Introduction to Value-at-Risk (VaR): Different Methodologies, Assumptions, and Limitations

What is Value-at-Risk?

At its core, Value-at-Risk is a statistical measure that identifies a specific point in the distribution of potential portfolio returns. More precisely, VaR represents the maximum expected loss over a given time horizon at a specified confidence level, under normal market conditions.

In practice, VaR tells portfolio and risk managers how much they could lose in an “average worst‑case” scenario (e.g., 5% one-day VaR). It quickly became a standard tool: financial institutions use it for risk management, and regulators use it to set capital requirements.

In simpler terms, it answers:

"What is the worst-case loss I can expect with a certain % confidence over the next 'n' days?"

For example, a 1-day VaR of $10 million at 99% confidence implies that there is a 99% chance that losses will be less than or equal to $10 million, with a 1% chance that the portfolio could lose more than $10 million in a single day.

This definition contains several crucial components that must be understood precisely. The term "maximum expected loss" refers not to the actual worst-case scenario, but rather to a threshold that will not be exceeded with a certain probability. The "confidence level" specifies this probability; a 95% confidence level means we expect losses to stay below the VaR threshold 95% of the time. The "time horizon" defines the period over which we're measuring potential losses, typically one day for trading operations or ten days for regulatory capital calculations.

The phrase "under normal market conditions" is particularly important and often overlooked. VaR is designed to capture the risk of typical market fluctuations, not catastrophic events or market crashes. This limitation is intentional. VaR provides a measure of day-to-day risk that can be monitored and managed on an ongoing basis. Extreme events that fall outside the VaR threshold (the so-called "tail risk") require separate analysis through stress testing and scenario analysis.

To make this concrete, consider a portfolio or a risk manager who calculates a one-day 95% VaR of $5 million. This means that based on historical patterns and current positions, there is a 95% probability that daily portfolio losses will not exceed $5 million. Equivalently, there is a 5% probability, roughly one day in twenty or 5 days in a hundred, that losses will exceed this threshold. The VaR measure tells us where this threshold lies, but provides no information about how much losses might exceed it on those worst days.

Understanding the Mechanics of Value-at-Risk (VaR)

Every VaR calculation requires the specification of three critical parameters, and the interpretation of VaR is meaningless without clearly stating these parameters.

• Confidence Level: Choosing the Probability Threshold: The confidence level determines how conservative the risk measure should be. Common choices include 95%, 99%, and occasionally 97.5%.

• A 95% confidence level corresponds to the 5th percentile of the loss distribution (or equivalently, the 95th percentile of the return distribution, since losses are negative returns).

  For normally distributed returns, 95% VaR corresponds to 1.65 standard deviations below the mean.

• A 99% confidence level corresponds to the 1st percentile of the loss distribution. A 99% confidence level implies that the model estimates losses under normal market conditions, where the losses will not exceed the VaR amount 99% of the time. It also implies a 1% chance of losses exceeding VaR, often referred to as tail risk; this tail risk falls outside the scope of traditional VaR and must be addressed using Expected Shortfall (ES) or stress testing.

  For normally distributed returns, 99% VaR corresponds to 2.33 standard deviations below the mean.

The choice of confidence level involves fundamental tradeoffs. Higher confidence levels (99% versus 95%) provide more conservative risk measures that account for worse potential outcomes. They correspond to rarer but more severe scenarios. However, higher confidence levels also mean fewer data points in the tail of the distribution, making estimation less reliable and more sensitive to modeling assumptions. They may also produce VaR numbers so large that they're not useful for day-to-day risk management.

In practice, trading operations typically use 95% or 99% confidence levels for daily risk monitoring, balancing conservatism with statistical reliability. Regulatory capital calculations often mandate 99% confidence to ensure institutions hold adequate buffers against severe losses. Some risk-averse institutions use even higher confidence levels (99.5% or 99.9%) for particularly critical portfolios.

The relationship between different confidence levels follows from the underlying distribution of returns.

• Time Horizon: The Period of Risk Measurement: The time horizon defines the period over which potential losses are measured. Common choices include:

  
  

  • 1-day VaR is standard for trading operations and daily risk monitoring. It answers the question "How much could we lose by tomorrow?" This short horizon is appropriate for liquid portfolios where positions can be adjusted daily and for monitoring day-to-day trading risk.

