When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns on the rule analyzed. 

In this report, you need to write what is wrong in the rule-set and the security consideration about the configuration.

For example, if in the rules you have not find egress filtering you can say it's a problem because from your network is possible to do spoofing.

What sources do you use to add credibility and customer satisfaction to your work after an audit and a report of this kind ? 

What reliable sources, best practice, etc ..  do you use to arguments your consideration to show to your client that this consideration is not your own consideration by a widely accepted consideration in the security industry ?