Ten Laws of Operational Risk