This paper analyzes the reliability of standard approaches for financial risk analysis. We focus on the difference between value--at--risk and expected shortfall, their small sample properties, the scope for underreporting risk and how estimation can be improved. Overall, we find that risk forecasts are extremely uncertain at low sample sizes, with value--at--risk more accurate than expected shortfall. Value--at--risk is easily deliberately underreported without violating regulations and control mechanisms. Finally, we discuss the implications for {academic research, }practitioners and regulators, along with best practice suggestions.