Guide

Value at Risk (VaR) explained

Every portfolio faces a question regulators, risk desks, and serious allocators ask daily: how bad could tomorrow get? Value at Risk (VaR) answers in one sentence — the maximum loss you expect not to exceed over a chosen horizon at a chosen confidence level. A one-day 95% VaR of $50,000 on a $2 million book means: under the model, you should lose more than $50,000 on only about one trading day in twenty. VaR became the lingua franca of bank risk management after the 1990s; it also misled institutions before 2008 when correlations spiked and tail losses blew past reported limits. This guide explains what VaR measures (and what it does not), the three standard calculation methods, how CVaR / expected shortfall patches VaR's blind spot, a Harbor Capital multi-asset allocator worked example, a method decision table, common pitfalls, and a practitioner checklist. Pair it with position sizing and maximum drawdown for a fuller picture of portfolio survival.

What VaR actually means

VaR is a quantile of the loss distribution, not an average or a worst-case scenario. Statement format matters: "10-day 99% VaR = $120,000" means there is a 1% chance (roughly two and a half days per year if independence held) that losses over the next ten trading days exceed $120,000. It does not cap losses — it describes a threshold that should be breached rarely under the assumptions baked into the model.

Three parameters define every VaR number:

Portfolio scope — a single position, a desk, or the entire fund.
Time horizon — usually one day for trading books, ten days for regulatory reporting (Basel scales one-day VaR by √10).
Confidence level — 95% and 99% are standard; higher confidence means a larger VaR because you are looking deeper into the left tail.

VaR compresses complex return distributions into a single dollar figure — powerful for limits and capital allocation, dangerous if treated as a guarantee. When markets gap, liquidity vanishes, or correlations converge to one, realized losses can exceed VaR by multiples. That is why post-crisis regulation increasingly favors expected shortfall (average loss beyond the VaR threshold) alongside or instead of VaR alone.

Three ways to calculate VaR

All methods estimate the same quantile; they differ in how they model the return distribution. No method is universally best — the right choice depends on portfolio complexity, data history, and how fat the tails are.

Historical simulation

Take the last N days of actual portfolio returns (or position returns weighted by holdings), sort them worst to best, and pick the loss at the desired percentile. If you have 250 daily returns and want 95% VaR, the fifth-worst day (250 × 5% = 12.5, round to the 13th worst) is your estimate. Pros: no distributional assumptions, captures real correlation structure if history is representative. Cons: backward-looking — silent on events never observed; slow to react after calm periods; needs enough history for rare quantiles (99% VaR on 100 days is statistically thin).

Parametric (variance-covariance) VaR

Assume returns are normally distributed (or use a parametric tail model). Estimate the portfolio's mean return μ and standard deviation σ from historical data or factor models, then read the quantile from the normal table. For one-day 95% VaR with zero mean: VaR = 1.65 × σ × portfolio value. For multiple assets, build a covariance matrix and compute portfolio variance: σ_p² = wᵀ Σ w where w is the weight vector. Pros: fast, scalable to large portfolios, easy to decompose by factor. Cons: underestimates tail risk for skewed or fat-tailed assets (crypto, options, distressed credit); correlation estimates go stale in crises.

Monte Carlo simulation

Specify a joint distribution for all risk factors (equity returns, rates, FX, vol surfaces), simulate thousands of scenarios, revalue the portfolio in each, and take the loss quantile from the simulated distribution. Pros: handles options, path-dependent payoffs, and nonlinear exposures parametric VaR misses. Cons: model risk is concentrated in the assumptions — wrong correlation dynamics or vol regime produce confident-but-wrong VaR; computationally expensive for complex books.

Method comparison at a glance

Method	Best for	Main weakness
Historical	Simple equity/bond mixes, enough clean history	Cannot foresee unprecedented shocks
Parametric	Large linear portfolios, daily risk reporting	Normal tails underestimate crashes
Monte Carlo	Options, structured products, nonlinear books	Garbage in, garbage out on correlations

CVaR and expected shortfall

VaR tells you the threshold; it says nothing about how bad losses are beyond that threshold. Two portfolios can share identical 99% VaR but differ wildly in tail severity — one might lose 1.1× VaR on a bad day, another 5× VaR. Conditional VaR (CVaR), also called expected shortfall (ES), averages all losses worse than the VaR cutoff. If 99% VaR is $100,000 and the average of the worst 1% of days is $180,000, CVaR = $180,000.

Basel III and many institutional risk frameworks now prefer ES because it is subadditive — combining two portfolios never magically lowers total risk the way VaR sometimes could (a known theoretical flaw). For retail investors sizing a crypto sleeve or evaluating a hedge fund, ask for both VaR and CVaR at the same confidence level. A fund showing tight VaR but exploding CVaR is hiding tail concentration. See also Sharpe ratio for mean-variance thinking and VIX for forward-looking vol gauges that stress parametric VaR inputs.

