VaR & expected shortfall

Everything so far has been descriptive. This lesson turns it into the number a risk committee actually looks at — and shows how each way of computing it fails.

The two measures

   VaR_α    the loss that will not be exceeded with probability α
            "we are 99% confident we won't lose more than X today"

   ES_α     the AVERAGE loss, given that VaR_α was breached
   (a.k.a.  "when it does go wrong, how bad is it on average?"
   CVaR,
   tail loss)

The distinction is the whole lesson in one line: VaR marks the door; ES tells you what is behind it.

      probability
          │
          │   ████████
          │  ██████████
          │ ████████████
          │██████████████▓▒░
          └──────────────┬────────────────▶  loss
                       VaR_99
                         ├──── ES = average of EVERYTHING out here ───▶
                         │
                    VaR says nothing whatsoever about this region

The same book, four ways

A £1,000,000 position in the S&P 500, 1-day horizon, 99% confidence, computed from the same 2,513 real daily returns as M3.1:

   method                          number      what it assumes
   ────────────────────────────────────────────────────────────────
   Gaussian (parametric) VaR      £26,563      returns are normal
   Historical VaR                 £33,416      the past resembles
                                                the future
   Historical Expected Shortfall  £49,557      —
   ────────────────────────────────────────────────────────────────
   worst day that actually
   happened (2020-03-16)         £127,652

Read those four numbers in order, because each gap is a distinct failure.

Gaussian → historical: +26%. Assuming normality understates the 99% loss by a quarter, for exactly the reason M3.1 and M3.2 gave. A fitted normal is calibrated on the middle of the distribution, where most of the data is, and the middle knows nothing about the tail.

Historical VaR → ES: +48%. Even having got the quantile right, the average breach is half as large again. VaR is a threshold, and the losses beyond it are not clustered just past it.

ES → worst day: +158%. And the worst single day was 4.8× the Gaussian VaR. No quantile measure was ever going to tell you about that day; that is a statement about the tail index (M3.2), not about the confidence level.

Backtesting it, which is the honest test

A 99% VaR should be breached about 1% of the time. Count:

   Gaussian 99% VaR breaches:   49 observed   vs   25 expected

                                ≈ 2× too many

Twice the intended breach rate, from a model that a risk report would describe as "99% confidence." Note this is the in-sample failure — the Gaussian was fitted to the very data it then failed on. It is not that the future was surprising; it is that the model could not describe the past.

VaR's structural problem

Everything above is a distributional complaint, fixable by using better distributions. VaR has a worse and more fundamental defect.

A risk measure ought to be coherent, which is four properties, of which the interesting one is:

   SUBADDITIVITY:    risk(A + B)  ≤  risk(A) + risk(B)

   i.e. combining two portfolios cannot create risk.
        DIVERSIFICATION SHOULD NEVER LOOK BAD.

VaR is not subadditive. You can construct — and people have found in the wild — portfolios where the VaR of the combination exceeds the sum of the individual VaRs. The classic case is two positions each of which loses a large amount with probability just under 1%: individually neither breach shows up at the 99% quantile, so each has low VaR; combined, the probability of some large loss exceeds 1% and the VaR jumps.

Two consequences follow, and the second is the serious one:

• Aggregating desk-level VaR into a firm number is not mathematically sound.
• VaR can be gamed. A trader optimising against a VaR limit is incentivised to move risk just beyond the quantile — selling far out-of-the-money options is the canonical example. It reports beautifully, earns steady premium, and is exactly the short-gamma payoff M2.3 warned about. VaR does not see it, because the losses live in the region VaR is blind to.

Expected shortfall is coherent, subadditive included, and it cannot be gamed the same way because it averages over the whole tail — pushing losses further out makes ES worse, not better. This is why the Basel Committee's FRTB moved market-risk capital from 99% VaR to 97.5% expected shortfall. That reform is the regulatory system conceding the argument.

Three ways to compute either, each broken differently

   PARAMETRIC       assume a distribution, use its quantile.
   (variance-       fast, smooth, and wrong in the tail unless
    covariance)     you use something fat-tailed (M3.2)

   HISTORICAL       use the empirical quantile of past returns.
                    no distributional assumption — but your 99%
                    estimate rests on ~25 observations, and it
                    cannot produce a loss larger than the worst
                    one already seen

   MONTE CARLO      simulate from a model. flexible, handles
                    options and path dependence — and inherits
                    every flaw of the model you simulated from.
                    Gaussian innovations give Gaussian answers
                    with a computational veneer

Historical VaR's limitation deserves emphasis because it is so easily missed: it can never tell you about a loss bigger than the largest in your sample. On 2020-03-15, a historical VaR model had never seen 2020-03-16. If you need the 1-in-1000 day, EVT (M3.2) is the tool, because it extrapolates the tail's shape instead of reading off an order statistic you don't have.

Using them without being fooled

   ✓ Quote ES, not VaR — or at minimum, always quote both.
   ✓ Backtest the breach count. A 99% measure breached 2% of the
     time is not a risk number, it is a decoration.
   ✓ Stress test separately. Risk measures are estimated from a
     sample; scenarios are not, so they can ask about things that
     have never happened.
   ✓ Remember volatility clusters (M3.3). A one-day VaR on a
     turbulent day should be far larger than on a calm one — a
     static estimate is wrong on both.
   ✓ Never confuse "we are 99% confident" with "we are safe." One
     percent of trading days is two and a half days a year.

That last point is the cultural one. VaR's greatest damage has probably not been mathematical but rhetorical: it produces a single, confident-sounding number that gets repeated by people who do not know what it excludes. It is a summary of the losses you expect to survive — and it is silent, by construction, about the ones you might not.

Source: McNeil, Frey & Embrechts, Quantitative Risk Management, ch.2 and 8 — the coherence axioms are Artzner et al. (1999) and worth reading in the original for how clean the argument is. The Basel FRTB documents are dry but show the ES transition being argued in public.