Adopting a Risk-Based Approach