risk-based rules