http://www.aicpa.org/download/infotech/2008_Top_Tech/IdentityManagementAccessControl.pdf