What is the difference between VaR and CVaR?

VaR is a quantile of the loss distribution: the loss that's exceeded with probability at most 1 minus alpha. CVaR, also called Expected Shortfall, is the average loss across the worst 1 minus alpha of outcomes, so it tells you how bad the tail gets past VaR. When losses are continuous, that equals the expected loss given that the loss exceeds VaR. With discrete or lumpy losses, use the worst-tail average, because the conditional shortcut can give the wrong number.

Why is VaR not a coherent risk measure?

VaR can violate sub-additivity: the VaR of a combined portfolio can exceed the sum of the VaRs of its parts. That contradicts diversification, and it's why Artzner, Delbaen, Eber and Heath (1999) classed VaR as non-coherent. Expected Shortfall doesn't have this problem.

Why did Basel III move from VaR to Expected Shortfall?

Basel III's Fundamental Review of the Trading Book (FRTB) replaced 99% VaR with 97.5% Expected Shortfall as the regulatory market-risk measure, because ES is coherent (sub-additive) and captures tail risk that VaR ignores. For a normal distribution, 97.5% ES roughly matches 99% VaR, but it's larger under fat tails.

What are the three main methods for estimating VaR?

Parametric (variance-covariance), which assumes normality and uses the mean plus a z-score times sigma. Historical simulation, which ranks past returns and reads off the alpha-quantile. Monte Carlo, which simulates returns from a specified distribution and reads off the quantile. They trade off accuracy, computing cost and how well they capture the tail.

Is VaR still useful given its limitations?

Yes, alongside Expected Shortfall and stress tests. VaR is still a handy daily summary for trading desks because it's easy to interpret. The professional standard is to report it next to ES, never alone, and most regulators and risk committees now require both.

VaR vs CVaR vs Expected Shortfall: A Risk Manager's Guide

Value at Risk (VaR) is a quantile of the loss distribution, the loss a portfolio exceeds at most $(1-\alpha)$ of the time, and CVaR, also called Expected Shortfall (ES), is the average loss across the worst $(1-\alpha)$ of outcomes. When losses are continuous, a 99% 1-day VaR of $10M means exactly a 1% chance of losing more than $10M tomorrow, and ES is the average loss on the days you go past it. Basel III replaced 99% VaR with 97.5% Expected Shortfall in the Fundamental Review of the Trading Book (FRTB), because ES is coherent and VaR isn't.

VaR became the default market-risk metric in the 1990s, after JP Morgan's 1994 RiskMetrics framework spread it across banks and hedge funds, and it's still on every risk dashboard. FRM Part I's Valuation and Risk Models section and the CFA Level II market risk reading test these measures, with more weight on interpretation than arithmetic. CAIA® covers less of it, mostly definitions and parametric VaR.

How VaR works, and where it breaks

VaR at confidence level $\alpha$ over horizon $T$ is the smallest loss whose cumulative probability reaches $\alpha$ :

$\text{VaR}_\alpha = \inf\{x : P(L \leq x) \geq \alpha\}$

So the chance of a loss above VaR is at most $1 - \alpha$ , $P(L > \text{VaR}_\alpha) \leq 1 - \alpha$ , and it's exactly $1 - \alpha$ when the loss distribution is continuous (no lump of probability sitting at VaR).

It's popular because it's one dollar figure that the board, the desk and the regulator all read the same way, and because desk VaRs can be summed (with adjustments) into a firm-level number.

That adding-up is where VaR runs into trouble. In 1999, Artzner, Delbaen, Eber and Heath set out four axioms a risk measure should satisfy: monotonicity, translation invariance, positive homogeneity and sub-additivity. Sub-additivity, $\rho(A + B) \leq \rho(A) + \rho(B)$ , says a combined portfolio is no riskier than the sum of its parts, which is diversification written formally. VaR violates it for non-elliptical distributions. Two short-volatility positions combined can have a higher VaR than the sum of their individual VaRs, because their rare tail events line up, so VaR can punish diversification.

You'll see this stem a lot: "A risk manager combines two strategies with VaRs of $1M and $2M and reports a combined VaR of $4M. Explain." The answer they want is VaR's failure of sub-additivity. Calling it a calculation error is the wrong answer.

CVaR, or Expected Shortfall, is the average of VaR across every confidence level above $\alpha$ , which works out to VaR plus the average overshoot past it, scaled to the tail:

$ES_\alpha = \frac{1}{1-\alpha}\int_\alpha^1 \text{VaR}_u \, du = \text{VaR}_\alpha + \frac{E[(L - \text{VaR}_\alpha)^+]}{1-\alpha}$

If the loss distribution is continuous, that's the same as the expected loss given that the loss exceeds VaR, the version most textbooks print:

$ES_\alpha = E[L \mid L \geq \text{VaR}_\alpha]$

With discrete or lumpy losses the conditional version can be badly off. Take 950 days with no loss and 50 days losing 100: the 95% VaR is 0, the conditional formula gives 5, and the average of the worst 50 days is 100. So in a sample, ES is the average of the worst $(1-\alpha)$ share of outcomes by probability. For a 95% ES with 1,000 equally weighted daily observations, the worst 50 days are exactly 5%, so you average them. If $(1-\alpha)N$ isn't a whole number, the boundary observation gets only the fractional weight needed to bring the tail to exactly $1-\alpha$ .

