  This paper concerns sequential computation of risk measures for financial
data and asks how, given a risk measurement procedure, we can tell whether the
answers it produces are `correct'. We draw the distinction between `external'
and `internal' risk measures and concentrate on the latter, where we observe
data in real time, make predictions and observe outcomes. It is argued that
evaluation of such procedures is best addressed from the point of view of
probability forecasting or Dawid's theory of `prequential statistics' [Dawid,
JRSS(A)1984]. We introduce a concept of `calibration' of a risk measure in a
dynamic setting, following the precepts of Dawid's weak and strong prequential
principles, and examine its application to quantile forecasting (VaR -- value
at risk) and to mean estimation (applicable to CVaR -- expected shortfall). The
relationship between these ideas and `elicitability' [Gneiting, JASA 2011] is
examined. We show in particular that VaR has special properties not shared by
any other risk measure. Turning to CVaR we argue that its main deficiency is
the unquantifiable tail dependence of estimators. In a final section we show
that a simple data-driven feedback algorithm can produce VaR estimates on
financial data that easily pass both the consistency test and a further
newly-introduced statistical test for independence of a binary sequence.
