Value at Risk and Expected Shortfall Concept Card Template

Value at Risk and Expected Shortfall Concept Card: [Course, portfolio or risk report]

A concept card for value at risk (VaR) and expected shortfall (ES) as they are taught in an MBA derivatives and risk management elective: parametric (variance-covariance) VaR, historical simulation and Monte Carlo, scaling over time, portfolio, marginal and component VaR, expected shortfall and why regulators moved to it (Artzner et al. 1999; Acerbi and Tasche 2002), volatility updating with an exponentially weighted moving average (EWMA), stress testing, and backtesting with the Kupiec (1995) test and the Basel traffic light. It builds on two core cards and links to them instead of re-teaching them: mba/mba-capm-wacc-card (portfolio variance, correlation, beta) and academic/stats-distributions-sheet (the normal distribution and quantiles). It is for second-year MBA students, candidates for risk, asset management, treasury and trading roles, and managers who read a risk report. Worked example A is fully solved with Excel formulas, B is half solved and Exercise C is left to you; self-test answers sit in a separate key. Source basis: the original works cited in each section, the Basel Committee's market risk standard (MAR) and national regulators' pages as checked in October 2026, and standard textbooks named as further reading; all wording, notation and examples are original. Northfield Outdoor Co. is fictional, and every position, volatility and profit or loss is an Example. Replace every [bracketed] value and every row marked Example. This is a learning aid, not investment, regulatory or legal advice.

Document control

Contents

1. When to use it
2. The idea in plain language
3. Formulas and notation
4. Three ways to compute VaR
5. Assumptions and limits
6. Regulation: from VaR to expected shortfall (dated facts)
7. How managers use it in practice
8. Worked example A (fully solved)
9. Worked example B (half solved)
10. Exercise C (unsolved)
11. Connections to other cards
12. Common mistakes and misconceptions
13. Self-test questions
14. My notes and next steps

When to use it

One-sentence rule: use VaR or ES when you need one comparable number for the downside of a portfolio of market-priced positions over a short horizon, and pair it with stress tests whenever the question is about rare, large or new events that the data window has not seen.

The idea in plain language

Value at risk answers: "over the next [horizon], there is only a [1 minus confidence] chance that we lose more than [amount]". A one-day 99% VaR of USD 0.82m means that on about 1 trading day in 100 the loss should be larger than USD 0.82m, if the model is right. VaR is a quantile of the loss distribution. J.P. Morgan's RiskMetrics technical document (1994, with later editions) made the approach standard practice, and the Basel Committee's 1996 market risk amendment put it into bank capital rules.

VaR says nothing about how large the loss is on those bad days. Two portfolios can have the same VaR while one loses a little more than VaR in the tail and the other loses ten times more. VaR also fails a property that a sensible risk measure should have: combining two portfolios can produce a VaR larger than the sum of their VaRs, which penalises diversification (Artzner, Delbaen, Eber and Heath 1999 set out the four "coherence" properties and showed VaR can break subadditivity).

Expected shortfall answers: "when the loss is beyond the [confidence] quantile, how large is it on average?" It is always at least as large as VaR at the same confidence level, it looks into the tail, and it is coherent (Acerbi and Tasche 2002; Rockafellar and Uryasev 2000 showed how to optimise it). Its weakness is that it needs more data in the tail to estimate and is harder to backtest by simply counting exceptions.

Both measures are only as good as the distribution behind them. Markets have fat tails (large moves are more frequent than the normal distribution says) and volatility clustering (calm and turbulent periods follow each other; Engle 1982; Bollerslev 1986). A VaR model fitted to a calm period understates risk at the moment it matters, which is why risk managers update volatility quickly (EWMA), keep stressed windows, and always add stress tests.

Formulas and notation

Parametric (normal) VaR and ES of a position with value $V$ and return volatility $\sigma$ over one day, assuming a zero mean return (usual for short horizons):

Portfolio VaR with dollar volatilities $s_i = \sigma_i V_i$ and correlations $\rho_{ij}$:

Square-root-of-time scaling (independent, identically distributed returns): $\text{VaR}_{h} = \text{VaR}_{1}\sqrt{h}$.

