They should absolutely be regulated as to not expose data to foreign intel.
Whereas the regulation in your context pertains to regulations that are codified as laws or rules to follow.
Audits measure compliance to an process or objective. They require that you have written down the process or objective, and retain sufficient information to measure whether you achieved it or not.
In this case, the DOGE boys do whatever Elon says. What is said isn’t recorded or written. People who attempt to do their duty who are seen as obstructive of the whim of the DOGE “agent” are fired.
But remember, Elon doesn’t follow the rule of law, and has no doubt engineered things in such a way that his little minions are accountable.