However, if the auditor finds no additional weaknesses, management will receive a good awareness rating, even if controls need to be strengthened.
The auditor may exercise some personal discretion in giving ratings if he things management has put forth a good faith effort.