We consider a contracting problem in which a principal hires an agent to manage a risky project. When the agent chooses volatility components of the output process and the principal observes the output continuously, the principal can compute the quadratic variation of the output, but not the individual components. This leads to moral hazard with respect to the risk choices of the agent. We identify a family of admissible contracts for which the optimal agent's action is explicitly characterized, and, using the recent theory of singular changes of measures for Itô processes, we study how restrictive this family is. In particular, in the special case of the standard Homlstrom-Milgrom model with fixed volatility, the family includes all possible contracts. We solve the principal-agent problem in the case of CARA preferences, and show that the optimal contract is linear in these factors: the contractible sources of risk, including the output, the quadratic variation of the output and the cross-variations between the output and the contractible risk sources. Thus, like sample Sharpe ratios used in practice, path-dependent contracts naturally arise when there is moral hazard with respect to risk management. In a numerical example, we show that the loss of efficiency can be significant if the principal does not use the quadratic variation component of the optimal contract.