Value at Risk: What It Tells You, and What It Doesn’t

It's Monday morning and the head of a fund asks her risk manager a simple question: "How bad could tomorrow be?"

The risk manager doesn't say "we could lose everything", even though, in theory, that's true. He says: "On 95 days out of 100, we won't lose more than $1.6 million."

That sentence is value at risk, or VaR. It is the most widely used number in risk management, it is all over the FRM exam, and it is easy to misread. Let's take it apart.

What VaR actually says

VaR always has three parts:

• A time horizon: one day, ten days, a month.
• A confidence level: usually 95% or 99%.
• An amount of money: $1.6 million.

Put together: "The 1-day 95% VaR is $1.6 million" means that on any given day, there is a 95% chance the loss will be smaller than $1.6 million, and a 5% chance it will be bigger. Five percent is about one trading day a month.

Notice what it does not say. It does not say $1.6 million is the most you can lose. On that one bad day a month, the loss could be $1.7 million, or it could be $17 million. VaR is a line in the sand, not the bottom of the pit.

The simplest way to calculate it

The quickest method assumes daily returns follow a normal distribution with an average close to zero. Then VaR is just:

• z comes from the normal distribution: 1.645 for 95%, 2.326 for 99%. These are one-tailed values, because only losses count.
• σ is the daily volatility of the portfolio's returns.

For a $100 million portfolio with a daily volatility of 1%:

• 95% 1-day VaR: 1.645 × 1% × $100m = $1,645,000. That is the risk manager's "$1.6 million".
• 99% 1-day VaR: 2.326 × 1% × $100m = $2,326,000.

This is called the parametric, variance-covariance or delta-normal method. It is fast and easy to explain. Its weakness is the normal distribution itself: real markets have more extreme days than the bell curve predicts, so this method tends to underestimate risk far out in the tail, especially at 99% and above.

Two other methods

Historical simulation skips the bell curve. Take the last 500 trading days, apply each day's actual market moves to today's portfolio, and sort the 500 results from worst to best. The 99% VaR is about the fifth-worst loss, because 1% of 500 is 5. Some textbooks take the sixth-worst, or a point between the two, so read the question for the convention. No distribution is assumed, so fat tails and crashes in the data are captured. The catch: the future is assumed to look like the window you picked. If the last two years were calm, your VaR will be too.

Monte Carlo simulation generates thousands of possible tomorrows from a model of how prices behave, revalues the portfolio in each one, and reads the VaR off the results. It handles options and other non-linear positions well (so does historical simulation, if each scenario fully revalues the portfolio). It is also the slowest, and only as good as the model behind it.

From one day to ten

To turn a 1-day VaR into a VaR over T days, multiply by the square root of T, not by T:

So the fund's 99% 1-day VaR of $2,326,000 becomes about $7.36 million over ten days. The square-root rule assumes each day's return is independent of the last, volatility stays the same and the average daily return is close to zero. Markets don't always behave that way, but the rule is standard, and exam questions expect you to use it unless told otherwise.

The same root shows up when you convert volatility. A daily volatility of 1% is roughly 16% a year, because √250 ≈ 15.8.

Why two positions are less risky than their sum

Say a desk holds two positions, each with a VaR of $100,000. Is the total VaR $200,000? Only if they always move together. With a correlation of 0.3, and assuming normal returns and linear positions, the parametric method gives:

That $38,800 gap is the diversification benefit. The lower the correlation, the bigger it gets.

Checking whether a VaR model works

A 99% VaR should be exceeded on about 1% of days. Over 250 trading days, that is about 2.5 days. Risk managers count these exceptions and compare the count with what the model promised. This is called backtesting.

Bank regulators use the same idea. Under the Basel "traffic light" test, which looks at 250 days of 99% VaR, 0 to 4 exceptions put a model in the green zone, 5 to 9 in the yellow zone and 10 or more in the red zone. The bank's capital multiplier rises in the yellow zone and hits its maximum in the red.

What VaR can't tell you

VaR tells you how often losses cross the line. It says nothing about how big those losses are. Two portfolios can have the same VaR while one hides a small worst case and the other a disaster.

That is why expected shortfall (ES) exists: the average loss on the days that do cross the VaR line. For the same $100 million portfolio, the 95% ES under normal returns is about $2.06 million, against a VaR of $1.645 million.

At the same confidence level, ES is never smaller than VaR. That is one reason the Basel Committee's trading-book standard, known as FRTB, replaces 99% VaR with 97.5% ES for banks that use internal models. Some countries already apply it, while the EU, UK and US are still phasing it in. Under normal returns the two are almost the same size: 2.338σ for the 97.5% ES against 2.326σ for the 99% VaR.

Try it yourself

Raise the confidence level, the volatility or the horizon and watch the VaR line and the expected shortfall line move out into the tail.

Where VaR shows up on the exams

• FRM Part I (Valuation and Risk Models, 30%): the three methods, parametric VaR for linear and option positions, time scaling, and expected shortfall.
• FRM Part II (Market Risk Measurement and Management, 20%): backtesting, VaR mapping, non-parametric methods, extreme value theory and the limits of VaR.
• CFA Level II (Portfolio Management, "Measuring and Managing Market Risk"): parametric, historical and Monte Carlo VaR, their strengths and weaknesses, plus expected shortfall and stress tests.

The four mistakes that cost marks

1. Scaling by T instead of √T. Ten days is × 3.16, not × 10.

2. Mixing up daily and annual volatility. Daily σ = annual σ ÷ √250 (some questions use 252). Check which one the question gives you.

3. Using the two-tailed z. 95% VaR uses 1.645, not 1.96. Only the loss side counts.

4. Calling VaR the maximum loss. It is the threshold that losses cross on about 5% (or 1%) of days, not the worst case.

Back to Monday morning

The risk manager's answer was honest, as long as the head of the fund heard all of it: on 95 days out of 100, less than $1.6 million. On the other five, VaR has nothing more to say. A good risk manager follows it with the expected shortfall, so nobody mistakes the line in the sand for the bottom.

Related reading: for option positions, parametric VaR is built from delta and gamma, explained in The Option Greeks. For bond positions it starts from DV01, in Duration and Convexity.

Want to check you have it? The FRM questions in the JephAi Questions Bank include VaR, expected shortfall and scaling calculations, each with a worked explanation.