Model rules for conducting internal analysis of corruption risks