VaR Backtesting Report Template (Kupiec, PLA Test)

VaR Backtesting Report: [Model name], [period end YYYY-MM-DD]

A periodic report that compares the bank's daily value at risk (VaR) with the profit and loss that followed, counts and explains the exceptions on both hypothetical and actual P&L, places the result in the supervisory zone, runs statistical tests (Kupiec proportion of failures and Christoffersen independence), shows the capital consequence, and, ahead of the revised market risk framework (FRTB), reports desk-level backtesting and the P&L attribution test in parallel. It follows Regulation (EU) No 575/2013 (CRR) Article 366 for the current internal model approach and refers to the Basel Framework MAR32 (Internal models approach: backtesting and P&L attribution test requirements), cited by chapter ID and name only. Replace every [bracketed] value and every row marked Example. The worked example is the trading book of the fictional Fernhollow Bank (EUR, 250 business days to 2026-09-30). This is a document format, not financial, regulatory, legal or accounting advice. Obtain the regulation or standard for the normative text.

Document control

Approvals

Revision history

Contents

• 1. Executive summary
• 2. Scope, model and observation window
• 3. P&L definitions and data quality
• 4. Exception count and supervisory zone
• 5. Exception list and root-cause analysis
• 6. Statistical tests
• 7. Capital consequence
• 8. Desk-level backtesting and P&L attribution test
• 9. Expected shortfall and tail monitoring
• 10. Conclusions, model actions and findings
• 11. Distribution and supervisory communication
• 12. Glossary and references
• Standard and licence note

1. Executive summary

Example: Over the 250 business days to 2026-09-30, Fernhollow Bank's trading book VaR model recorded six exceptions on hypothetical P&L and five on actual P&L, against an expectation of 2.5 for a 99% measure. The model stayed in the amber zone with a sixth exception, and the multiplication factor for the next quarter rises from 3.40 to 3.50. The statistical tests do not reject the model at the 5% level, but the conditional coverage test is very close to its critical value and two exceptions occurred on consecutive days. Root-cause analysis attributes three exceptions to known model limitations (covered bond spread proxy, FX option volatility skew on hypothetical P&L only, and slow reaction of the equally weighted window) and three to large market moves that the model treated as rare but possible. The Head of Market Risk recommends two model changes and a tighter compensating limit until they are in production.

2. Scope, model and observation window

Backtesting compares the one-day VaR produced at the end of day t with the P&L for day t+1 on the same portfolio. The report covers the regulatory VaR used for own funds, and, where different, the management VaR used for limits. Both are listed here so that a reader can see whether conclusions apply to both.

If the model changed inside the window, report the date and the nature of the change, and show whether the exceptions occurred before or after it. A change that was approved because of exceptions does not erase them; they stay in the count until they roll out of the window.

3. P&L definitions and data quality

Hypothetical P&L is the change in value of the end-of-day portfolio at day t, held constant, revalued with the market data of day t+1. It tests the model directly: if the positions did not change, did the loss exceed what the model predicted? It excludes new trades, intraday trading, fees and commissions, and changes in valuation reserves.

Actual P&L is the real change in the portfolio value between the end of day t and the end of day t+1, as recorded by Product Control, excluding fees, commissions and net interest income where the regulation requires their exclusion. It includes intraday trading and new deals. It tests whether the VaR is a sensible measure of the risk the bank actually ran, including the effect of trading activity.

Under Article 366 the bank counts overshootings on both hypothetical and actual changes in the portfolio value, and uses the higher of the two counts to set the addend. Check the consolidated text of Article 366 for the exact exclusions and for any permission under which the competent authority may disregard specific overshootings.

Data quality controls run before the count is final. Any day with a stale market data series, a late trade booking or a revaluation error is investigated. Where the official P&L is restated, the backtest uses the restated figure and the change is logged with its approval. A day is never dropped from the window: if VaR or P&L is missing, the analyst rebuilds it from archived inputs and records the method.

