Change-Point Detection in Risk Monitoring

Some risk metrics — portfolio volatility, correlation between two hedges, a strategy's daily P&L variance — don't drift smoothly; they hold steady at one level for a long stretch and then jump abruptly to a new level, because something structural changed: a market regime shifted, a hedge broke, a counterparty's behavior changed. Averaging the whole history together hides the jump inside a smeared-out number. Change-point detection is built specifically to find the moment a series switched from one stable regime to another, rather than just reporting that the long-run average moved.

The analogy: finding when a river changed course, not just its average path

If a river ran along one path for fifty years and then, after a flood, settled into a completely different path for the next fifty, averaging the two paths together would draw a line down the middle that the river never actually followed in either era. What you actually want to know is: when did the flood happen, and where was the river before versus after. Change-point detection answers exactly that question for a numerical series — not "what's the average," but "where's the one moment that splits this series into two genuinely different regimes."

Worked example 1: a CUSUM statistic catching a variance jump

A simple approach, the cumulative sum (CUSUM), tracks running deviations from a baseline. Suppose a strategy's daily P&L standard deviation has been stable near $\sigma_0 = 1.0$ for months. Track the cumulative sum of $(x_t^2 - \sigma_0^2)$ day by day, where $x_t$ is that day's P&L:

$$S_t = \sum_{i=1}^{t} (x_i^2 - \sigma_0^2)$$

While volatility stays near $\sigma_0$, $S_t$ wanders near zero. Suppose on day 40 the true volatility jumps to $\sigma_1 = 2.0$ and stays there. From day 40 onward, each $x_i^2$ averages around $4.0$ instead of $1.0$, so each new term adds roughly $+3.0$ to $S_t$ on average. $S_t$ starts climbing in a clear, sustained trend right at day 40 — the point where the slope of $S_t$ visibly kinks is the estimated change-point, not day 1 and not "sometime in the last few months."

Worked example 2: comparing two candidate split points

Suppose a 20-day correlation series between a stock and its hedge sits near $0.85$ for the first 12 days, then near $0.55$ for the last 8 days. A change-point algorithm tests candidate split points by asking: if I split the series here, how much does modeling "two separate constant levels" reduce total squared error versus "one constant level for the whole 20 days"? Splitting at day 12 gives two nearly-constant segments (errors close to zero within each); splitting at, say, day 5 forces the first segment to average across both the $0.85$ true level and part of the $0.55$ level, leaving a much larger residual error. The algorithm picks whichever candidate split minimizes total error, and here that is decisively day 12 — recovering the true break rather than an arbitrary one.

What this means in practice

Risk teams run change-point detection on rolling volatility, correlation, and drawdown series to catch regime shifts as soon as they're statistically supportable, then investigate the cause — a hedge that stopped working, a market structure change, a strategy quietly breaking. Detecting the change-point fast matters because risk limits and hedge ratios calibrated to the old regime can be badly wrong the moment the new one starts, and every day of delay compounds that mismatch.