1. Quality Assurance Institute (QAI). (2024). Certified Software Quality Analyst (CSQA) Body of Knowledge (SQBOK). Skill Category 7: Quality Control Practices, Section 7.3, "Auditing and Assessment." The SQBOK describes the role of the auditor in evaluating evidence and making judgments about compliance. It implicitly supports the concept that auditors must analyze situations to determine the significance of findings, which is a form of subjective enforcement decision.
2. Herath, T., & Rao, H. R. (2009). "Protection motivation and deterrence: a framework for security policy compliance in organisations." European Journal of Information Systems, 18(2), pp. 106-125. This academic publication discusses how employee perceptions and managerial discretion (a form of subjective enforcement) influence compliance with information security policies. The study highlights that managers often weigh situational factors before enforcing penalties, confirming the practice of subjective decisions. DOI: https://doi.org/10.1057/ejis.2009.6
3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2016). 16.842 Fundamentals of Systems Engineering, Fall 2015. Lecture Notes, "Verification and Validation." Course materials often discuss the process of handling non-conformance. The disposition of a non-conforming item or process frequently involves a Material Review Board (MRB) or a similar body that analyzes the situation and makes a judgment call (a subjective decision) on whether to accept, rework, or reject, rather than strictly enforcing a single "reject" policy for all deviations.