Identifying internal weaknesses and vetting controls to detect internal fraud