A document from Richard Klein detailing why and how to audit BMPs.