Proactive and reactive approaches to risk regulation