1. What standard deviation measures and what it does not

Risk 1: Measuring risk

Ask ten investors what the risk of a portfolio is and nine will answer with a number: volatility. It is a reasonable answer, and the one half the industry uses. But it is worth knowing what that number measures, what it quietly takes for granted and when it stops meaning what we think it means.

What exactly that number is

Standard deviation measures how far results spread from their own mean. The procedure has four steps: you work out the mean, subtract it from each data point, square those differences, average them and take the square root. Squaring turns every difference positive, so that the ones above and the ones below do not cancel out, and it punishes large differences more than small ones.

With figures. A strategy delivers these five years: +20%, -5%, +12%, +3% and -10%. The mean is 4%. The differences from it are +16, -9, +8, -1 and -14 points, and their squares add up to 598. Dividing by four (the number of data points minus one, the usual correction with a sample) gives 149.5, and its square root is 12.2%: the number that will end up printed on the fund's factsheet.

Notice what you have just done: you have summarized five years of history in a single figure describing the width of the cloud around that 4%. Nothing more. It says nothing about the shape of that cloud, nor about whether the surprises came on the upside or the downside, nor about the order in which they arrived.

The assumptions that travel as stowaways

When you use standard deviation as a synonym for risk you are signing, without reading it, a contract with three clauses:

• That the mean is stable and meaningful. If the process generating the returns changes (a different rate regime, new regulation, a new competitor), the past mean does not describe the future cloud, and everything else rests on it.
• That dispersion sums up the danger. This only holds if the distribution is roughly symmetrical and free of disproportionate extremes. As soon as there is skew or fat tails, the same number describes opposite realities.
• That each period is independent of the one before. Markets break this systematically: volatility clusters, and calm stretches are followed by calm stretches, violent ones by violent ones.

Harry Markowitz, who in 1952 put variance at the center of portfolio analysis, was aware of these limitations and even discussed alternatives focused on the downside alone. Variance won because it was mathematically tractable, not because it described better what an investor fears.

Symmetry: a +8% weighs the same as a -8%

It is the oldest objection ever leveled at standard deviation. Because of the squaring, an exceptionally good year raises measured risk just as much as an exceptionally bad one of the same size: a strategy that posts an unexpected +40% 'gets worse' by this measure. Nobody loses sleep over earning too much. What the investor fears is losing, and in a very specific way: a lot and all at once. Standard deviation does not tell the two halves of the distribution apart because it was never designed to.

Annualizing: the square root of time and its small print

Volatilities are compared in annual terms. The convention is to multiply by the square root of the number of periods in a year:

• A monthly volatility of 4% is equivalent to 4 x square root of 12 = 13.9% a year.
• A daily volatility of 1% is equivalent to 1 x square root of 252, the trading days in a year, = 15.9% a year.

The small print is that this square root only holds if the periods are independent. If the strategy strings together runs, true annual volatility is higher than the formula's and the published number understates the danger; if there is mean reversion, it overstates it. Almost nobody checks which of the two cases they are looking at.

What it means in practice, and what to put beside it

If you accept the bell curve, a portfolio with an expected 7% and a 15% standard deviation tells you this: two years out of every three will end between -8% and +22%, and one in six below -8%. That is useful information, as long as you remember which assumption it depends on.

To correct the blindness to symmetry there are two close relatives:

• Semi-deviation, which repeats the calculation using only the data points below the mean. In our series, the bad years contributed -9, -1 and -14 points; their squares add up to 278, and over the same four degrees of freedom the square root comes to 8.3%. The bad half of the cloud was narrower than the whole.
• Downside deviation, which measures against a threshold you choose (zero, inflation, the risk-free rate) instead of against the mean. It is the one in the denominator of the Sortino ratio.

Case study: the same index, three different standard deviations

Take the S&P 500. Its annualized volatility over the very long run is around 15%-16%, but that averages regimes with nothing in common: in 2017 realized volatility halved, with the VIX averaging around 11, the lowest annual average level in its history; in 2008 it comfortably exceeded 40%.

And now the arithmetic. With an annualized volatility of 7%, the implied daily volatility is 7 divided by the square root of 252, that is, about 0.44 points a day. On February 5, 2018 the index fell 4.1% in a single session: roughly nine standard deviations measured with the previous year's yardstick. Under the bell curve, an event like that should not happen once in the lifetime of the universe.

The conclusion is not that standard deviation is useless. It is that it is not a property of the asset but of the sample you have looked at, and that it describes the width of the calm cloud, not the depth of the hole. The next module deals with the hole.