However , if the auditor finds no additional weaknesses , management will receive a good awareness rating , even if controls need to be strengthened .
The auditor may exercise some personal discretion in giving ratings if he things management has put forth a good faith effort .