How does the operational structure affects a bank's operational risk management capabilities - case study of two Saudi banks