Value at Risk (VaR)

VaR answers the question 'what is the maximum loss at a given confidence level?' — but it says nothing about how large losses can be beyond that threshold. Expected Shortfall (ES), also called Conditional VaR (CVaR), answers the complementary question 'if losses exceed VaR, what is the average loss?' ES is always greater than or equal to VaR and provides a more complete description of tail risk. For example, if 99% VaR is $1M, CVaR might be $1.8M — meaning losses beyond the VaR threshold average $1.8M. Basel III has progressively shifted from VaR toward Expected Shortfall as the primary regulatory risk measure due to CVaR's superior tail risk properties.

VaR is a quantile measure — it specifies a threshold that losses will not exceed with a given probability, but it provides no information about the distribution of losses beyond that threshold. Two portfolios can have identical VaRs but very different tail loss profiles: one might have moderate losses just beyond VaR, while another might experience catastrophic losses. This limitation is particularly severe for portfolios with options, credit derivatives, or other instruments with non-linear, highly skewed return distributions. The practical consequence is that VaR alone is insufficient for risk management and must be supplemented by Expected Shortfall and stress testing.

The most common choices are 95% (used in many internal risk management applications and by some regulators) and 99% (specified by Basel III for bank market risk capital). Some firms use 99.9% or higher for economic capital and stress testing purposes. The choice depends on the application: internal risk limits might use 95% VaR for daily monitoring (producing more frequent but smaller exceptions), while regulatory capital and risk tolerance frameworks typically use 99% VaR. Higher confidence levels produce larger VaR estimates and require more historical data for reliable estimation — 99.9% VaR from historical data requires at least 1,000 observations to have a meaningful number of tail events.

VaR models are backtested by comparing daily VaR estimates against actual subsequent P&L realizations and counting the number of 'exceptions' — days when actual losses exceeded the VaR estimate. For a correctly calibrated 99% VaR model, approximately 1% of days should produce exceptions — about 2 to 3 days per year out of 250 trading days. Basel III uses a traffic-light system: 0–4 exceptions per year is a green zone (model is acceptable), 5–9 is a yellow zone (model is suspect, additional capital charges apply), and 10+ is a red zone (model is rejected). Systematic over- or under-prediction of exceptions triggers regulatory scrutiny and model recalibration.

VaR has several well-documented limitations. It can provide false precision — expressing risk as a single number can create misleading confidence. It does not measure tail risk (losses beyond the VaR threshold). Parametric VaR assumes normally distributed returns, which underestimates risk from fat-tailed distributions. Historical simulation is backward-looking and may not capture future market conditions. VaR can be procyclical — appearing low during calm markets when risk is actually accumulating, and spiking during crises when positions need to be cut. Additionally, during correlated stress events, diversification benefits assumed by VaR models can disappear, causing actual losses to far exceed VaR estimates.

VaR scales approximately with the square root of the time horizon under the assumption that daily returns are independent and identically distributed (i.i.d.). A 10-day VaR is approximately √10 ≈ 3.16 times the 1-day VaR. This scaling rule is embedded in Basel III (which specifies 10-day VaR for regulatory capital) and is mathematically valid when returns are uncorrelated across time. However, if returns exhibit serial autocorrelation — which many do at short horizons — the square-root-of-time rule overestimates VaR for positively autocorrelated assets and underestimates it for negatively autocorrelated (mean-reverting) ones.

Banks use VaR for regulatory capital calculations (Basel III market risk capital), daily risk limit monitoring for trading desks, counterparty credit exposure estimation, and economic capital allocation across business lines. Investment managers use VaR for portfolio construction (optimizing the portfolio to achieve target VaR within risk budget constraints), client reporting (disclosing portfolio risk in standardized form), fund prospectus risk disclosures (required in UCITS funds in the EU), and stress testing. Risk management systems at major banks compute VaR in real time across thousands of positions and asset classes to aggregate firm-wide market risk exposure.