Component and marginal VaR (Euler allocation; the components add up to the portfolio VaR):

EWMA volatility update (RiskMetrics; decay factor $\lambda$, often 0.94 for daily data):

Kupiec (1995) proportion-of-failures test for $x$ exceptions in $n$ days at expected rate $p = 1 - \alpha$, with $\hat{\pi} = x/n$:

Three ways to compute VaR

Assumptions and limits

• Normality (parametric). Daily returns have fatter tails than the normal; at 99% the normal VaR understates the loss for most assets, as Worked example A2 shows.
• Stable volatility and correlation. Both change, and correlations tend to rise in crises, exactly when diversification is needed. EWMA or GARCH models (Engle 1982; Bollerslev 1986) react faster than equal weights.
• Square-root-of-time scaling assumes independent returns with constant volatility and no change in positions. It is a convention, not a law: autocorrelation, mean reversion or trading during the horizon break it.
• Linear positions (delta-normal). Options have curvature (gamma), so their losses are not proportional to the move in the underlying; use full revaluation (mba/mba-options-real-options-card).
• Liquidity. A one-day VaR assumes you could exit in a day. Large or illiquid positions take longer, which is why the Basel standard scales ES by liquidity horizons of 10 to 120 days.
• The data window. Historical simulation and estimated volatilities only know the past they were given. A risk that never happened in the window (a new product, a currency peg) has zero weight.
• VaR is not the worst case. Losses beyond VaR happen by design (1 day in 100 at 99%), and their size is not bounded by VaR.

Regulation: from VaR to expected shortfall (dated facts)

As of October 2026, checked on official pages (check them before you rely on it):

• Basel standard. The Basel Committee's revised market risk standard (often called the Fundamental Review of the Trading Book, FRTB; "Minimum capital requirements for market risk", January 2019, now chapters MAR of the Basel Framework, bis.org) replaces 99% VaR with expected shortfall at a 97.5th percentile, one-tailed confidence level for the internal models approach, computed daily for the bank and for each trading desk using the model. ES is calculated on a 10-day base horizon and scaled up for less liquid risk factors with liquidity horizons of 10, 20, 40, 60 or 120 days, and it is calibrated to a period of stress. Desk-level backtesting is done at both the 97.5th and 99th percentiles, alongside a profit and loss attribution test (MAR32, MAR33).
• Why 97.5% ES? Under a normal distribution, 97.5% ES (2.3378 standard deviations) is almost the same as 99% VaR (2.3263), so capital levels are comparable; with fat tails, ES rises above VaR and captures the tail the VaR misses.
• Implementation differs by jurisdiction. EU: Commission Delegated Regulation (EU) 2025/1496 (adopted 12 June 2025, published in the Official Journal on 19 September 2025) deferred the application of the FRTB own funds requirements to 1 January 2027, the second one-year deferral; until then banks keep the market risk framework as it stood before the change (note: checked on law-firm summaries and later EU acts, because the EUR-Lex text could not be opened at checking time), and Commission Delegated Regulation (EU) 2026/1221 of 4 June 2026, published 1 September 2026, adds temporary targeted relief measures and multipliers for the market risk calculation (check EUR-Lex and finance.ec.europa.eu for the current position). UK: the PRA's final Basel 3.1 rules (policy statement PS1/26, 20 January 2026) take effect on 1 January 2027, with the FRTB internal models approach from 1 January 2028 (check bankofengland.co.uk). US: on 19 March 2026 the Federal Reserve, FDIC and OCC requested comment on proposals to modernize the capital framework, with a market risk part that would apply only to banks with significant trading activity; comments were due 18 June 2026 and no final rule had been announced as of October 2026 (check federalreserve.gov).
• The pre-FRTB traffic light (Basel Committee, 1996, backtesting framework) still frames most teaching and many current rules: over 250 days at 99%, 0 to 4 exceptions is the green zone, 5 to 9 the yellow (amber) zone with a rising add-on to the capital multiplier, and 10 or more the red zone. Look up the exact add-ons in the rule that applies to you (finance/var-backtesting-report).

