Best practices for operational risk management and crisis response