On conducting an analysis of internal corruption risks