1. VaR: what it says, and why it fails when needed
Risk 6: The limits of the tools
The previous five levels have assembled a toolkit: measuring dispersion, sizing a position, understanding ruin, knowing what leverage does and how to spread risk around. This level goes hunting for the seams in that toolkit, starting with the most famous and worst-read tool of the lot.
What the figure says, exactly
Value at risk, or VaR, answers one very specific question: given a time horizon and a probability, what is the loss that will not be exceeded? Without those two ingredients the number means nothing, and yet that is how it circulates in half of all conversations.
An example. A portfolio of 10 million euros, one-day 99% VaR of 230,000 euros. The correct reading is: on 99% of sessions the loss will be smaller than 230,000 euros, 2.3% of the portfolio. And the reading that really matters is the mirror image: roughly one session in every hundred, the loss will be larger. With around 250 sessions a year, that comes to two and a half days a year on which the figure falls short. This is not a failure of the model: it is its definition.
Where the number comes from, and why that is not a technical detail
There are three usual ways of computing it, and none of them is neutral:
- Historical. You rank the last 250 sessions from worst to best and take whichever percentile applies. With 250 data points, 1% is two or three observations: the figure that governs your risk depends on two or three particular days of the recent past.
- Parametric. You assume a distribution, almost always the Gaussian bell curve, and solve. Under that bell the 1% percentile falls at 2.33 standard deviations: if estimated daily volatility is 1%, the 99% VaR comes out at 2.33%.
- By simulation. Thousands of paths are generated from a model. The result inherits, without exception, the assumptions of that model.
With the same portfolio and the same data, the parametric calculation gives 233,000 euros and the historical one can give 350,000. The number does not describe the market: it describes the conversation between the market and the assumption you have chosen.
First failing: it says nothing about what lies on the other side
This defect is conceptual, not a matter of calibration: VaR marks a boundary and then says nothing about anything that happens beyond it. Two 10 million portfolios with the same VaR of 230,000 euros can behave in utterly incomparable ways in the remaining 1%: one loses 260,000 euros on its worst day, the other 2.4 million.
Worse still: a portfolio can be designed to exploit that blindness. Selling options a long way from the current price reduces measured volatility, brings in premiums every month and keeps VaR low, because the loss lives where the measure stops looking. Nassim Taleb has been pointing out since the nineties that the problem is not the imprecision but the false sense of control, and the reward it hands to whoever hides risk below the threshold. Philippe Jorion, its most rigorous defender, concedes the argument and replies: the alternative to measuring badly was not measuring well, it was not measuring at all.
Second and third failings: the assumed distribution and the recent past
The second has already surfaced: the figure depends on the distribution you assume. Level 1 explained why real tails are fatter than the bell's, and VaR lives precisely in the tail, the zone where the normal assumption goes most badly wrong.
The third is the most dangerous because it is silent. Volatility is estimated from recent data and it clusters in runs. That means that in calm periods VaR produces reassuring figures, and if your risk limit is expressed as a percentage of the portfolio, volatility falling from 1.2% to 0.5% authorizes you to more than double your exposure. The system reaches its maximum size right at the end of the quiet stretch.
Expected shortfall: a partial answer
To the first failing there is a reasonable answer: expected shortfall, the average loss conditional on the threshold being exceeded. If the 99% VaR is 230,000 euros and the average of the losses in that worst 1% is 420,000, you now know something you did not know before, and that something is what decides whether you survive.
It also has a property VaR lacks: it never suggests that putting two portfolios together generates more risk than the sum of its parts, a mathematical oddity that can end up penalizing diversification. But it is not a cure: it still depends on the distributional assumption, and it is estimated from the scarcest data there is, the tail's.
A real case: the traffic light that turned red
The tool was born in the early nineties at J.P. Morgan, with a daily report that summarized the risk of the whole firm on a single page, and it went universal in 1994 when its methodology was published free of charge. In 1996, the market risk amendment to the Basel accord turned it into the pillar of regulatory capital: ten-day 99% VaR, multiplied by a factor of at least three. The supervisor checked it against a traffic light over 250 sessions: up to four exceptions, green; five to nine, amber; ten or more, red.
In 2008 several large banks went well past the red zone and racked up in a single year far more exceptions than their model had allowed for. As early as August 2007, the chief financial officer of Goldman Sachs was publicly describing moves of twenty-five standard deviations several days running: under the bell curve, an event like that should not be observed even once in the lifetime of the universe. The correct reading is not that the market went mad, but that the model those deviations were being measured with was the wrong one. The Basel committee ended up siding with the criticism and replaced VaR with 97.5% expected shortfall as the basis for market risk capital.