  
  

  • 10-day VaR is mandated by banking regulators under the Basel Accords for capital adequacy calculations. This longer horizon reflects regulators' concerns about the time needed to liquidate positions or hedge risks in stressed market conditions. The 10-day period is assumed to represent a minimum time needed to take risk-reducing actions during a crisis.

Longer horizons (monthly, quarterly, or annual) are sometimes used for strategic risk assessment or for less liquid portfolios where positions cannot be quickly adjusted. These longer horizons are particularly relevant for private equity, real estate, or other illiquid investments.

A crucial mathematical property is that VaR does not scale linearly with time. You cannot simply multiply 1-day VaR by 10 to get 10-day VaR, because risk does not accumulate linearly over time. Instead, under assumptions of independent and identically distributed returns, VaR scales with the square root of time:

For example, if 1-day 99% VaR is $5 million, then:

10-day 99% VaR ≈ $5 million x √10 ≈ $15.8 million

1-month (21 trading days) 99% VaR ≈ $5 million x √21 ≈ $22.9 million

This square-root scaling reflects the fact that while the expected magnitude of cumulative moves increases with time, there's also an increased possibility of offsetting moves in different directions. The square root rule applies exactly when returns are independent and identically distributed, assumptions that are often violated in practice but provide a useful approximation.

• Lookback Period: The Historical Window: The lookback period defines how much historical data is used to estimate VaR. Common choices range from 1 year (approximately 250 trading days) to 5 years (approximately 1,250 trading days). This parameter is particularly relevant for Historical Simulation and Parametric VaR methods.

  
  

  The lookback period faces similar tradeoffs to those discussed in the simulation methods chapter:

  
  

  • Longer lookback periods provide more data points, improving statistical reliability and increasing the likelihood of capturing rare events. However, they may include obsolete data from different market regimes that no longer reflect current conditions.

    
    

  • Shorter lookback periods better reflect current market conditions but provide fewer observations and may miss important rare events.

A one-year lookback is most common for VaR calculations, providing a reasonable balance between relevance and sample size. This period typically captures various market conditions (rising and falling markets, high and low volatility periods) while remaining current enough to reflect the present regime. However, this choice means that major crisis events more than one year in the past will not directly influence current VaR estimates; a significant limitation addressed through supplementary measures like Stressed VaR.

VaR is typically expressed in monetary/dollar terms, such as USD, EUR, or GBP, making it a practical measure and highly intuitive for stakeholders, internal risk reporting, and capital adequacy requirements. For example, a VaR of $10 million at 99% confidence over 1 day clearly communicates the maximum expected daily loss in dollar terms.

VaR as a Percentile Measure: Understanding the Distribution

Understanding VaR as a percentile of the loss distribution is crucial for proper interpretation. VaR does not measure expected loss, average loss, or worst-case loss. It measures a specific percentile, the point at which a certain percentage of outcomes are better and the remaining percentage are worse.

Example: A portfolio with the following distribution of potential daily returns:

• Best 20% of days: gains exceeding +$3 million

• Next 60% of days: results between +$3 million and -$2 million

• Next 15% of days: losses between -$2 million and -$8 million

• Worst 5% of days: losses exceeding -$8 million

The 95% VaR for this portfolio is -$8 million; this is the threshold above which the worst 5% of outcomes lie. This threshold tells us nothing about how the best 95% of days are distributed (they could be mostly small gains or include many large gains). It also tells us nothing about how bad the worst 5% of days might be (losses could range from just over -$8 million to catastrophically large amounts).

This percentile interpretation has important implications. VaR is not additive; the VaR of a combined portfolio does not necessarily equal the sum of VaRs of individual components, because percentiles don't add. VaR can sometimes discourage diversification in counterintuitive ways because it focuses on a single point in the distribution rather than the entire distribution. Understanding these properties is essential for using VaR appropriately.

Methodologies for Calculating Value-at-Risk (VaR)

Value-at-Risk (VaR) can be implemented through different methodologies, each offering distinct theoretical assumptions, computational requirements, and modeling precision suited to different types of portfolios. The choice of method depends on the type of portfolio, the availability of data, and the desired level of accuracy.

• Parametric (Variance-Covariance) VaR: Also known as the analytical method or delta-normal method, this approach is based on the assumption that portfolio returns are normally distributed and that risk factors have a linear impact on portfolio value. Under these assumptions, Value-at-Risk can be calculated using a closed-form expression that incorporates the portfolio’s expected return, standard deviation, and a z-score corresponding to the selected confidence level.

