[codingdave]

This misses half of the risk management equation - likelihood of risk. Something with high severity, but low likelihood will have a different mitigation plan than high severity and high likelihood.

[taylodl]

Yep! You are correct - that's what we do in practice. Good catch!