Value at Risk, and the Question It Refuses to Answer

A trading book's future value is a distribution, not a number. Management, regulators and counterparties all want a single figure anyway, and Value at Risk is the standard attempt.

VaR is a quantile of the loss distribution. A one-day 99% VaR of 2 million means: on 99% of days, the loss will be less than 2 million. Three parameters define it, and all three are choices rather than facts. The horizon is how far ahead you are looking. The confidence level is which quantile. And the distribution is whatever assumption or data set you used.

Its appeal is genuine. It is denominated in money rather than in standard deviations, it applies across asset classes, and it aggregates. A desk trading bonds and a desk trading equity options can be compared on one scale.

That compression is also the problem, and the rest of this lesson is about what gets lost in it.

The definition is one thing; producing a number requires a distribution, and there are three standard routes.

Historical simulation replays actual past returns through the current portfolio and reads off the quantile. It assumes the future resembles the sample you chose, and it cannot produce a loss larger than the worst one in that window.

Parametric, or variance-covariance, assumes a distributional form, usually normal, estimates volatilities and correlations, and computes the quantile analytically. It is fast and aggregates neatly, and it inherits every defect of the normal assumption.

Monte Carlo simulates paths from a specified model and revalues the portfolio under each. It handles nonlinear instruments such as options properly, at the cost of being only as good as the model generating the paths.

The choice is not technical detail. Historical simulation on a calm window and Monte Carlo with fat tails can differ by a factor of several on the same book, and neither is wrong in its own terms.

Historical VaR is a sort and an index lookup, which is worth seeing because the simplicity is part of why it spread.

def var_and_es(losses, confidence=0.99):
    """losses: positive numbers are losses. Returns (VaR, expected shortfall)."""
    ordered = sorted(losses)
    idx = int(confidence * len(ordered))
    var = ordered[idx]
    tail = ordered[idx:]                       # the breaches themselves
    es = sum(tail) / len(tail)
    return var, es

# 1000 days of daily P&L, mostly quiet with a few bad days
var99, es99 = var_and_es(daily_losses, 0.99)
var99      # e.g. 1.9m : the threshold
es99       # e.g. 3.4m : the average loss when the threshold is breached

The second number is expected shortfall, sometimes called conditional VaR: the average loss given that the VaR level is breached.

Both come from the same sorted array, which makes the comparison direct. VaR reads one point on the distribution. Expected shortfall reads the average of everything past it. That difference turns out to matter more than it looks.

The definition contains an omission that is easy to state and easy to forget: VaR says nothing whatsoever about what happens beyond the threshold.

Consider two books with an identical one-day 99% VaR of 2 million. In the first, the worst 1% of days lose between 2 and 3 million. In the second, they lose between 2 million and the entire firm. The number is the same. The risk is not remotely the same.

This is not a subtle limitation. It is the definition working exactly as specified, and it means VaR is uninformative about precisely the events that matter, since a firm is destroyed by tail losses and not by the 99th percentile.

Expected shortfall closes this specific gap by averaging over the tail rather than reading its boundary. The two books above would report clearly different expected shortfalls.

A related misreading concerns the confidence level. A 99% one-day VaR is not a safety threshold; it is an expectation of roughly two or three breaches per trading year. Breaches are the model working, not failing. A year with none suggests the number is too high.

There is a worse failure, and it is arithmetic rather than statistical.

Take a bond that repays in full with probability 0.96 and defaults with probability 0.04, losing its full notional. Hold 50 of notional in one such bond. The loss is 0 with probability 0.96, so the 95th percentile loss is zero. VaR at 95% is 0.

Now hold 50 in each of two independent such bonds. The portfolio loses nothing with probability 0.96 * 0.96 = 0.9216, loses 50 with probability 2 * 0.96 * 0.04 = 0.0768, and loses 100 with probability 0.0016.

Since 0.9216 is below 0.95, the 95th percentile loss is now 50. VaR at 95% is 50.

VaR(bond A) + VaR(bond B)  =  0 + 0  =   0
VaR(A and B together)                =  50

The diversified portfolio reports higher risk than the sum of its parts. Nothing about the position got worse; the measure did.

Philippe Artzner, Freddy Delbaen, Jean-Marc Eber and David Heath formalised what a risk measure ought to satisfy in "Coherent Measures of Risk", Mathematical Finance, volume 9, issue 3, 1999, pages 203 to 228. A measure meeting all four axioms is called coherent.

The subadditivity axiom is the one carrying the practical weight. It says the risk of a combined portfolio cannot exceed the sum of the parts, which is the formal statement that diversification cannot hurt. The example above shows VaR violating it.

The consequences are organisational rather than mathematical. If risk limits are set on VaR, splitting a book across two desks can reduce measured risk without changing any position, and merging desks can increase it. Anyone whose bonus depends on a VaR limit has a reason to notice.

Expected shortfall satisfies all four axioms, which is the technical reason it displaced VaR rather than merely supplementing it.

The critique moved from journals into rules. Under the Basel Committee's revised market risk framework, expected shortfall replaces VaR as the basis for internal-model capital, at a 97.5% one-tailed confidence level.

The choice of 97.5% rather than the familiar 99% looks arbitrary and is not. Under a normal distribution, 97.5% expected shortfall comes out close to 99% VaR, so the switch changes the shape of what is measured without immediately changing the level of capital required. It is a deliberate decision to alter the measure's properties while leaving its calibration roughly where the industry already was.

The framework makes a second change worth noting. Instead of a uniform ten-day horizon, it applies several liquidity horizons, reflecting that different positions take different lengths of time to exit.

That second change addresses something the first does not. Both VaR and expected shortfall assume you can close the position over the stated horizon at the prices in the model, and in the situations that actually threaten a firm, you cannot.

The last row is the practical test and it inverts most people's instinct. A model producing no breaches is not conservative; it is uncalibrated, and it is probably licensing more position than intended.

Backtesting a risk model means comparing the frequency of breaches to the frequency the confidence level promised. It is the only external check available, and it takes a long time to be conclusive, because the events being counted are rare by construction.

Both measures share a dependency that neither exposes. Each is computed from a distribution of returns, and that distribution is estimated, usually from recent history.

So the number inherits every property of that estimate. If the sample period was calm, the distribution is narrow and both VaR and expected shortfall are small. If correlations in the sample were low, diversification looks effective and the aggregate looks modest.

This produces a specific and dangerous behaviour: measured risk falls during calm periods, which is exactly when positions tend to be increased, and rises after losses have already occurred, which is exactly when reducing is most expensive.

The measure is procyclical, and no choice between VaR and expected shortfall fixes it, because the problem is in the estimated distribution rather than in the functional applied to it.

The next lesson is about that distribution: which of its standard assumptions fail, when they fail together, and what has to be done alongside a risk number rather than instead of it.