When testing the operational effectiveness of an institution’s customer risk rating model, an auditor finds that the risk rating is not in accordance with the m...