VaR (Value at Risk): what it measures, and more importantly what it doesn't
In the article on counterparty risk, EAD, PFE and CVA answer the question "what if my counterparty defaults?". VaR answers a different, more general question: on a given portfolio, how much loss can reasonably be anticipated over a given horizon, with no counterparty needing to default at all? Market movements alone (rates, prices, FX) are enough.
The definition, with a concrete example
A 1-day 99% VaR of €500,000 means: over a trading day, there's a 99% chance the portfolio's loss stays under €500,000, and therefore a 1% chance it exceeds it. It's neither an absolute maximum nor a forecast: it's a statistical threshold, calibrated to a chosen confidence level (95%, 99%, sometimes higher depending on regulation).
Distribution of daily gains/losses
(area = probability)
gains losses
◄─────────────────────────┼──────────────────────────────────────►
0 │
│◄── 1% of the
│ distribution
│
VaR 99% = €500,000
The area to the right of the VaR threshold (the remaining 1%) isn't measured by VaR itself: it only tells you where that zone begins, not how large the loss inside it can get.
Three calculation methods, three trade-offs
| Method | Principle | Strength | Weakness |
|---|---|---|---|
| Historical VaR | Replays actually observed market moves over a past window (often 1-2 years) | Assumes no particular distribution shape | Assumes the recent past is representative of the near future |
| Parametric VaR (variance-covariance) | Assumes a normal distribution of returns, computes VaR analytically | Fast to compute, even on a large portfolio | Underestimates extreme events (reality has fatter tails than a normal distribution) |
| Monte Carlo VaR | Simulates thousands of market scenarios from a stochastic model | The most flexible, handles non-linear products (options) | The most computationally expensive, sensitive to the quality of the chosen model |
None of the three is strictly superior to the others: the choice depends on the portfolio (linear products or ones with optionality), the available compute time, and what the regulator requires.
What VaR never tells you
This is the most misunderstood point, including among professionals who quote the number without having dug into its definition: VaR says nothing about the size of the loss beyond the threshold. A 99% VaR of €500,000 is just as consistent with a loss of €510,000 in the worst of the 1% of cases as it is with a loss of €50 million in that same 1% of cases. The VaR figure alone can't distinguish between these two radically different situations.
That's exactly the problem Expected Shortfall (or CVaR, Conditional VaR) fixes: instead of stopping at the threshold, it computes the average loss within the scenarios that exceed it. That's why the FRTB (Fundamental Review of the Trading Book) regulatory framework shifted capital requirements from VaR to Expected Shortfall: VaR alone was no longer enough to correctly describe tail risk.
Stress testing, an indispensable complement
Stress testing complements VaR in a different way: rather than reasoning in probabilities, it applies a deliberately chosen extreme scenario (a bond market crash, a 200-basis-point rate shock, a replay of the 2008 scenario) and looks at the impact on the portfolio, without asking how probable that scenario is. VaR answers "what's likely", stress testing answers "what would be catastrophic if it happened", and serious risk management needs both answers, not just one.
Why this topic deserves to be understood, not just quoted
Outside trading floors, the risk is treating VaR as a single number that "says the risk", when it only tells part of the story, calibrated to one specific method and data window. That's the kind of nuance I try to make accessible on Finance for Engineers, a site I built to explain these concepts to curious developers with no access to a trading desk: VaR has its place there, alongside the glossary entry that defines it precisely and the articles that put it back in its regulatory context.