The Correlation Problem in Operational Risk