Adding prior knowledge to quantitative operational risk models