Value at Risk (VaR)

Value at Risk answers a question every risk committee asks: "What's the most I can lose on a normal day?" Formally, VaR is a quantile of the loss distribution, the loss level that will not be exceeded with a chosen probability over a chosen horizon. It became the lingua franca of risk after J.P. Morgan's RiskMetrics and is embedded in Basel bank-capital rules. It is also deeply flawed in ways that matter, which is why understanding both how to compute it and how it fails is essential, and why the regulators eventually moved to Expected Shortfall (CVaR).

Definition

Let $L$ be the loss (negative P&L) over a horizon $h$. For a confidence level $\alpha$ (e.g. 99%), the Value at Risk is the smallest loss threshold not exceeded with probability $\alpha$:

$\boxed{\;\text{VaR}_\alpha = \inf\{\ell : \Pr(L \le \ell) \ge \alpha\} = F_L^{-1}(\alpha).\;}$

Equivalently, $\Pr(L > \text{VaR}_\alpha) = 1-\alpha$. A 1-day 99% VaR of $10m means: on 99% of days losses stay below $10m, and on the worst 1% of days (about 2–3 days a year) they exceed it. Crucially, VaR says nothing about how far beyond it you go, a fact that is its central weakness.

Three ways to compute it

1. Parametric (variance-covariance). Assume returns are Gaussian with volatility $\sigma$. Then

$\text{VaR}_\alpha = -\big(\mu_h + z_\alpha\,\sigma_h\big)\cdot V,$

where $z_\alpha$ is the standard-normal quantile ($z_{0.99} = 2.326$, $z_{0.95} = 1.645$) and $V$ is portfolio value. For a portfolio, $\sigma_h = \sqrt{h}\sqrt{w^\top\Sigma w}$ from a covariance model (often a Factor Risk Models $\Sigma$). Fast and analytic, but assumes normality, it understates tail risk when returns are fat-tailed, and it cannot handle option-like nonlinearity.

2. Historical simulation. Take the empirical distribution of the last $T$ portfolio returns and read off the $(1-\alpha)$ empirical quantile, no distributional assumption. With 500 days at 99%, VaR is roughly the 5th-worst loss. Captures fat tails and skew that actually occurred, but is entirely backward-looking: if the sample contains no crash, VaR sees no crash, and it reacts slowly (a big move stays in the window then abruptly drops out, "ghosting").

3. Monte Carlo. Simulate many return paths from a model (Gaussian, $t$, GARCH, jump-diffusion, or a factor model), fully reprice the portfolio under each, including nonlinear derivatives, and take the empirical quantile. The most flexible and the only method that properly handles optionality and gamma, at the cost of a model and heavy computation.

Horizon scaling

Under i.i.d. returns, volatility scales with the square root of time, so $\text{VaR}$ scales as $\sqrt{h}$: a 10-day VaR is $\sqrt{10}\approx 3.16\times$ the 1-day VaR, the "square-root-of-time" rule Basel used. It breaks under autocorrelation, volatility clustering, or fat tails.

Backtesting

Because VaR is a probabilistic forecast, you validate it by counting exceptions (days where realized loss exceeded the VaR). Over $T$ days at level $\alpha$, exceptions should number $\approx (1-\alpha)T$ and be independent.

• Kupiec POF test. A likelihood-ratio test that the observed exception rate $\hat p = x/T$ equals the target $1-\alpha$; too many exceptions means the model understates risk, too few means it wastes capital.
• Christoffersen test. Adds an independence test: exceptions should not cluster. Clustered breaches (several in a row during a stress week) indicate the model fails to update to changing volatility, even if the total count looks fine.

Basel's "traffic light" system counts exceptions in a 250-day window: green ($\le 4$), yellow (5–9, capital multiplier rises), red ($\ge 10$, model rejected).

Worked example

A $100m portfolio, daily vol $\sigma = 1.5\%$, assume zero mean. Parametric 99% 1-day VaR: \text{VaR}_{0.99} = 2.326 \times 0.015 \times \100\text{m} = $3.49\text{m}$. At 95$1.645\times 0.015\times$100\text{m} = $2.47\text{m}$. Scaling the 99$$3.49\text{m}\times\sqrt{10} = $11.0\text{m}$. Now suppose the true return distribution is Student-$t$with 4 degrees of freedom (fat tails): the true 99$2.326\sigma$, so the Gaussian VaR understates the real tail, the classic parametric-VaR trap. Historical simulation on a sample that includes a crash would reveal the heavier tail; a sample from a calm period would not.

Failure modes and criticisms

• Tail-blind. VaR is the threshold of the tail, not its size. Two portfolios with identical 99% VaR can have wildly different expected losses beyond it; VaR cannot distinguish a capped loss from a catastrophic one. This is the motivation for Expected Shortfall (CVaR).
• Not subadditive. VaR can violate the diversification principle: $\text{VaR}(A+B) > \text{VaR}(A)+\text{VaR}(B)$ is possible, so merging two books can increase measured risk. This means VaR is not a coherent risk measure (Coherent Risk Measures), a serious defect for capital allocation across desks.
• Gaming and moral hazard. Because VaR ignores tail depth, a trader can lower reported VaR while loading up on rare, huge losses (selling deep out-of-the-money options), hidden risk that only shows up beyond the quantile.
• Model and sample risk. Parametric VaR assumes normality; historical VaR is hostage to its window; all methods failed spectacularly in 2008 when correlations and volatilities jumped together.

In interviews

Define VaR precisely as a quantile of the loss distribution, $\Pr(L > \text{VaR}_\alpha)=1-\alpha$, and resist the common error of calling it "the maximum loss" (it is the maximum on all but the worst $1-\alpha$ of days). Walk through the three methods and their trade-offs: parametric (fast, assumes normality, misses tails), historical (assumption-free, backward-looking), Monte Carlo (flexible, handles options, model-heavy). Know the parametric formula $z_\alpha\sigma V$ and $z_{0.99}=2.33$. Be ready for the two killer criticisms, VaR ignores the size of losses beyond it, and it is not subadditive so it can penalize diversification, and to say that both are fixed by expected shortfall. See Expected Shortfall (CVaR) and Coherent Risk Measures.