Guidelines for the use of a risk-based approach in supervisory activities