4 – Risk-based approach