operational risks cycle