4. Exception count and supervisory zone

An exception (an overshooting in CRR terms) is a day on which the loss exceeds the VaR for that day. For a 99% one-day VaR over 250 business days the expected number of exceptions is $250 \times 0.01 = 2.5$. A count far above that suggests the model understates risk; a count of zero over a long period may suggest it overstates risk, which is a capital and limit-efficiency question rather than a safety one.

The supervisory framework sorts results into three zones (the pre-FRTB Basel traffic light calls the middle zone yellow, MAR32 for the revised framework uses amber, and the EU Article 366 table works on counts only; this report uses amber). In original terms: the green zone means the count is consistent with an accurate model and needs no supervisory action; the amber zone means the evidence is inconclusive, so the bank must explain the exceptions and supervisors may increase the capital multiplier; the red zone means the count is very unlikely from an accurate model, which leads to the highest multiplier and an expectation that the bank fixes the model. The boundaries between zones and the matching capital consequence are set in MAR32 and, for the EU, in the table in Article 366. Look them up for the window length used and record the zone; do not restate the tables in the report.

The trend matters as much as the level. Fernhollow Bank's count rose by one in each of the last three quarters, driven mainly by events in the second half of the window, which means it will not fall quickly as older exceptions roll off.

5. Exception list and root-cause analysis

Classify each exception into one of four causes:

• Model limitation: a risk factor missing, proxied or mis-specified; the model would have produced a higher VaR with better specification.
• Market move beyond the model's history: the position was correctly captured but the move was larger than anything in the data window. These are the exceptions the 1% tail is expected to produce.
• Trading activity: the loss came from intraday trading or new positions not in the end-of-day portfolio (actual P&L only).
• Data or process error: wrong position, market data or P&L. Correct the input, rerun, and document whether the exception remains.

The magnitude ratio (loss divided by VaR) helps prioritise. Repeated exceptions with ratios well above one point to a tail that the model underestimates in size, not only in frequency.

Five exceptions occurred on both P&L measures (BT-EXC-01, 02, 04, 05, 06), and one on hypothetical P&L only (BT-EXC-03), giving six hypothetical and five actual exceptions. Three are classed as model limitations, which is the group the model actions in section 10 address. The two equity exceptions on consecutive days (BT-EXC-04 and 05) are the clustering that the independence test in section 6 looks at.

6. Statistical tests

6.1 Kupiec proportion of failures test

The proportion of failures (POF) test asks whether the observed exception rate $x/T$ is consistent with the expected rate $p$. With $T$ observations, $x$ exceptions and $p = 1 - \alpha$, the likelihood ratio is:

Under the null hypothesis that the model is correctly calibrated, $LR_{POF}$ follows a chi-squared distribution with one degree of freedom. At a 5% significance level the critical value is 3.841.

Example: with $T = 250$, $x = 6$ and $p = 0.01$, the observed rate is $6/250 = 0.024$.

• First term: $244 \ln(0.99) + 6 \ln(0.01) = -2.4523 - 27.6310 = -30.0833$.
• Second term: $244 \ln(0.976) + 6 \ln(0.024) = -5.9274 - 22.3782 = -28.3056$.
• $LR_{POF} = -2 \times (-30.0833 + 28.3056) = 3.555$.

Because 3.555 is below 3.841, the test does not reject the model at the 5% level; the p-value is about 0.059. With the actual P&L count of five, $LR_{POF} = 1.957$ (p-value about 0.162).

A complementary view is the binomial tail probability. If the model were exactly right, the probability of six or more exceptions in 250 days would be $P(X \ge 6) = 1 - P(X \le 5) = 1 - 0.9588 = 0.0412$, about 4.1%. That is unusual but not conclusive, which is consistent with the amber result.

The POF test has low power at this sample size: a model whose true exception rate is 2% instead of 1% would pass it most of the time. Read a "do not reject" as "no strong evidence against the model", never as confirmation.

