How risky is Riskmetrics?