Operational risk and regulatory change