In plain English
Risk management is asking 'how bad can it get, how likely is that, and what do we do about it before it happens?'
The advanced view
Risk is decomposed by type — market, credit, liquidity, operational — because each has a different measurement and a different hedge. VaR summarises a quantile of the loss distribution; expected shortfall averages the tail beyond it and is coherent, which VaR is not. Stress testing replaces distributional assumptions with narratives, precisely because tails are where models fail.
Value at Risk answers: what is the maximum loss over a horizon at a confidence level? A 1-day 95% VaR of 2M means a 5% chance of losing more than 2M in one day. Three methods: historical simulation, parametric variance-covariance, and Monte Carlo. VaR says nothing about the size of losses beyond the threshold and assumes stable correlations that break in crises.
Parametric VaR = z_α × σ × Portfolio value σ_annual = σ_daily × √252 Expected shortfall = E[loss | loss > VaR]
Expected shortfall (CVaR) fixes the tail problem by averaging losses beyond VaR — which is why Basel III moved to ES for market-risk capital. Stress testing complements statistical measures by asking what happens under a specific extreme scenario: a rate spike, a liquidity freeze, a counterparty default. Good risk management uses all three.
Essential vocabulary
- Credit risk
- Risk a counterparty defaults. Measured by PD, LGD and EAD.
- Market risk
- Risk from moves in prices, rates and FX — what VaR and ES measure.
- Operational risk
- Risk from failed processes, people or systems. Hard to quantify; Basel requires capital anyway.
- Liquidity risk
- Inability to sell at fair value (market) or meet obligations (funding). The risk that kills banks.
- Basel III/IV
- International banking regulation: minimum capital, leverage and liquidity ratios. CET1 is the headline number.
Intuition
Risk management is about the shape of the tail, not the average. VaR answers 'how bad on a normal bad day', expected shortfall answers 'how bad when it is worse than that'. Stress tests exist because both are estimated from a past that may not contain the scenario you fear.
Common pitfalls
- ×Assuming normality for returns that are visibly fat-tailed.
- ×Reading VaR as a maximum loss.
- ×Scaling one-day risk to a year by multiplying by 252 rather than √252.
Worked example — one-day VaR
Step 1 of 4
- 1Position 50M, daily σ =
Why it works
VaR works as a communication device because a quantile is comparable across desks and mandates. It fails as a control when returns are fat-tailed or correlations rise in a crisis — dependence itself is state-dependent. That is why regulators moved to expected shortfall and why practitioners pair any single number with scenarios.
How it is used — a quick parametric VaR
Step 1 of 5
- 1Portfolio 100m, annual σ =
Deeper
Deeper: VaR, expected shortfall and what they miss
Parametric VaR at 95% is 1.645σ of the P&L distribution (2.326σ at 99%), scaled by √t for horizon. Expected shortfall answers a better question — the average loss given that you are in the tail — and is coherent (sub-additive), which VaR is not.
Both are statements about a fitted distribution. Real returns have fat tails and correlations that go to one in a crisis, so the historical 99% number understates the loss that ends a firm. Complement them with stress tests built from scenarios, and with liquidity analysis: most failures are funding failures, not mark-to-market failures.
Must know cold
- ✓95% VaR ≈ 1.645σ; 99% ≈ 2.326σ (normal assumption).
- ✓Volatility scales with √t; returns scale with t.
- ✓Expected shortfall = average loss beyond the VaR threshold.
- ✓Diversification benefits vanish exactly when you need them.
Exercises
Try each one on paper before revealing the worked solution.
Exercise 1
A 100M portfolio has 1.2% daily volatility. What is the 1-day 99% VaR and the 10-day 99% VaR?
Exercise 2
Your 99% VaR was breached four times in 250 trading days. What does that tell you?
Volatility arrives in regimes, so a VaR computed on a calm sample underestimates the next stressed month. This is why risk work uses conditional volatility models and stress scenarios alongside a single historical number.