How to rate external auditors