practice to separate operational risks from strategic risks