Text this: On the inadequacy of VaR-based risk management