An organization can make three basic responses to a risk, once they have identified and defined it.15 The first is to accept the risk and work on other things. This is often the best approach for very low risks or ones about which the organization cannot effectively do anything. The risk of a drummer spontaneously combusting is an example: this has a very low likelihood, so bands tend to accept this particular risk and work on things they can more easily affect, like perfecting their lyrics. The second is to try to mitigate the risk. This means trying to reduce the risk by reducing the potential impact, reducing the likelihood that it will affect the organization, or both.16 For example, you patch your server, thus reducing the likelihood that the new exploit for your OS will affect you. The third is to try to transfer the risk. This means that you get someone else to accept at least some of the risk for you. For example, you buy business insurance. There are no other responses to a risk: anything else boils down to one of these three or a combination of two or more of the three. Bass and Robichaux, for example, identify seven risk control mechanisms: