https://www.otorio.com//blog/aligning-operational-risk-and-business-objectives/