Rules for conducting an external analysis of corruption risks