A decision logic for operational risk management