I agree with the comments above. The acceptance leads to a high severity of risk due to the company not any additional steps to deal with the risk. As Dr. Simon has mentioned, sometimes it is cheaper for the company to allocate certain money for the risk of the product rather than dealing with reducing the risk. The mitigation and transference would lie as a mid-severity of risk due to still dealing with the risk but by implementing controls, or other countermeasures that have a direct effect on risk identified. Lastly, avoidance of risk is with the company avoiding an activity or process that produces risk. This can be categorized as a low severity of risk due to eliminating the risk all together.