An operational risk profile: the experience of British firms