How managers use it in practice

• Limits. Desks, funds and treasuries run with VaR or ES limits and stop-loss limits; a limit breach triggers a conversation, not an automatic sale (finance/market-risk-limit-framework). Ask: "what is the limit utilisation, and how has it moved?"
• Allocating risk. Component VaR shows where the risk sits. In A1 the equity position carries 99.5 percent of the VaR although it is 60 percent of the capital. Ask: "which position would I cut first to lower risk most?"
• Capital and performance. Banks hold capital against market risk and compare returns with the risk capital used (risk-adjusted return on capital). Funds report VaR to investors. Ask: "is this return high for the risk taken?" (mba/mba-performance-evaluation-card).
• Corporate use. Non-financial firms use cash-flow-at-risk or the VaR of a hedge's mark to market to plan liquidity for margin calls (mba/mba-forwards-futures-swaps-card, A4). Ask: "how much cash could the hedges demand in a bad month?"
• Stress testing beside VaR. A board risk appetite statement (finance/risk-appetite-statement) uses VaR or ES for normal times and stress losses for crises. Ask: "what scenario would cost us more than one year of profit?"
• Model governance. Backtesting and independent validation keep the model honest. Ask: "how many exceptions in the last 250 days, and what caused them?"

Worked example A (fully solved)

A1. Parametric VaR, ES and component VaR (Example). Northfield Outdoor Co.'s pension fund (fictional) holds an equity portfolio worth USD 30m with a daily volatility of 1.2 percent and a bond portfolio worth USD 20m with a daily volatility of 0.4 percent. The correlation of daily returns is -0.2. Assume zero mean daily returns.

Read the result: on 1 day in 100 the fund should lose more than about USD 0.82m. The bonds add almost nothing to the risk, because their volatility is low and their correlation with equities is negative; their component VaR is close to zero. The 97.5% ES (0.8248) and the 99% VaR (0.8208) are nearly equal, which is the normal-distribution property behind the Basel calibration.

A2. Historical simulation (Example). The risk team revalues the same portfolio under 500 daily scenarios. In this teaching example the 500 profit and loss figures are simulated from a fat-tailed Student t distribution with 4 degrees of freedom, scaled to the same daily standard deviation as A1 (fixed random seed in the calc script; sample standard deviation USD 0.3519m).

With the same standard deviation, the fat-tailed data give a 99% VaR about 27 percent higher than the normal model (1.0406 against 0.8208) and an ES about 28 percent higher. This is the core lesson: a normal model calibrated on volatility alone understates tail risk. Conventions matter too: some systems take the 6th largest loss for 99% VaR on 500 days, or interpolate; state the one you use. The chart shows the distribution of the 500 daily profit and loss figures; the left tail (losses) is longer than a normal curve would show.

A3. Backtesting (Example). Over the last 250 trading days the fund's one-day 99% VaR was exceeded on 7 days.

The test rejects an accurate 1 percent exception rate at the 5 percent level (5.50 > 3.84): the model probably understates risk. Under the 1996 traffic light, 7 exceptions fall in the yellow zone, where supervisors could raise the capital multiplier. The next step is root-cause analysis: were the exceptions clustered in a volatile month (the volatility estimate reacted too slowly, see A4), or spread out (a missing risk factor)? Christoffersen (1998) adds a test for clustering; finance/var-backtesting-report shows the full report.

A4. EWMA volatility update (Example). Yesterday the equity estimate was 1.2 percent a day, and the equity portfolio fell 2.5 percent. With $\lambda$ = 0.94:

One large move raises the VaR by almost 10 percent the next day. An equal-weighted 500-day estimate would barely move, which is why equally weighted models collect exceptions in clusters when markets turn.

Worked example B (half solved)

A treasury holds a single foreign-currency deposit worth USD 15m with a daily volatility of 1.5 percent. Assume zero mean and normal returns.

Exercise C (unsolved)

1. Diversification. Two positions have dollar volatilities of USD 0.20m and USD 0.10m a day. Compute the one-day 99% VaR of the portfolio for correlations of 1.0, 0.5 and -0.5. What is the diversification benefit at each correlation compared with the sum of stand-alone VaRs?
2. Backtest. A model's 99% VaR was exceeded 12 times in 250 days. Compute the Kupiec statistic and its p-value, name the traffic-light zone, and list three possible causes you would investigate.
3. Method choice. A fund holds mainly short-dated equity index options. Which VaR method would you use, and why would the parametric method mislead?

