Every bank's risk management team calculates VaR daily. Regulators require it. Traders monitor it. And yet, VaR famously failed to prevent the 2008 crisis — the very models designed to capture risk systematically underestimated the losses that were actually possible. Understanding VaR means understanding both its power and its profound limitations.
The three parameters
- Confidence level: Typically 95% or 99%. At 99%, you're saying: "I'm 99% confident losses won't exceed X."
- Time horizon: Usually 1 day (for trading) or 10 days (for regulatory capital). Longer = bigger VaR.
- Portfolio: VaR depends on the specific mix of positions held.
Methods for calculating VaR
Historical simulation: Apply today's portfolio to historical returns over the past 250 days; the 99% VaR is the 2.5th worst day's loss. Simple, but limited to scenarios that actually occurred.
Parametric (variance-covariance): Assumes returns are normally distributed; uses historical volatility and correlations. Fast but blind to fat tails.
Monte Carlo simulation: Simulates thousands of random scenarios from assumed distributions. Flexible but computationally intensive and model-dependent.
VaR's critical flaw: it says nothing about tail losses
The most dangerous thing about VaR is what it doesn't tell you. A 99% VaR of £1m says you'll lose more than £1m in 1% of days. But it says nothing about how much more on those worst days. You might lose £1.1m or £100m — VaR is silent on this. This is why risk managers now supplement VaR with "Expected Shortfall" (CVaR) — the average loss in the worst scenarios beyond VaR.
What this means for you
When a bank says its "daily VaR is £50m," they're not saying they can't lose more than £50m. They're saying they expect to lose more than £50m about 2.5 times per year. In a crisis — when correlations spike, markets become illiquid, and the "fat tails" materialise — VaR-based risk management can catastrophically understate actual risk. Post-2008, stress testing (simulating specific scenarios like 2008 itself) is now required alongside VaR precisely because VaR fails when it matters most.