operational risk subgroup of risk, 9 assertions