Operational Risk Measurement Beyond the Loss Distribution Approach: An Exposure-Based Methodology