While the {estimation} of risk is an important question in the daily business of banking and insurance, many existing plug-in estimation procedures suffer from an unnecessary bias. This often leads to the underestimation of risk and negatively impacts backtesting results, especially in small sample cases. In this article we show that the link between estimation bias and backtesting can be traced back to the dual relationship between risk measures and the corresponding performance measures, and discuss this in reference to value-at-risk, expected shortfall and expectile value-at-risk. Motivated by the consistent underestimation of risk by plug-in procedures, we propose a new algorithm for bias correction and show how to apply it for generalized Pareto distributions to the i.i.d. setting and to a GARCH(1,1) time series. In particular, we show that the application of our algorithm leads to gain in efficiency when heavy tails or heteroscedasticity exists in the data.