Pātuhitia tēnei: Measuring operational and reputational risk