text: The auditors then develop two ratings on a scale of 1 to 5 : One rating to indicate the effectiveness of information security controls and a second rating to indicate the level of management awareness .
  
  ###
  
  One to five was chosen by the auditors democratically as their rating scale .