operational risk management establishes which of the following factors