On the aggregation of credit, market and operational risks