How does the risk-based approach work?