Internal vs. external risk measures: How capital requirements differ in practice