Pub. Util. Code, § 187037

(a) Except as provided in subdivision (b), upon completion of an audit or review conducted pursuant to subdivision (a) of Section 187030, the Inspector General shall do all of the following:

(1) Publish a complete report on its internet website.

(2) Provide, in compliance with policies developed by the Inspector General, notification of the published report to the Governor and the High-Speed Rail Authority.

(3) Submit a copy of the published report to the Legislature in compliance with Section 9795 of the Government Code.

(b) (1) The Inspector General may hold a report, or a portion of a report, confidential for the period of time described in paragraph (3) if the Inspector General determines that the report, or a portion of the report, would describe or otherwise reveal weaknesses, including those involving information security, physical security, fraud detection controls, or pending litigation, that would pose a substantial and articulable risk to the project or to state operations if publicly disclosed.

(2) If the Inspector General makes a determination pursuant to paragraph (1), the Inspector General shall do all of the following:

(A) Make publicly available any reasonably segregable portion of the report that does not pose the substantial and articulable risk identified pursuant to paragraph (1).

(B) Publicly disclose that a report, or a portion of the report, has been held confidential and provide the rationale for the determination.

(C) Deliver a confidential report, or a confidential portion of the report, that describes and makes recommendations to resolve the identified weaknesses to state officials with oversight of the project, which may include the executive director and board chair of the High-Speed Rail Authority, the chairs of the Assembly Committee on Transportation and the Senate Committee on Transportation, or the Governor. The report, or portion of the report, delivered pursuant to this subparagraph shall remain confidential only so long as the Inspector General determines that public disclosure would continue to pose the substantial and articulable risk identified pursuant to paragraph (1).

(3) Within 120 days after making a determination pursuant to paragraph (1), and at least every 120 days thereafter while a report, or a portion of a report, is held confidential, the Inspector General shall reassess whether continued confidentiality is warranted. Upon each reassessment, the Inspector General shall either publicly release the report, or the portion of the report, that is held confidential or issue a written determination explaining why continued confidentiality remains necessary.