Russell W. Hinton
STATE AUDITOR
(404) 656-2174

DEPARTMENT OF AUDITS AND ACCOUNTS
270 Washington Street, S.W., Suite 1-156 Atlanta, Georgia 30334-8400
December 15, 2008

Members of the Board of Regents of the University System of Georgia
and Director and Members of the Piedmont Regional Library Board
Ladies and Gentlemen:
In planning and performing our audit of the financial statements of Piedmont Regional Library as of and for the year ended June 30, 2007, in accordance with auditing standards generally accepted in the United States of America, we considered Piedmont Regional Library's internal control over financial reporting (internal control) as a basis for designing our auditing procedures for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the Library's internal control. Accordingly, we do not express an opinion on the effectiveness of the Piedmont Regional Library's internal control.
A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affect the Piedmont Regional Library's ability to initiate, authorize, record, process, or report financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the Piedmont Regional Library's financial statements that is more than inconsequential will not be prevented or detected by the Piedmont Regional Library's internal control.
A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected by the Piedmont Regional Library's internal control.
Our consideration of internal control was for the limited purpose described in the preceding paragraph and would not necessarily identify all deficiencies in internal control that might be significant deficiencies or material weaknesses. Any identified deficiencies in internal controls that we consider to be significant deficiencies or material weaknesses will be communicated to management and those charged with governance within the Schedule of Findings and Questioned Costs section of our report on the Piedmont Regional Library's basic financial statements dated December 15, 2008.

We noted certain other matters involving the internal control and operations of Piedmont Regional Library that are presented in this management letter for your consideration. This letter does not affect our report dated December 15, 2008 on the financial statements of Piedmont Regional Library. Our comments and recommendations, all of which have been discussed with appropriate members of management, are intended to improve the Library's internal control or result in other operating efficiencies. We will be pleased to discuss these comments in further detail at your convenience. Our comments are summarized as follows:
Internal Control Process Documentation As a result of our audit, we found a lack of formal documentation related to management's internal control processes and procedures, risk assessments, and monitoring of key controls over significant processes identified by management. Management should formalize their documentation and monitoring of key controls over significant accounts, processes, decentralized operations, and financial statement disclosures that will be relied upon to ensure that Piedmont Regional Library's financial statements are fairly presented.
Disaster Recovery Plan Piedmont Regional Library does not have well defined, written disaster recovery procedures. The time to make contingency plans is before disaster strikes, so that all personnel will be aware of their responsibilities in the event of an emergency situation. We suggest that management ensure that their disaster recovery plan includes, but is not limited to, the following matters:
Location of, and access to, off-site storage, a listing of all data files that would have to be obtained from the off-site storage
location, identification of a backup location (name and telephone number) with similar or
compatible equipment for emergency processing (management should make arrangements for such back-up with another company, a computer vendor, or a service center; the agreement should be in writing), responsibilities of various personnel in an emergency, and priority of critical applications and reporting requirements during the emergency period.
Uncollectible Fees and Fines Our examination of the Library's general ledger/and or financial statements revealed that the Library did not record uncollectible fees and fines from the PINES system. The Library should maintain the activity for these fees and fines in their general ledger. By excluding this information from their records, the Library's financial statements could potentially be misstated.
In the normal course of the audit process, the auditor is only required to obtain an understanding of internal control sufficient to plan the audit. This, however, does not imply that the auditor must perform any type of test or other verification of the effectiveness of the internal control system. As such, we strongly recommend that management evaluate the effectiveness of the Library's system of internal controls. This evaluation should reaffirm management's responsibility for establishing and maintaining an adequate system of internal controls and financial reporting. Strong and effective internal controls are the responsibility of management and we believe that this practice, conducted on an annual basis, will be of significant benefit in enhancing internal controls and preventing fraud and abuse.

We believe that the implementation of these recommendations will provide Piedmont Regional Library with a stronger system of internal accounting controls while also making its operations more efficient. This communication is intended solely for the information and use of management and others within the organization and is not intended to be and should not be used by anyone other than these specified parties.
Respectfully,
Ru sell W. Hinton, CPA, CGFM State Auditor