On Measuring Risk with Scarce Observations