Auditing The Louvre Heist: When Internal Control Falls Short

The Louvre Museum is one of the most visited museums globally, located in the heart of Paris, France. As a silent witness to history, it houses many valuable collections spanning from 7000 BCE to the 21st century. The Louvre serves as a symbol of civilization, curating over 480,000 works of art with an estimated asset value of €45 billion. However, its global reputation as a heritage for world’s art collections was suddenly tarnished following a heist in October 2025. This incident exposes a fatal flaw in the risk management system implemented by the Louvre’s administration.

The Louvre Museum heist occurred on Sunday, October 19 2025, at 09:30 a.m. local time. The incident began when four suspects arrived in a truck equipped with a mechanical lift. The perpetrators then used the lift to reach the museum’s balcony and entered through a window into the Galerie d’Apollon. They carried out the heist in just eight minutes, stealing eight historic pieces of jewelry with an estimated value of €88 million.

The French Culture Minister, Rachida Dati, stated that the incident occurred due to a “chronic, structural underestimation of the risk of intrusions and theft.” The heist was successfully carried out despite the internal controls implemented by the Louvre Museum’s management. In fact, the security systems, such as cameras, alarms, and other security devices within the Louvre Museum were unable to prevent the heist.

The Global Internal Audit Standards (GIAS) are the global professional standards formulated by The Institute of Internal Auditors (IIA) that guide professional internal audit practices worldwide. In the context of GIAS, auditors must understand how an entity or organization identifies and manages key risk areas, one of which is the safeguarding of assets. Internal auditors need to determine whether public resources are being adequately protected. The Louvre holds an art collection with high asset value. However, the previous internal audit function failed to provide an honest assurance regarding the status of asset safeguarding. In fact, a security audit report by France’s national audit office, Cour des Comptes, revealed that only 39% of the museum’s rooms are monitored by security cameras. Furthermore, the same report stated that the upgrade of security infrastructure would not be finished until 2031. The report explained that the Louvre failed to improve its security systems due to misplaced budget priorities and poor management.

The Global Internal Audit Standards (GIAS) emphasize the importance for auditors to understand the effectiveness and efficiency of operations and programs within risk management. In the context of the Louvre heist incident, an internal audit should have been able to accurately assess whether the Louvre’s management operations were being carried out effectively and efficiently. However, Elise Muller, a member of the Louvre’s security staff, stated that complaints regarding the shortage of security personnel and obsolete security equipment were frequently ignored by management. This statement indicates that internal risk management was not being executed effectively or responsively. This is reflected in the lack of maintenance on gallery security infrastructure and the underestimation of key risk areas, which also demonstrates operational inefficiency.

The heist at the Louvre Museum underscores the critical importance of an effective internal audit role. Internal audit serves as a line of defense by conducting in-depth risk assessments. In this context, internal audit should have been able to identify and evaluate the underestimation of risks regarding key risk areas, so that the Louvre Museum heist could have been prevented.