input. Evidence that would have shown the error was never gathered, was thrown away, or was available and not consulted.

    Citations produced with AI went into the report with errors that Deloitte’s review did not catch. Deloitte confirmed that “the use of the generative AI tools had resulted in inaccurate outputs whereby certain citations ... contained errors.”

    Kind of evidence: admission. Source: Australian Department of Finance, 2 September 2025, p. 2.

    Related guidance: P6 Signer independence and P4 Reviewable policy. Contract clause C-6.

  • G7 Review in name only

    A person was supposed to catch the error but lacked the information, time, training, or practical means to do it, so the review did not work as a check.

    The AI output “was subject to review prior to their respective use in the Deliverables, and while this review corrected some errors, not all were identified as part of this process.” The department published the report, and its secretary later said: “We should not be receiving work that has glaring errors in footnotes and sources.”

    Kind of evidence: admission. Sources: Australian Department of Finance, 2 September 2025; PS News, 12 October 2025. References: Letter, p. 2.

    Related guidance: P5 Human authority. Contract clause C-5.

Entries with gaps in common

Sources

Cite this entry

External Control Layer. (2026). Entry 20: A report for a government department cites sources that do not exist. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-20

@misc{ecl_cgr_20,
  author = {{External Control Layer}},
  title = {Entry 20: A report for a government department cites sources that do not exist},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-20},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 20” in the subject line.

Write the email