Measuring the Impact of Risk-Based Monitoring