Value at Risk and expected shortfall

Volatility describes typical days. Risk management is about the bad ones.

Value at Risk

The $\alpha$-level Value at Risk over horizon $h$ is the loss that will not be exceeded with probability $\alpha$:

“One-day 99% VaR of 2 million” means: on 99 days out of 100, we expect to lose less than 2 million. It says nothing about how much you lose on the hundredth day.

Three ways to compute it

1. Parametric (variance–covariance). Assume normal returns: $\text{VaR}_\alpha = z_\alpha\,\sigma_p - \mu_p$, with $z_{0.99} \approx 2.33$ and $z_{0.95} \approx 1.645$. Fast, but fat tails make it understate risk.
2. Historical simulation. Apply the last $N$ days of actual returns to today’s portfolio and take the empirical quantile. Captures fat tails and correlations, but only those present in the window.
3. Monte Carlo. Simulate many scenarios from a fitted model and take the quantile. Flexible enough for options and path-dependence; only as good as the model. Try it in the path simulator.

To scale a one-day VaR to $h$ days under independence, multiply by $\sqrt{h}$.

Expected shortfall

Expected shortfall (also called CVaR) is the average loss on the days that breach VaR:

For a normal distribution, $\text{ES}_{0.975} \approx 2.34\sigma$, almost exactly $\text{VaR}_{0.99}$. For fat-tailed returns, ES grows much faster than VaR as the tails thicken, which is exactly the information you want.

Backtesting VaR

A 99% VaR model should be breached on about 1% of days. Count the breaches: far more means the model underestimates risk; clustered breaches mean it ignores volatility regimes. The Kupiec test checks the count, the Christoffersen test checks the clustering.