(a) Work papers and preliminary drafts of reports created in the course of the discharge of duties and powers of the Department of Audits and Accounts and the state auditor shall not be subject to inspection as public records until an audit or special examination is concluded and a report pertaining to those work papers or preliminary drafts is released as a public record, if a report is to be done. If a public request to inspect such documents has been pending for at least six months, the state auditor's decision not to disclose the documents shall be subject to judicial review in the Superior Court of Fulton County. On judicial review, the state auditor shall have the burden of establishing that the state's interest in nondisclosure outweighs the public interest in access to the records.

(b) If in performing a vulnerability assessment or review the state auditor determines in his or her discretion that a vulnerability or security deficiency may exist, such findings and related work papers shall not be disclosed publicly or otherwise except as determined by the state auditor. The findings shall not be considered a public record until the state auditor determines no material risk is present from disclosure. Those parts of findings and work papers which identify the methods of the state auditor or which may cause or perpetuate vulnerability shall remain confidential and protected from disclosure until the state auditor otherwise directs. A decision of the state auditor not to disclose documents pursuant to this subsection shall be subject to judicial review in the Superior Court of Fulton County, provided a public request to inspect such documents has been pending for at least six months. The state auditor shall have the burden of establishing that the state's interest in nondisclosure outweighs the public interest in access to the records.