Worked example: Harbor Capital daily risk limit

Harbor Capital manages a $5 million balanced portfolio: 60% global equity ETF, 30% investment-grade bonds, 10% gold. The risk officer must set a one-day 95% VaR limit for the investment committee. Using two years of daily returns (about 500 observations):

Historical VaR: Reconstruct daily portfolio returns from weighted components. The 25th-worst day (500 × 5%) shows a −1.42% return → 95% VaR ≈ $71,000.
Parametric VaR: Annualized portfolio volatility estimated at 9.8% → daily σ ≈ 9.8% / √252 ≈ 0.62%. With 1.65 × 0.62% × $5M ≈ $51,150 — materially lower than historical because recent calm years pulled σ down.
Stress overlay: March 2020 week showed −3.1% in a single day on this mix — nearly 2.2× the parametric VaR. Committee sets internal limit at $75,000 (historical-based, rounded up) and requires CVaR reporting at 95% alongside.

The gap between parametric ($51k) and historical ($71k) VaR is the lesson: normal assumptions flatter risk after extended bull markets. Harbor also runs a stressed VaR using covariance matrices from 2008 and 2020 separately — the higher of stressed and baseline VaR drives position limits. When the equity sleeve drifts above 65% from appreciation, rebalancing is triggered not only by allocation bands (see portfolio rebalancing) but because uncorrected drift pushed parametric VaR toward $58,000 — approaching the $75,000 ceiling with no buffer for correlation spikes.

Portfolio VaR vs position limits

Banks decompose portfolio VaR into component VaR — each position's marginal contribution to total risk. A $1 million bond position might add only $8,000 to daily VaR because it hedges equity volatility; a $200,000 crypto position might add $15,000 because of high standalone vol and correlation spikes. Component VaR guides which positions to trim when aggregate VaR breaches limits.

Retail investors can approximate this without a quant desk:

Compute standalone VaR per sleeve (equities, bonds, alts).
Compare to portfolio VaR — if portfolio VaR is much less than the sum of parts, diversification is working.
During crises, recompute weekly; diversification benefits often disappear when you need them most.

VaR complements but does not replace per-trade position sizing. A trader might accept 1% account risk per trade while the portfolio VaR limit caps aggregate daily exposure across all open positions.

When VaR fails — and how to mitigate

Correlation breakdown — in crashes, "uncorrelated" assets move together. Historical VaR from peaceful years underestimates joint tail moves. Mitigation: stressed correlation matrices, regime-switching models, or shorter rolling windows.
Liquidity risk — VaR assumes you can exit at modeled prices. Thin altcoins, corporate bonds, and private credit can gap far beyond VaR when bid-ask spreads blow out. Mitigation: haircut illiquid sleeves in stress scenarios; size positions to days-to-liquidate metrics.
Non-normal tails — equity and crypto returns exhibit kurtosis and skew. Parametric VaR at 99% can be half the realized tail loss. Mitigation: prefer historical or Monte Carlo with fat-tailed distributions; report CVaR.
Model stagnation — VaR models updated monthly miss vol regime shifts. Mitigation: backtest VaR breaches (count how often actual losses exceed VaR — should match the confidence level); escalate when breach rate doubles.
Procylical limits — cutting risk only after VaR spikes forces selling into downturns. Mitigation: pair VaR ceilings with pre-defined bear market playbooks and rebalancing rules set in calm periods.

VaR vs other risk metrics

Metric	What it measures	VaR relationship
Volatility (σ)	Spread of returns	Parametric VaR is a σ multiple
Maximum drawdown	Worst peak-to-trough loss over a period	Backward-looking realized pain; VaR is forward probabilistic
Sharpe / Sortino	Return per unit of risk	Reward efficiency; VaR is loss magnitude only
Beta	Sensitivity to benchmark	Systematic exposure; VaR captures total volatility including idiosyncratic
CVaR / ES	Average loss beyond VaR	Tail complement; use together

No single number captures risk. VaR excels at daily limit setting and regulatory capital; maximum drawdown tells you what investors actually endured; Sharpe tells you whether returns justified the ride.

Production checklist

State horizon, confidence level, and currency every time you cite a VaR number.
Pick a method matched to portfolio complexity — historical for simple, Monte Carlo for nonlinear.
Report CVaR / expected shortfall at the same confidence level as VaR.
Backtest breach frequency — 95% VaR should be exceeded about 5% of days.
Run stressed VaR with crisis-period correlation and volatility inputs.
Haircut or exclude illiquid positions that models price too optimistically.
Decompose portfolio VaR by sleeve to find hidden concentration.
Recompute after major allocation changes, not only on a calendar.
Never treat VaR as a maximum loss guarantee — document tail scenarios beyond VaR.
Pair VaR limits with drawdown tolerance and liquidity runway for the whole portfolio.

Key takeaways

VaR is the loss threshold not expected to be exceeded at a given confidence level over a defined horizon — a quantile, not a worst case.
Historical, parametric, and Monte Carlo methods trade assumptions for flexibility; parametric VaR often understates tails.
CVaR / expected shortfall measures average severity beyond VaR and is subadditive — use it alongside VaR.
Correlation and liquidity are the main reasons realized crises exceed modeled VaR.
Backtest breach rates and stressed scenarios matter more than a single polished daily number.