Password criteria

Could someone please tell me where the criteria for resetting the password is kept on a SCO box. i.e. 3 characters to be changed - 2 characters have to be numeric. I need to prove this to an auditor so I would like to be able to print or place the data in a file.

Have a look at a command named goodpw

location: /usr/lib/goodpw

this utility contains the password control settings if been used, this is set within /etc/defaults/passwd