operating risk