Severity Differences

How should we handle severity differences between audit firms?

For example Ackee Blockchain (in the marinade audit) reported the usage of Anchor as a high severity vulnerability.
This kind of vulnerability could potentially bump the Dependencies class higher in the classification.

In the future, it may become necessary to standardize the severity of vulnerabilities.
How should we do that?