• Historical Simulation VaR: Also known as a non-parametric method, this approach uses actual historical returns to estimate future risk, avoiding any assumption about the distribution of returns. It applies past changes in market variables to the current portfolio and derives the distribution of hypothetical portfolio returns. VaR is then determined by identifying the appropriate percentile based on the chosen confidence level.

  
  

  Published: Historical Simulation Value-at-Risk for Equity Portfolios: Theoretical Foundation, Practical Implementation, and Limitations

• Monte Carlo Simulation VaR: This method is the most flexible and sophisticated VaR methodology. It involves generating a large number of potential future scenarios by simulating the behavior of risk factors based on user-defined statistical distributions and correlation structures. Each scenario is applied to the portfolio to estimate potential changes in value, capturing a wide range of outcomes. This approach is particularly well-suited for portfolios with complex or non-linear instruments, such as derivatives, and can model non-normal return distributions, fat tails, and volatility clustering.

In practice, risk managers often combine multiple approaches or use hybrid models to balance computational feasibility with accuracy and robustness.

In the published articles attached above, we explore each methodology in depth, with step-by-step calculation examples, use-case scenarios, and illustrations to help you understand and implement VaR across various portfolio types.

Interpretation of Value-at-Risk (VaR) Number

An asset management firm (“buy-side”) manages a large U.S. equities portfolio on behalf of clients. It approximately invested $500 million in 100 large-cap U.S equities (stocks) diversified across sectors (about 25% in Technology, 15% in Healthcare, 15% in Financials, and the remainder spread across Consumer, Industrials, Energy, including ETFs), and benchmarked the portfolio against the S&P 500.

Being fully invested in equities, the portfolio is subject to the volatility of the equity market. On average, its value might fluctuate by around 1% (approximately $5 million) in either direction (up or down). Because it holds a diversified portfolio of stocks across industries, it’s less volatile than any individual stock (diversification reduces idiosyncratic risk).

The risk manager, responsible for Value-at-Risk (VaR) reporting and ongoing risk monitoring for the firm, wants to quantify “How much could this portfolio's maximum loss be in a day?” while attaching a confidence level to the statement. And for this, they calculate the 1-day 99% Value at Risk (VaR), a standard risk metric for potential loss, of $10 million on a $500 million portfolio.

The 1-day 99% VaR of $10 million was computed using the Historical Simulation / Parametric / Monte Carlo method, based on a rolling 1-year window of daily returns.

This indicates that, based on historical return distribution and under normal market conditions, there is a 99% chance that the portfolio will not incur a loss of more than $10 million in a single trading day. Conversely, there is a 1% chance, or approximately 1 out of every 100 trading days, that the portfolio could incur a loss exceeding $10 million on any given day, due to extreme or adverse market movements not captured in the historical return data.

The risk manager uses the $10m VaR for risk appetite and risk communication, as it provides a common risk language to discuss with portfolio managers and stakeholders. With that, management can understand that “with 99% confidence, our worst daily loss should be around $10 million.” This helps in setting expectations and comparing risk across portfolios. If the firm’s daily risk tolerance is $8 million, then a $10 million VaR may trigger a review of position sizing or hedging strategies to bring risk in line with governance thresholds.

Note: The VaR figure does not predict the actual loss, nor does it describe losses beyond the 99% threshold. It’s also important to understand that VaR is forward-looking, based on the past behavior of market variables. This highlights its dual nature as both a predictive and statistical tool, useful but inherently uncertain.

Risk Monitoring and Breach Analysis

VaR is not just calculated once; it must be monitored continuously and compared to actual outcomes. This process, called backtesting, provides crucial validation of the VaR model.

Daily Monitoring Process: Each trading day, the risk team:

Expected Breach Frequency: For 99% VaR, we expect breaches on approximately 1% of days, roughly 2.5 times per year (given ~250 trading days per year). The actual breach frequency provides important information:

• Fewer Breaches Than Expected: If VaR is breached less than 1% of the time (say, only once in two years), the VaR model may be too conservative, overstating risk. This could lead to unnecessarily defensive positioning, unnecessary hedges, and missed opportunities.

• More Breaches Than Expected: If VaR is breached more than 1% of the time (say, five times per year), the model is underestimating risk. This is the more dangerous situation, as it creates false confidence, a false sense of safety. The model parameters or methodology may need revision.

