On conducting an internal analysis of corruption risks