BU Today: There are several kinds of audits that an entity can undergo. What are the audit basics that we need to know here?

 The term “audit” can mean a lot of different things to a lot of different people. One way to distinguish it is there are audits that are required and audits that are not required. For example, if you’re a publicly traded company in the United States, you’re required to get a financial audit every year, per the U.S. Securities and Exchange Commission. More-voluntary audits happen, for example, when an organization decides to go over [statements or a process] because a situation occurred that suggested a review [would be helpful]. 

Another way to distinguish between audits is compliance versus efficiency audits. Compliance audits are the things that sell the headlines for politicians—that’s the fraud and waste audit. Efficiency audits are: “We don’t necessarily think that there’s something wrong going on, but there might be better ways to allocate resources.” Nothing that DOGE is doing is new. The concept of government audits has been around forever. Most agencies, as they’re structured, have internal audits as a normal best practice.

BU Today: Okay, so when it comes to efficiency audits, what are some of those best practices for trying to streamline operations?

There are three things that you would do. The first big step, if you’re trying to make improvements, would be to understand the processes and internal controls that are already in place. Once you understand what the processes are, the next step is to look at whether or not there’s compliance with the processes. That’s important: it may not be that a process is a bad process; it may just be that you’re not enforcing it the way you’re supposed to. The third step is to improve the process. For example, if a process feels antiquated—maybe you have something being done on paper—can you do it electronically? And is there somewhere you can look, like another government agency, to illustrate the best way to digitize that process? 

Some people believe that our government is so entrenched in its ways that you need someone radical to come in who smashes things to pieces because there’s no other way to change it. There’s probably some truth to that—we’re a lot better at adding things than we are at taking away, right? There’s another important part of that third step: benchmarking. For DOGE, a benchmark should include thinking about how the size of our federal government compares to that of comparable countries. Hacking something apart makes sense if you’re a big outlier—if, say, 10 percent of the US population was a federal employee, and most other countries were at 4 percent. But if we’re within the normal range, or even better than where other countries are, blowing things up probably doesn’t make sense. 

BU Today: On that note, what are the other dangers of not following those steps or not taking the proper amount of time with them?

My general perception is that if you’re not thoughtful about how you change things, you can make mistakes. You can also end up with a standoff: on the one hand, DOGE might want compliance with procedures in the Internal Revenue Service, for example, but on the other hand, they’re pulling away resources to make sure that compliance is happening. You can’t have it both ways.

The bigger issue here is thinking about the role of government versus business. When Elon Musk took over Twitter and renamed it X, he went and smashed it up and basically fired 80 percent of the employees. We can argue whether that was good or bad, but in the end, that’s a private company with a certain objective. Now, if you take that approach to the federal government—which provides vital services to the citizens of this country, not social media accounts—you’re probably going to harm part of those services. If you fire 80 percent of the Social Security Administration, citizens might have trouble getting the funds they’re due. You’ve now imposed a social cost. That, to me, suggests that you need to be more thoughtful and cautious about making changes in government than you would within a business. 

BU Today: Questions have been raised about Musk’s conflicts of interest, with Tesla and SpaceX especially, considering that both companies have relied on government contracts. Is it a problem to have a conflict of interest when performing an audit?

You should avoid conflict of interest, pure and simple. There’s no question about that. The person overseeing a review of an audit—the one who’s trying to make sure that processes are in place, whether they’re being complied with, etc.—should not be the same person doing something such as running a company that could stand to benefit from [potential results of an audit]. When you don’t have that, it opens up the possibility that you’re going to influence things in a biased way. The best way to avoid that question is to not have the conflict of interest in the first place.