A risk-based approach using process flow diagrams for operational