Connections to other cards

Common mistakes and misconceptions

• "VaR is the most we can lose." It is the loss exceeded with a small probability; the tail beyond it can be much larger.
• Adding VaRs across desks. Stand-alone VaRs add up only if correlations are all one; the diversified VaR is lower, and VaR may even fail to be subadditive for non-normal positions.
• Scaling every horizon by the square root of time. It assumes independent returns and unchanged positions; for long horizons, illiquid assets or trending markets it can badly misstate risk.
• Using the normal multiplier for fat-tailed data. At 99% this understates the loss (A2); check with historical simulation or a Student t.
• Confusing component VaR with conditional VaR. Some texts use "CVaR" for expected shortfall. State which you mean.
• Reading a low exception count as good news. Zero exceptions over a long period may mean the model is too conservative, which wastes capital and limits.
• Forgetting that historical simulation forgets. When a crisis drops out of the window, VaR falls overnight although nothing in the portfolio changed.
• Using delta-normal VaR for options. Gamma makes losses non-linear; revalue fully.
• Treating VaR as a substitute for stress testing. VaR reflects the data window; stress tests explore events the window has not seen.

Self-test questions

1. Define one-day 99% VaR in one sentence, and say what it does not tell you.
2. Why is ES coherent while VaR is not always? Name the property VaR can break.
3. Why did the Basel Committee pick 97.5% for ES rather than 99%?
4. In A1, why is the bonds' component VaR almost zero although they are 40 percent of the capital?
5. Give one strength and one weakness each of parametric VaR, historical simulation and Monte Carlo.
6. What does square-root-of-time scaling assume?
7. In A3, how many exceptions would you expect, and what is the conclusion of the Kupiec test?
8. Why does an EWMA volatility react faster than a 500-day equal-weighted estimate?
9. A portfolio's VaR fell sharply overnight although no positions changed. Give a likely cause under historical simulation.
10. How would a non-financial company use VaR-like thinking for its derivative hedges?
11. Why are liquidity horizons part of the Basel ES calculation?

My notes and next steps

Sources and further reading

• Engle, R. F. (1982). Autoregressive conditional heteroscedasticity with estimates of the variance of United Kingdom inflation. Econometrica, 50(4), 987-1007.
• Bollerslev, T. (1986). Generalized autoregressive conditional heteroskedasticity. Journal of Econometrics, 31(3), 307-327.
• J.P. Morgan and Reuters (1996). RiskMetrics: Technical Document (4th ed.). (First edition 1994.)
• Kupiec, P. H. (1995). Techniques for verifying the accuracy of risk measurement models. The Journal of Derivatives, 3(2), 73-84.
• Basel Committee on Banking Supervision (1996). Supervisory framework for the use of "backtesting" in conjunction with the internal models approach to market risk capital requirements, bis.org (checked 2026-10-28).
• Christoffersen, P. F. (1998). Evaluating interval forecasts. International Economic Review, 39(4), 841-862.
• Artzner, P., Delbaen, F., Eber, J.-M., and Heath, D. (1999). Coherent measures of risk. Mathematical Finance, 9(3), 203-228.
• Rockafellar, R. T., and Uryasev, S. (2000). Optimization of conditional value-at-risk. Journal of Risk, 2(3), 21-41.
• Acerbi, C., and Tasche, D. (2002). On the coherence of expected shortfall. Journal of Banking and Finance, 26(7), 1487-1503.
• Basel Committee on Banking Supervision (2019). Minimum capital requirements for market risk; Basel Framework chapters MAR32 and MAR33, bis.org (checked 2026-10-28).
• Prudential Regulation Authority (2026). PS1/26, Implementation of the Basel 3.1 final rules, 20 January 2026, bankofengland.co.uk (checked 2026-10-28); consultation CP17/25, Basel 3.1: adjustments to the market risk framework, 15 July 2025.
• European Commission. Implementing and delegated acts under the Capital Requirements Regulation, including Commission Delegated Regulation (EU) 2026/1221, finance.ec.europa.eu (checked 2026-10-28).
• Board of Governors of the Federal Reserve System, FDIC and OCC (2026). Agencies request comment on proposals to modernize the regulatory capital framework, press release of 19 March 2026, federalreserve.gov (checked 2026-10-28).
• Textbooks (further reading, by name only): Jorion, Value at Risk; Hull, Risk Management and Financial Institutions; Christoffersen, Elements of Financial Risk Management; McNeil, Frey and Embrechts, Quantitative Risk Management.
• Open resource: OpenStax, Introductory Statistics and Principles of Finance, free online at https://openstax.org (check the licence on each book page).

