I'm not trying to discount the value of risk avoidance they are both important and should both be used, but mitigation should always be the priority of the two.

1) When you have neither you should focus on risk mitigation first. 2) Having a great and complex risk avoidance policy in place is a good thing but doesn't mean that you need a lesser mitigation system.