Risk: From Market Risk to Expected Credit Loss, Part 1. This series follows on from the Quant Finance Foundations series.
Value at Risk is the number that turned risk management into a discipline with a single headline figure — and the number that got blamed when the discipline failed. Both reputations are overstated. It is a useful summary statistic with clearly defined limits, and the limits are the interesting part.
What value at risk actually says
A VaR figure is a sentence with three slots: a loss amount, a time horizon, and a confidence level. Fill them in and you get something like this:
The one-day 99% VaR of this portfolio is 4.2 billion VND.
Read that carefully. It means that on 99 days out of 100, the portfolio should lose less than 4.2 billion. It does not mean the maximum loss is 4.2 billion. On the hundredth day the loss could be 5 billion, or 50.
That distinction is the entire controversy around the measure, and it will occupy the next post. For now, note what the definition gives you: a single comparable number across desks trading entirely different instruments. A bond desk and an FX desk have nothing in common operationally, but both can report a one-day 99% VaR, and those numbers add up into a firm-wide figure. That comparability is why the measure spread so fast.
Three ways to compute it
The definition says nothing about method. Three approaches dominate, and they disagree.
| Historical simulation | Parametric (variance-covariance) | Monte Carlo | |
|---|---|---|---|
| Core assumption | The past repeats | Returns are normal | A chosen model is right |
| Fat tails captured | Only those in the window | No | If the model has them |
| Non-linear payoffs | Yes | Poorly | Yes |
| Compute cost | Low | Very low | High |
| Main failure mode | Quiet window, low VaR | Understates tails | Model risk |
Historical simulation
Take the last 250 or 500 trading days of market moves. Apply each day’s move to today’s portfolio. Sort the resulting profit-and-loss figures and read off the first percentile.
The appeal is that it assumes nothing about distribution shape. Fat tails, skew, and correlation structure all come along for free, provided they appeared in the window. That proviso is the weakness: a portfolio measured after two calm years will show a reassuringly small VaR precisely because nothing has gone wrong recently.
Parametric
Assume returns are normally distributed. Estimate volatility and correlations, then read the percentile off the normal distribution — at 99%, roughly 2.33 standard deviations.
It is fast and analytically clean. However, the fat tails covered in the previous series make the normality assumption actively misleading in the tail, which is exactly where VaR lives. It also handles options badly, since a linear approximation cannot represent a curved payoff.
Monte Carlo
Simulate many scenarios from a chosen distribution, revalue the portfolio fully in each, and read the percentile. The machinery is exactly the Monte Carlo simulation built in the previous series, pointed at a different question.
Full revaluation makes this the only method that handles complex books honestly. The cost is compute time and, more importantly, model risk: the output inherits every assumption you fed in.
A worked example
A portfolio worth 100 billion VND, with daily volatility of 1.2%, holding only linear instruments.
- Daily standard deviation in money terms: 100bn × 1.2% = 1.2 billion.
- At 99% confidence, the normal multiplier is 2.33.
- One-day 99% VaR = 1.2bn × 2.33 = 2.80 billion VND.
- Scaling to ten days uses the square root of time: 2.80bn × √10 = 8.85 billion VND.
That √10 should look familiar — it is the same square-root-of-time scaling derived from coin flips in the post on Brownian motion. It is also the first thing to distrust. Scaling assumes independent daily returns, and in a crisis returns are anything but independent: bad days cluster, so the true ten-day loss exceeds the scaled figure.
Where value at risk misleads
It says nothing about the tail. Two portfolios can share a 99% VaR of 2.8 billion while one loses 3 billion on the worst day and the other loses 40. The measure cannot distinguish them.
It is not sub-additive. Combining two portfolios can produce a VaR larger than the sum of the parts. That violates the intuition that diversification never hurts, and it is a genuine mathematical defect rather than an estimation issue.
It is procyclical. Calm markets shrink measured VaR, which permits larger positions, which amplifies losses when volatility returns. The measure is loosest exactly when it should be tightest.
It invites gaming. A trader rewarded for low VaR can sell deep out-of-the-money options: tiny probability of loss, so almost no VaR contribution, and a large payout collected until the day it is not.
Frequently asked questions
What does a 99% value at risk figure mean?
It is the loss level that should be exceeded on only one day in a hundred. It is a threshold, not a worst case.
Which VaR method should a bank use?
Historical simulation is the common default for its simplicity and lack of distributional assumptions. Books with significant optionality generally need Monte Carlo with full revaluation.
Why is VaR criticised so heavily?
Because it is silent about the size of losses beyond the threshold, and because it is not sub-additive. Both shortcomings matter most in exactly the conditions it is meant to warn about.
Is VaR still used?
Yes, widely, for internal limits and reporting. Basel’s market risk framework has nevertheless moved to expected shortfall for capital purposes.
Try it yourself
Build a historical-simulation VaR from scratch, in this order:
- Download two years of daily prices for three liquid assets.
- Compute daily returns for each, then build a portfolio return series with fixed weights.
- Sort the portfolio returns from worst to best.
- Read off the value at the first percentile — that is your 99% VaR.
- Recompute using only the most recent 100 days and compare the two figures.
The gap between those two numbers, computed on identical holdings, is the procyclicality problem in concrete form.
Next in this series: why VaR failed in 2008, and what expected shortfall fixes.