Regulators and financial institutions increasingly depend on statistical risk forecasting. This column argues that most risk modelling approaches are highly inaccurate and confidence intervals should be provided along with point estimates. Two major approaches, value-at-risk and expected shortfall are compared, and while the former is found to be superior in practice, it is also easier to be manipulated by forecasters.