I work for a small software company with less than 10 programmers. Our software is installed in dozens of places across the world. Our code base is huge, due mostly to poor design and massive amounts of duplication of code (IMO). We have roughly 30 different projects, each with a total of about 600 KLOC with about 200 KLOC of that being our own homegrown code. When I got there in 2006, this code wasn't even under revision control. I've managed to convince powers that its important, and we now use a code control system (cs-rcs, not my choice but its better than nothin), and a bug tracking system. The huge missing piece is the total and complete lack of QA in the process. Our release process is non existant on paper, and in practice it consists of "hit ctrl-F9, copy binary to client, declare problem fixed."
Can anyone point me to some official papers or PHB-language documents or articles that can explain the blatant lunacy in this process? I'm sure the boss could hire some consultant to tell him this, and then he might believe it. But I'm just a lowly maintainer with a Software Engineering BS degree. And my ethnicity doesn't help me either. What's the best ammunition to use in this case?