The 'monitoring visit frequency' for a given site in a risk-based approach is primarily determined by: