What happened
A joint investigation by BBC Panorama and the Bureau of Investigative Journalism, part of the Cyprus Confidential project, found that accounts signed off by Deloitte in Cyprus caused assets worth $672 million to disappear from Roman Abramovich's company records. Superyachts, mansions and private jets vanished from the books between 1999 and 2013.
The mechanics were straightforward. A 2006 Cypriot transparency law threatened to make company accounts public, and Deloitte Cyprus had draft 2003 accounts for Abramovich's company Amiscan Investments sitting unfinalised, detailing $672m of property. His associates and Cyprus corporate services firm MeritServus planned to move the assets to a British Virgin Islands parent and backdate the transfer by three years. Deloitte Cyprus reviewed the backdated documents, called them adequate to remove the assets from Amiscan's accounts, and signed the accounts off with roughly $75,000 of assets remaining.
The reporting describes a larger second instance, in which MeritServus signed and backdated documents purporting to show a BVI company had owned a $10 billion fortune since November 2003, leaving the Cypriot company of the same name appearing to hold $145,000. Barrister Andrew Mitchell KC told Panorama the evidence pointed to straightforward tax evasion that could not be more blatant.
Deloitte Cyprus said it acts in compliance with applicable laws and declined to address the allegations because the documents were more than 20 years old and no longer accessible. Abramovich's lawyers denied that he evaded tax or concealed his fortune, and said there was no evidence he knew about, authorised or directed any falsification. MeritServus closed after the leak.
Why this is a GRC story
The sign-off was the control. No automated rule was going to catch the backdating. The only thing between a fabricated paper trail and a filed account was a professional deciding whether a document was adequate. When the reviewer accepts the artefact without testing the claim behind it, the control has failed even though every box is ticked.
Knowledge lives in correspondence. The leak is a trail of emails about intent, timing and what was needed to satisfy a new disclosure rule, which is exactly the material a regulator wants and the material most firms delete as routine. Deloitte Cyprus's answer, that records over 20 years old are no longer accessible, is a fair moment to check your own retention schedule.
Enablers get named. Abramovich was designated in 2022, long after the conduct, so a programme built around the current designations list looks forward at a problem regulators examine backwards. And the story is less about one sanctioned individual than about the advisory layer that made the structure usable, including a Deloitte ownership link to MeritServus that outlasted the 2005 split.
What to watch
Whether any supervisory body opens a file on the firm's Cyprus audit practice, and whether tax authorities in Cyprus or Jersey treat the leaked documents as new evidence. For practitioners the useful question is narrower: can you evidence who reviewed a contentious accounting judgement, what they were shown, and what they tested? If the answer depends on someone remembering, the answer is no.
Attribution: Analysis based on BBC News and related public reporting. This article is original commentary, not a repost of the source material.