Full and Prompt Access, Reserved for Some
The executive order that created the Department of Government Efficiency told agency heads to give its personnel full and prompt access to every unclassified record, software system, and IT system they owned. Agencies duly stood up DOGE teams and provisioned accounts. When the Government Accountability Office, which is Congress’s own auditor, asked six of them to demonstrate what that access looked like in practice, the enthusiasm curdled into a remarkable silence.
GAO’s new report, GAO-26-108192, covers the Consumer Financial Protection Bureau, the Departments of Education and Veterans Affairs, NOAA, the Securities and Exchange Commission, and the Small Business Administration. The audit ran from March 2025 to September 2026. After eighteen months, GAO’s conclusion is that it could not determine how far DOGE’s reach extended at any of them. Four agencies reported that DOGE teams touched more than 23 systems covering contracts, grants, human resources, and finances, but none supplied enough to verify the level of access. SBA and VA never even named the systems.
Let us be precise about what this is not. The report does not allege that anything was stolen, leaked, or misused. Its complaint is subtler and, for anyone who believes in oversight, arguably worse. It could not check.
A Catalogue of Excuses
The reasons for not being checked are instructive, if only for their range.
VA and SBA went with the classic. GAO asked SBA repeatedly between May 2025 and February 2026, and as of this month the agency has not explained why it never answered. GAO asked VA repeatedly from April 2025 to May 2026, and in June the department confirmed it would neither address the requests nor say why. Nothing says accountability quite like a closed door with no sign on it.
NOAA and SEC preferred the constitutional approach. Their general counsels informed GAO that the auditors lacked authority to proceed, NOAA because the request came from a ranking member of a committee and SEC because it believed only a committee or its chair may ask. SEC added that certain information was protected from disclosure to GAO. Education cited ongoing litigation and worried about handing over personal information about DOGE staff without a guarantee of confidentiality. GAO, for the record, says it has routinely protected exactly this kind of information at the same level of confidentiality required of an agency head, and has obtained it from these very agencies before.
CFPB chose prose. Its lawyers called the inquiry a “fishing expedition,” described GAO’s requests as redundant, unnecessary, and disruptive to bureau operations, and accused the auditors of a fundamental misunderstanding of federal personnel management. In April, its chief legal officer wrote that GAO was serving at the behest of a few congressional members to harass the bureau. When GAO offered an exit conference to sort out the disagreements, CFPB declined. It did, however, ask GAO to reprint its April letter in the final report, which GAO did, along with the bureau’s September comments and annotated rebuttals in the margins. It is the closest thing to a duel the federal government has produced this year.
Notice the arithmetic here. An executive order demanded that DOGE receive full and prompt access. The same agencies then found the concept of prompt access to be considerably less appealing when the person asking carried a congressional badge instead of a White House one.
What the Cooperators Got
The most damning evidence that cooperation is possible comes from the agencies that offered it. In April 2026, GAO reported on the Treasury Department’s Bureau of the Fiscal Service and on the National Labor Relations Board. Both let auditors in. At the NLRB, GAO found no evidence that DOGE-affiliated staff accessed the human resources systems they had requested. At the Bureau of the Fiscal Service, it found the opposite kind of news, namely that the bureau had not fully implemented the security and privacy controls needed to protect sensitive payment data, and that one DOGE team member failed to secure information appropriately. GAO made six recommendations. As of September, none has been implemented.
So here is the pattern. Where auditors were admitted, the public got a clean answer in one case and an uncomfortable one in the other. Both are useful. That is what audits are for. Where auditors were turned away, the public got a shrug in a government letterhead.
The partial answers were not reassuring either. At CFPB, the bureau’s own policy requires data users to complete security and privacy training before touching data, and its guidance makes no exception for short-term detailees. GAO received documentation that all six DOGE team members got a privacy briefing but only four completed security training. Five of six signed the agreement not to knowingly create cybersecurity risks, and four of six reviewed the acceptable use policy. One CFPB team member had the ability to view, modify, and delete data in the bureau’s primary human resources system. At Education, signed IT rules of behavior for one of the six team members never materialized, despite repeated requests. At SEC, one background check was still underway and another dated from 2017, with no confirmation that it was favorably adjudicated.
CFPB and SEC each say they had no cybersecurity or privacy incidents involving their DOGE teams. Perhaps so. But neither would let GAO watch the systems that track incidents or log user activity, which makes the claim a promise rather than a finding. Government Auditing Standards, GAO patiently explains, call for corroborating testimony with something more reliable than the testimony.
Oversight by Permission Slip
The legal argument deserves attention because it would, if accepted, remake the balance of power between Congress and the executive branch. GAO points to 31 U.S.C. § 717(b)(1), which lets the Comptroller General conduct audits on his own initiative, and notes that Congress and multiple administrations have recognized work for ranking members over decades. Agencies that now insist only a committee chair may ask are not clarifying the law. They are discovering that a minority-party request is easy to ignore.
Most of the requesters here were ranking members, which is to say the minority. That is precisely who cannot compel anything on their own, and precisely why they rely on GAO. If an agency can decline an audit because the person who asked lacks a gavel, then oversight becomes something the majority grants to itself and withholds from everyone else. It is a tidy arrangement for whoever holds the majority, and a fine reason for whoever loses it to wish they had objected sooner.
For a veteran audience, the VA portion stings most. Department officials told GAO that contractors and employees serving as DOGE liaisons received access to every system that ordinary employees could reach. They then declined to say which systems, which liaisons, or at what level. GAO also notes that evidence from another agency showed a DOGE team member with access to the Veterans Health Administration’s instance of the Electronic Official Personnel Folder, and GAO could not confirm it with VA. That is a system of employment records, not medical charts. It is still not a system one wants to learn about secondhand.
DOGE arrived promising efficiency. Its host agencies have made the question of what DOGE could reach opaque for eighteen months and counting, which, in fairness, is a kind of efficiency. GAO says it has the authority and the track record to keep asking. In the meantime the rest of us are invited to take the agencies at their word, which is precisely what an audit exists to spare us.
