This paper concerns sequential computation of risk measures for financial data and asks how, given a risk measurement procedure, we can tell whether the answers it produces are `correct'. We draw the distinction between `external' and `internal' risk measures and concentrate on the latter, where we observe data in real time, make predictions and observe outcomes. It is argued that evaluation of such procedures is best addressed from the point of view of probability forecasting or Dawid's theory of `prequential statistics' [J. Roy. Statist. Soc. A 147 (1984), 278–292]. We introduce a concept of `calibration' of a risk measure in a dynamic setting, following the precepts of Dawid's weak and strong prequential principles, and examine its application to quantile forecasting (VaR – value at risk) and to mean estimation (applicable to CVaR – expected shortfall). The relationship between these ideas and `elicitability' [J. Amer. Statist. Assoc. 106 (2011), 746–762] is examined. We show in particular that VaR has special properties not shared by any other risk measure. Turning to CVaR we argue that its main deficiency is the unquantifiable tail dependence of estimators. In a final section we show that a simple data-driven feedback algorithm can produce VaR estimates on financial data that easily pass both the consistency test and a further newly-introduced statistical test for independence of a binary sequence.