anchor: The auditors then develop two ratings on a scale of 1 to 5: One rating to indicate the effectiveness of information security controls and a second rating to indicate the level of management awareness.
positive: Two ratings are created by the auditors using a scale from one to five.
negative: The auditors created a system of rating based on one to ten stars.