6.2 Christoffersen independence and conditional coverage tests

A model can have the right number of exceptions and still be poor if they cluster, because clusters mean the model fails to react to changing volatility. Christoffersen's test compares the probability of an exception after a day without one ($\pi_{01}$) with the probability after a day with one ($\pi_{11}$). With $n_{ij}$ the number of days in state $j$ that follow a day in state $i$ (0 = no exception, 1 = exception):

where $\pi_{01} = n_{01}/(n_{00}+n_{01})$, $\pi_{11} = n_{11}/(n_{10}+n_{11})$ and $\pi = (n_{01}+n_{11})/(n_{00}+n_{01}+n_{10}+n_{11})$. $LR_{ind}$ follows a chi-squared distribution with one degree of freedom. The conditional coverage test combines both, $LR_{CC} = LR_{POF} + LR_{ind}$, with two degrees of freedom (critical value 5.991 at 5%).

Example: the 250 hypothetical P&L days give 249 transitions. The six exceptions form five separate runs, one of two consecutive days, so $n_{01} = 5$, $n_{11} = 1$, $n_{10} = 5$ and $n_{00} = 249 - 5 - 1 - 5 = 238$. Then $\pi_{01} = 5/243 = 0.0206$, $\pi_{11} = 1/6 = 0.1667$ and $\pi = 6/249 = 0.0241$. The log-likelihood under independence is $-28.2813$, under the alternative $-27.0697$, so $LR_{ind} = 2.423$ (p-value about 0.120). The conditional coverage statistic is $3.555 + 2.423 = 5.979$, just below 5.991 (p-value about 0.050).

Other tests may be added where the bank has the data, such as a test across several confidence levels (to check the whole distribution rather than one quantile) or a duration-based independence test. Record any added test, its specification and its result in the same table.

7. Capital consequence

Under CRR Article 364(1), the VaR component of the own funds requirement is the higher of the previous day's VaR and the multiplication factor times the average daily VaR over the preceding 60 business days; the stressed VaR component follows the same rule with its own factor. Under Article 366, each of the multiplication factors applied to VaR and stressed VaR is at least 3 plus an addend between 0 and 1 that depends on the number of overshootings over the most recent 250 business days. Look up the addend in Table 1 of Article 366 for the count recorded in section 4 and apply it from the date set by the bank's process and the competent authority.

Example: the count of six gives an addend of 0.50 under Table 1 of Article 366, so the multiplication factor rises from 3.40 (five overshootings in the previous quarter) to 3.50. If the multiplication factor times the 60-business-day average VaR (ten-day equivalent, EUR 8.20 million) exceeds the previous day's VaR, the VaR component rises from 3.40 x 8.20 = EUR 27.88 million to 3.50 x 8.20 = EUR 28.70 million, an increase of EUR 0.82 million. The same factor change applies to the stressed VaR component: on a 60-day average ten-day stressed VaR of EUR 13.80 million it rises from 3.40 x 13.80 = EUR 46.92 million to 3.50 x 13.80 = EUR 48.30 million, an increase of EUR 1.38 million. Together the IMA requirement rises from EUR 74.80 million to EUR 77.00 million (plus EUR 2.20 million, or EUR 27.5 million of RWEA at 12.5 times). With standardised specific risk of EUR 3.00 million, the market risk own funds requirement is EUR 80.00 million, which the ICAAP Report shows as market risk RWEA of EUR 1,000 million. Confirm the calculation with Finance before the next own funds return.

8. Desk-level backtesting and P&L attribution test

Under the revised market risk framework, eligibility for the internal model is decided per trading desk. Each desk must pass backtesting at desk level (at the 97.5th and 99th percentiles) and the P&L attribution (PLA) test, which compares the risk-theoretical P&L (RTPL) produced by the risk model with the hypothetical P&L (HPL) produced by the front-office pricing systems. MAR32 sets the PLA metrics (the Spearman correlation and the Kolmogorov-Smirnov test statistic) and the zone thresholds; in the EU the corresponding requirements are in Articles 325bf and 325bg of the CRR. The revised framework does not yet apply in the EU (see the Market Risk Limit Framework (finance/market-risk-limit-framework), section 12), so these results are reported for preparation only and have no capital effect.

Look up the zone thresholds in MAR32 and the CRR and record the zone for each desk. For a desk in a weaker zone, analyse where RTPL and HPL differ: risk factors present in pricing but absent from the risk model, different data sources or time stamps, and different interpolation or volatility surfaces are the usual causes.

