Here[1] I saw that it was from an internal audit. [1] http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.a

Here[1] I saw that it was from an internal audit. [1] http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-... EDIT: Added a better source.