Incorporating risk in a positive mathematical programming framework: a dual approach