The desk results point to the same weaknesses as the aggregate root-cause analysis, which raises confidence that fixing them will improve both the current model and the bank's readiness for the revised framework.

9. Expected shortfall and tail monitoring

Expected shortfall cannot be backtested by counting exceptions, because it is an average of tail losses, not a quantile. As a monitoring step the bank compares, on each day when the loss exceeded the 97.5% VaR, the actual loss with the model's 97.5% ES for that day. If the average ratio of loss to ES over these days is well above one, the model's tail is too thin.

Define the method used, the window and the decision rule in this section, and keep it unchanged between periods so trends can be read. Under the revised framework, regulatory backtesting remains on VaR at desk level while capital is based on ES; the monitoring described here is an internal practice.

10. Conclusions, model actions and findings

State one conclusion: fit for purpose, fit for purpose with actions, or not fit for purpose. Base it on the count, the zone, the tests, the root causes and the trend, not on any single number. If the conclusion is "not fit", escalate under the Model Risk Management Policy (finance/model-risk-management-policy) and consider a capital add-on or limit reduction until the model is fixed.

Example: the model is fit for purpose with actions. The count is in the amber zone, the tests do not reject it at 5% but the conditional coverage result is borderline, and three of six exceptions trace to three known limitations (spread proxy, volatility skew, equal weighting), addressed by ACT-BT-01 to ACT-BT-03. Until the changes below are in production, Market Risk keeps the reduced single-issuer limit MRL-032 (see the limit framework) and adds a monitoring trigger on FB-EQD vega.

Independent review comments from Model Risk Management are recorded here verbatim or by reference, with the response from Market Risk.

11. Distribution and supervisory communication

Distribute the approved report to the Market Risk Committee, the CRO, Model Risk Management, Finance (own funds reporting) and Internal Audit. Notify the competent authority of each overshooting promptly and no later than five working days after it occurs, as required by CRR Article 366 (check the consolidated text); do not wait for the root-cause analysis, which can follow. Record the date and reference of each notification. Example: Fernhollow Bank is a significant institution, so the notifications go to the ECB Joint Supervisory Team; BT-EXC-06 (P&L day 2026-09-08) was notified on 2026-09-10. Exceptions that the bank asks the supervisor to disregard must be documented with the evidence and the supervisor's response.

12. Glossary and references

Glossary

References

• Regulation (EU) No 575/2013 (CRR), Article 365 (VaR and stressed VaR calculation) and Article 366 (regulatory back testing and multiplication factors); Articles 325bf and 325bg (back-testing and profit and loss attribution under the revised framework); check the consolidated text on EUR-Lex.
• Commission Delegated Regulation (EU) 2025/1496 on the date of application of the own funds requirements for market risk.
• Basel Committee on Banking Supervision, Basel Framework: MAR32 (Internal models approach: backtesting and P&L attribution test requirements), MAR33 (Internal models approach: capital requirements calculation), MAR99 (Guidance on use of the internal models approach); chapter IDs and names only.
• Kupiec, P. (1995), techniques for verifying the accuracy of risk measurement models, Journal of Derivatives.
• Christoffersen, P. (1998), evaluating interval forecasts, International Economic Review.
• Related templates: Market Risk Limit Framework (finance/market-risk-limit-framework), Model Risk Management Policy (finance/model-risk-management-policy), Model Validation Report (ai-data/model-validation-report), Model Development Document (finance/model-development-document), Stress Testing Programme (finance/stress-testing-programme).

Standard and licence note

Based on Regulation (EU) No 575/2013 as amended, in particular Article 366. Structure aligned with the Basel Framework chapter MAR32, cited by chapter ID and name only; the supervisory zone table, the plus-factor table and the PLA thresholds are referenced, not reproduced, and the Basel Committee does not endorse this template. The Kupiec and Christoffersen tests are standard statistical methods, cited to their academic authors and expressed in original notation and wording. The report structure, classification of causes, worked example and all text are original. Check the current official version of the regulation, the delegated acts and the Basel Framework before use. Fernhollow Bank and every figure are fictional. Template licence: MIT.