Answer key

Worked example B. (2) USD 0.5234m. (3) USD 1.6552m. (4) USD 0.5260m. (5) 12.5 days. (6) Any of: volatility is not constant (it clusters), returns are autocorrelated, the position would be traded or hedged during the ten days, the currency could be managed or pegged, fat tails make the normal multiplier too small.

Exercise C. (1) Sum of stand-alone VaRs = $2.3263 \times 0.30$ = USD 0.6979m. Correlation 1.0: VaR USD 0.6979m, benefit 0. Correlation 0.5: VaR USD 0.6155m, benefit USD 0.0824m. Correlation -0.5: VaR USD 0.4029m, benefit USD 0.2950m. (2) $LR_{POF}$ = 19.0162, p-value 0.000013 (=CHISQ.DIST.RT(19.0162,1)); red zone (10 or more). Causes: volatility estimate too slow after a regime change, missing or proxied risk factors, wrong or stale market data, positions changed during the day, fat tails not captured. (3) Monte Carlo or historical simulation with full revaluation of the options; delta-normal VaR treats the option as a linear position and misses gamma, so it misstates losses for large moves (understating for short option positions).

Self-test.

1. The loss that, with 99 percent probability, will not be exceeded over the next day. It says nothing about how large the loss is on the remaining 1 percent of days.
2. ES averages the whole tail and satisfies subadditivity, so merging portfolios never raises it above the sum; VaR is a single quantile and can break subadditivity (Artzner et al. 1999).
3. Under normality, 97.5% ES is close to 99% VaR (2.3378 against 2.3263 standard deviations), which keeps capital comparable while making the measure sensitive to fat tails.
4. Its dollar volatility is small (0.08 against 0.36) and its correlation with equities is negative, so its marginal effect on portfolio volatility is close to zero.
5. Parametric: fast and decomposable, but assumes normality and linearity. Historical: no distribution assumption, but limited to the window. Monte Carlo: flexible and handles options, but depends on the chosen model and is costly.
6. Independent and identically distributed returns, constant volatility and unchanged positions over the horizon.
7. 2.5 expected; LR 5.50 > 3.84, p-value 0.019, so reject the hypothesis of a 1 percent exception rate at 5 percent: the model probably understates risk.
8. It gives yesterday's squared return a weight of $1-\lambda$ (6 percent) and lets older data decay geometrically, while a 500-day equal-weighted estimate gives each day 0.2 percent.
9. A volatile period (for example a crisis day) has dropped out of the window.
10. It estimates how much the mark to market of its hedges, and therefore the margin or collateral calls, could move in a bad month, and holds liquidity for that (cash-flow-at-risk).
11. A one-day or ten-day horizon assumes positions can be exited quickly; less liquid risk factors take longer, so the loss over the time needed to exit is larger.

Revision history

Standard and licence note

Based on the risk measurement methods in the original works cited above (RiskMetrics; Kupiec 1995; Christoffersen 1998; Artzner et al. 1999; Acerbi and Tasche 2002) and on the Basel Committee's market risk framework, cited by document and chapter only (MAR32, MAR33), with jurisdiction dates from the European Commission, the PRA and the US agencies as checked in October 2026. Check the current official texts before you rely on them. The explanations, notation, worked examples and layout are original; no regulatory table, textbook text, published case or exam question is reproduced. Every number was computed in Python and is shown with the matching Excel formula. The template is not affiliated with or endorsed by any business school, regulator or publisher, and it is not investment, regulatory or legal advice. Template licence: MIT.