Operational risk areas : performance audit