Applying a risk-based approach to assurance systems