operating risk analysis