This paper (this work was achieved through the Laboratory of Excellence on Financial Regulation (Labex ReFi) supported by PRESheSam under the reference ANR-10-LABEX-0095) analyses how risks are measured in financial institutions, for instance Market, Credit, Operational, among others with respect to the choice of risk measures, the choice of distributions used to model them and the level of confidence selected. We discuss and illustrate the characteristics, the paradoxes and the issues observed, comparing the Value-at-Risk and the Expected Shortfall in practice. This paper is built as a differential diagnosis and aims at discussing the reliability of the risk measures and making some recommendations. (This paper has been written in a very particular period of time as most regulatory papers written in the past 20 years are currently being questioned by both practitioners and regulators themselves. Some disarray has been observed among risk managers as most models required by the regulation have not been consistent with their own objective of risk management. The enlightenment brought by this paper is based on an academic analysis of the issues engendered by some pieces of regulation and its purpose is not to create any sort of controversy).