Building an effective operational risk management system