http://blogs.msdn.com/joelo/archive/2007/03/19/solutions-information-policies-compliance-and-auditing.aspx