Here's a nice piece from our friends at 
1SecureAudit.com.  Peter Higgins and the gang maintain a 
great blog over there devoted to operation risk issues.  
This recent post on how corporate boards deal with reputation risk is one that is definitely worth your time.
-- MDT