Risk-based supervision norms