A risk-based approach makes sense, but the evaluation criteria should be transparent and consistent for everyone