• Breach clustering: Even if the overall breach frequency is correct, clustering of breaches (multiple breaches in a short period) suggests the model isn't capturing volatility clustering or regime changes properly.

Breach Analysis Example:

On October 15, 2024, the portfolio experiences a loss of $12.3 million, breaching the $10 million VaR threshold. The risk team conducts immediate analysis:

1. Markets: The S&P 500 fell 2.8% on unexpected inflation data. This represents a roughly 2-standard-deviation market move, rare but not unprecedented.

2. Portfolio-Specific Factors: The portfolio's technology overweight (25% versus 20% in the index) amplified losses, as tech stocks fell 4.1%. The portfolio declined 2.46% versus 2.80% for the index.

3. Model Assessment: The breach occurred during unusual market conditions (major economic data surprise) rather than normal market fluctuations. The VaR model is designed to capture risk under normal conditions, so occasional breaches during abnormal conditions are expected.

Action items: No immediate model revision is needed, but the technology overweight is flagged for review. If similar breaches recur, position sizing or diversification may need adjustment.

Risk Limits and Governance

VaR plays a central role in risk governance frameworks, establishing clear boundaries for acceptable risk-taking.

Hierarchy of Risk Limits:

• Firm-wide VaR limit: The board of directors sets a maximum VaR for the entire firm based on capital, risk appetite, and regulatory requirements. For example: "Total firm VaR shall not exceed $100 million at 99% confidence."

• Desk-level VaR limits: Within the firm-wide limit, VaR budgets are allocated to different trading desks or portfolio management teams based on their strategies and expected returns. The equity desk might receive a $30 million VaR budget, the fixed income desk $40 million, etc.

• Individual portfolio VaR limits: Within each desk, individual portfolios receive VaR sub-limits. Our $500 million equity portfolio might have a limit of $8 million (as mentioned earlier).

Escalation procedures:

When VaR approaches or exceeds limits, clear escalation procedures activate:

• Yellow zone (80-100% of limit): Portfolio manager receives automated alert. Risk monitoring frequency increases. Introduction of risk adjustments/hedges. New positions require risk team approval.

• Red zone (exceeding limit): Immediate notification to senior management. The portfolio manager must present a risk reduction plan within 24 hours. No new risk-increasing positions allowed without executive approval.

Consistent Breaches: If VaR remains above limits for multiple days, mandatory position reduction occurs. The portfolio manager must bring VaR back within limits through position sales, hedging, or rebalancing.

Limitations of Value-at-Risk (VaR)

While Value-at-Risk (VaR) remains one of the most widely used risk metrics in financial institutions, particularly within banks, asset managers, and regulators, it has significant limitations. These limitations become especially critical during market stress (stress events or crises), for complex portfolios, or when risk managers rely on VaR without complementing it with other risk measures.

• Dependence on Historical Data and Lookback Periods:

  
  

  • VaR calculations rely heavily on historical market data to estimate future risk. This introduces a key limitation: if the historical dataset does not include periods of extreme volatility or crisis, the VaR measure will likely underestimate potential losses.

    
    

  • The lookback period used (the number of past days or years considered) has a major impact on the accuracy of VaR. A short lookback period may reflect recent calm markets and fail to capture rare but impactful tail events, while an excessively long period may dilute the relevance of recent market conditions. For example, a VaR model using data from 2017 to 2018 (a period of low volatility and steady returns) would completely miss the shock of COVID-19 in early 2020. Risk estimates from such a model would provide a false sense of security, showing artificially low risk just before a major market collapse.

  
  

  Solution: Stressed Value-at-Risk (SVaR) is specifically designed to address the limitation of relying solely on benign historical periods in VaR calculations. It uses historical data from a period of significant financial stress (the 2008 Global Financial Crisis) to model potential losses under extreme but plausible conditions, ensuring that the risk measure captures tail events and periods of market dislocation that standard VaR might ignore.

• VaR Does Not Capture Tail Risk (Fails in Extreme Events): VaR only provides the threshold loss at a given confidence level (95% or 99%), but it does not tell us the potential size of losses beyond this point. For example, a 1-day 99% VaR of $10 million implies that there is a 1% chance of losing more than $10 million. But how much more? $15 million? $100 million?, VaR does not quantify how much worse the losses could be.

  
  

  • In the 2008 Global Financial Crisis, many institutions relied on VaR for risk management and capital allocation. However, most VaR models missed the magnitude of the losses; they captured the “usual bad days” but not the rare catastrophic ones.

