How do financial institutions reduce operational risk?