Risk-based compliance monitoring plan design