Integration of qualitative and quantitative operational risk data: a Bayesian approach.