    
    

  • VaR at 99% confidence does not account for the 1% worst-case scenarios, which is where catastrophic losses occur.

  
  

  Solution: Expected Shortfall (ES, also known as Conditional VaR) estimates the average loss beyond the VaR threshold (it measures the risk of extreme losses in the tail, especially critical in risk-averse or regulated environments).

• VaR Assumes Normal Distribution (Underestimates Fat-Tailed Risks): Many implementations of VaR (especially the Parametric method) assume that asset returns are normally distributed, which means they fail to capture fat tails (extreme price movements). However, real financial markets often exhibit fat tails (extreme losses occur more often than predicted) and skewness (returns are not symmetrically distributed). For example, stock market crashes exhibit leptokurtosis (fat tails), which means extreme losses occur more frequently than normal distribution predicts. VaR does not adjust for this, and that makes risk estimates unreliable during financial crises.

  
  

  The 2000 Dot-Com Crash, the 2008 Financial Crisis both saw extreme losses far beyond what normal distribution-based VaR predicted. Under a normal distribution, such losses were supposed to occur once in a million years, yet they happened within a single decade, exposing the flaws in the assumption.

  
  

  Models that incorporate fat-tailed distributions (t-distribution or EVT) or use non-parametric methods like historical simulation or Monte Carlo can mitigate this, but Expected Shortfall (ES) remains a better alternative, especially when used with fat-tail modeling.

• VaR Is Not Subadditive: A risk measure should satisfy subadditivity, which means that the risk of a diversified portfolio should not exceed the sum of the individual risks. VaR violates this in some scenarios: When two uncorrelated portfolios are combined, the total VaR can be higher than the sum of the individual VaRs (non-linear portfolios). This also occurs because VaR does not always reward diversification, especially when returns are non-normal or non-linear.

  
  

  Portfolio A and Portfolio B may each have a VaR of $10 million. When combined, the VaR of the aggregate portfolio could be $22 million, instead of being less than or equal to $20 million, which is counterintuitive and misleading, violating subadditivity, making VaR unreliable for portfolio risk aggregation and capital allocation for institutions that manage diversified portfolios.

  
  

  Solution: Expected Shortfall (ES) satisfies subadditivity, meaning it accounts for diversification benefits and provides a more accurate measure of total risk, making it a more coherent risk measure for portfolio risk aggregation.

• VaR Is Highly Model-Dependent (Sensitive to Methodology): VaR is not a single model but a framework that can be implemented using different methodologies. Different VaR calculation methods (Historical, Parametric, Monte Carlo) introduce different assumptions and produce different results, making VaR highly dependent on the chosen model. Different banks report different VaR values for the same portfolio due to different modeling assumptions.

  
  

  • A trading desk at Bank A may use Parametric VaR, assuming normality, which may understate risk in non-normal markets.

    
    

  • Bank B may use Historical VaR, reflecting recent market history, and fail to predict future crises that haven’t happened before.

    
    

  • Bank C may implement Monte Carlo VaR, generating thousands of random return paths—more flexible but computationally expensive.

  
  

  Despite managing similar portfolios, their reported VaR numbers may differ, making risk non-comparable across institutions.

  
  

  Solution: Expected Shortfall (ES) still depends on methodology (a model-dependent measure), but it consistently captures extreme risks better than VaR, regardless of the method used.

• When determining portfolio risk, a reliable risk measure is expected to incorporate correlations between each pair of assets. However, as the number of assets increases and the portfolio becomes more diverse across asset classes, sectors, and geographies, it becomes extremely challenging to estimate and maintain accurate correlations. Correlation matrices become unstable and noisy, especially when using limited historical data, leading to inaccurate aggregation of portfolio risk and ineffective diversification.

  
  

  In large institutional portfolios with hundreds or thousands of positions, even small errors in estimating pairwise correlations can distort the overall risk profile, causing underestimation or overestimation of VaR and, consequently, under-allocation of capital against high-risk exposures.

While Value-at-Risk provides a simple and interpretable measure of risk, its limitations—particularly in terms of tail risk, distributional assumptions, aggregation inconsistencies, and data/model sensitivity—highlight the need to supplement VaR with more robust measures. Expected Shortfall (ES), stress testing, scenario analysis, and model risk awareness are all essential tools to ensure more resilient and accurate risk management frameworks.