which statement best describes operational risk management sejpme