We consider a contracting problem in which a principal hires an agent to manage a risky project. When the agent chooses volatility components of the output process and the principal observes the output continuously, the principal can compute the quadratic variation of the output, but not the individual components. This leads to moral hazard with respect to the risk choices of the agent. To find the optimal contract, we develop a novel approach to solving principal-agent problems: first, we identify a family of admissible contracts for which the optimal agent's action is explicitly characterized; then, we show that we do not lose on generality when finding the optimal contract inside this family, up to integrability conditions. To do this, we use the recent theory of singular changes of measures for Ito processes. We solve the problem in the case of CARA preferences and show that the optimal contract is linear in these factors: the contractible sources of risk, including the output, the quadratic variation of the output and the cross-variations between the output and the contractible risk sources. Thus, like sample Sharpe ratios used in practice, path-dependent contracts naturally arise when there is moral hazard with respect to risk management. In a numerical example, we show that the loss of efficiency can be significant if the principal does not use the quadratic variation component of the optimal contract.