operational risk management for investments