I agree with you Luisa, I’d also like to add that risk transference is the involvement of handing risk off to a willing third party. In my opinion, in the case of low severity I think it is a good idea if a company outsources certain operations such as customer service, payroll services, etc. This can be beneficial for a company if a transferred risk is not a core competency of that company. It can also be used so a company can focus more on their core competencies. For high severity mitigation and acceptance would be recommended.

-Nicole