Value at Risk (VaR) explained

VaR compresses the whole distribution of possible outcomes into a single, comparable number, which is why risk managers, regulators, and boards all use it. It reads off the left tail of the P&L distribution, the region of unusually bad days.

In words: VaR is the smallest loss level such that the probability of losing more than it is at most 1 minus the confidence. At 95% confidence, that is the loss exceeded on only 5% of days.

Suppose a desk’s daily P&L, gathered over the last 500 trading days, ranges from large gains to large losses. Sort those 500 outcomes from worst to best. The 95% one-day VaR is, roughly, the loss at the 25th worst day (5% of 500), because 5% of days were worse than it. That is the entire idea of historical VaR: let the past distribution speak, and read the quantile directly.

There is no single correct method; each trades off intuition, speed, and fidelity differently.

• Historical simulation, re-price the current portfolio using actual historical market moves and read the loss at the chosen percentile. Intuitive and assumption-light, but limited by the history you have.
• Parametric (variance-covariance), assume returns are normally distributed and compute VaR from volatilities and correlations. Fast, but the normality assumption understates tail risk.
• Monte Carlo simulation, generate many random market scenarios, re-price under each, and read the percentile. The most flexible, and the most computationally demanding.

Here is historical VaR in a few lines of Python, computed by full revaluation across historical scenarios and reading the quantile, with Expected Shortfall as the mean of the tail beyond it:

pythonimport numpy as np

def historical_var_es(scenario_pnl, alpha=0.95):
    """scenario_pnl: array of P&L outcomes, one per historical scenario."""
    losses = -np.asarray(scenario_pnl)      # losses are negative P&L
    var = np.quantile(losses, alpha)        # the VaR quantile
    tail = losses[losses >= var]            # everything beyond VaR
    es = tail.mean() if len(tail) else var  # Expected Shortfall
    return var, es

The Risk module supports these approaches against live positions rather than end-of-day snapshots.

When returns are assumed normal, VaR has a closed form: it is the portfolio’s volatility scaled by the number of standard deviations that corresponds to the confidence level.

Here z is the standard-normal quantile (about 1.65 for 95%, 2.33 for 99%), the portfolio volatility comes from the sensitivity vector w and the covariance matrix of risk factors, and h scales a one-day figure to an h-day horizon. The elegance is also the weakness: real commodity returns have fatter tails than the normal distribution, so this formula understates how often large losses occur.

Two parameters define any VaR number. The confidence level (commonly 95% or 99%) sets how far into the tail you look, 99% VaR is larger than 95% VaR because it captures rarer, worse days. The horizon (one day, ten days) sets the period over which loss is measured. Always quote both: "$1m" is meaningless without "one-day, 95%".

VaR is powerful but has well-known blind spots, and treating it as the whole picture is a classic mistake:

• It says nothing about how bad the bad days are beyond the cutoff. A 95% VaR is silent on the worst 5%. Expected Shortfall (the average loss in the tail) addresses this.
• It assumes normal conditions. In a crisis, correlations converge and losses exceed VaR far more often than the confidence level implies.
• It is backward-looking when built from history that did not contain the shock you now face.
• It is not sub-additive in general, meaning the VaR of a combined book can exceed the sum of its parts, which perversely penalises diversification.

Because Expected Shortfall averages the tail rather than reading a single point on its edge, it describes severity, not just frequency, and it is coherent (in particular, sub-additive). This is why regulators have increasingly favoured it. A mature desk computes both, and pairs them with scenario and stress testing, deliberately asking what happens under specific severe moves.

VaR tells you the edge of a normal bad day. Expected Shortfall tells you how bad it gets beyond that edge, and stress testing tells you what specific event would take you there. A risk function needs all three.

Every VaR number is computed on a set of positions against a set of market data. If those positions are last night’s, taken from an overnight extract, then the VaR describes last night’s risk, not the risk the desk actually carries now. In a fast-moving market that gap is largest exactly when it matters most. This is why a modern platform computes risk on the same live positions and governed market data as valuation, so the VaR on the screen is the risk in the book, and so risk ties out to P&L rather than drifting from it.