ES satisfies sub-additivity, so combining sub-portfolios can't push it above the sum of the parts, and that's why Basel III adopted it. It also measures how bad the tail gets, which VaR doesn't. Two strategies can share the same 99% VaR and have very different ES because one has a fatter tail, and for options-writing, credit-spread and other tail-risk strategies, reporting only VaR can hide stress losses of 3x or 4x the VaR threshold.

For a normal distribution, 97.5% ES and 99% VaR are roughly equivalent. Under fat tails, 97.5% ES is materially larger, so the FRTB switch makes banks hold more capital against tail-risk exposures. The formal Basel III version is a scaled 10-day ES with stress-period scaling and liquidity horizons by asset class, but FRM stems only need the 97.5% ES versus 99% VaR idea.

Estimating VaR and ES

All three measures can be estimated three ways, and practitioners usually run all three and compare. A big gap between parametric and historical VaR suggests fat tails, and a big gap between historical and Monte Carlo suggests model error.

Parametric (variance-covariance)

Assume returns are normal with mean $\mu$ and standard deviation $\sigma$ :

$VaR_\alpha = -(\mu + z_\alpha \cdot \sigma)$

$z_\alpha$ is the standard-normal z-score (-1.645 for 95%, -2.326 for 99%). For a 99% 1-day VaR with a daily mean of 0.05% and daily volatility of 1%:

$VaR = -(0.0005 - 2.326 \cdot 0.01) = 0.0228 = 2.28\%$

It's simple and it's wrong for fat-tailed distributions, so use it only when you can defend the normality assumption.

Historical simulation

Turn the last $N$ daily returns into losses (a -2% return is a 2% loss), sort them and read off the $\alpha$ quantile. Conventions differ, so say which one you're using. Under the quantile definition above, 99% VaR with 500 days of data is the 495th smallest loss, which is the 6th worst, and ES is the average of the worst 5, since those five days are exactly 1% of the sample. Some textbooks and question writers take the 5th worst loss as VaR instead, so check how the question counts. It needs no distributional assumption, but it's limited by sample size, and the worst day in the sample may be milder than the worst one ahead.

Monte Carlo simulation

Fit a distribution (or a multi-factor model) to the data, simulate 10,000 (or 100,000) returns and read off the quantile. It handles non-normal distributions and complex positions like options, credit derivatives and path-dependent payoffs. It's computationally heavy, and only as good as the distribution you feed it.

Modified VaR (Cornish-Fisher)

For strategies with material skew and kurtosis, the Cornish-Fisher expansion adjusts the parametric z-score:

$z'_\alpha = z_\alpha + (z_\alpha^2 - 1)\frac{S}{6} + (z_\alpha^3 - 3z_\alpha)\frac{K}{24} - (2z_\alpha^3 - 5z_\alpha)\frac{S^2}{36}$

$S$ is skewness and $K$ is excess kurtosis (kurtosis minus 3). Modified VaR is then

$\text{mVaR}_\alpha = -(\mu + z'_\alpha \cdot \sigma)$

With skew of -1.5 and excess kurtosis of 5, the 99% z-score moves from -2.326 to about -3.75, which makes the VaR estimate about 60% larger than the normal-distribution VaR. It's the same expansion behind the Modified Sharpe ratio, and a simple, defensible fix for moderate non-normality. For severe non-normality (heavy options-writing books, credit spreads in stress), even modified VaR can underestimate, and full Monte Carlo with a fat-tailed distribution is the better call.

To backtest, remember that a 99% 1-day VaR predicts exceedances on roughly 1% of trading days, about 2-3 a year. Kupiec's POF (proportion of failures) test compares the observed count with the expected count using a binomial test, so a model with 8 exceedances in a year when 2.5 were expected gets rejected. Basel's backtest counts exceedances over the most recent 250 trading days, and under its traffic-light rules too many of them raise the VaR capital multiplier from 3.0 toward 4.0. ES is harder to backtest because it conditions on tail events, and the standard Acerbi-Szekely tests are newer and less powerful than VaR backtests.

What the exams test

FRM Part I covers VaR estimation methods, sub-additivity and the basic idea of ES. FRM Part II's market risk readings go further into ES estimation and VaR backtesting, including the Basel rules. CAIA stops earlier: Level I asks you to define VaR and CVaR and apply parametric VaR, and Level II's VaR material is parametric VaR for managed futures. Across these exams you'll see four kinds of question:

Definitions: distinguish VaR from CVaR, and state the four coherence axioms.
Calculations: parametric VaR from a mean and sigma, historical VaR from a sorted return series, modified VaR from skew and kurtosis.
Interpretation: why Basel III moved to ES, what sub-additivity means, why VaR can mislead on a short-vol book.
Backtesting: apply Kupiec's test and say when a model should be rejected.

People lose points by dropping the negative sign (VaR is reported as a positive loss, so the -2.326 z-score turns positive through the negation), mixing up confidence and horizon (a 95% 10-day VaR and a 99% 1-day VaR are different numbers), using parametric VaR on a fat-tailed book like short volatility, and treating VaR and ES as substitutes when you should report both.

The biggest of those is using parametric VaR by default. Before you use it, ask whether the distribution is normal enough to justify it. If it isn't, the answer is almost always historical simulation, Monte Carlo or modified VaR, and the stem usually signals which. The parametric VaR and CVaR formulas are on the CAIA Level II formula sheet, and the free CAIA Level II question bank has dozens of risk-measurement questions tagged by topic, with solutions that cover both the calculation and the choice of method.