On conducting an analysis of corruption risks