Establishing a clear inventory of operational risk models for effective validation and controls