Value at Risk (VaR)

By Sitraka Forler · Lecturer, Durham Business SchoolUpdated 13 September 2026 About this site

Worst expected loss over a horizon at a confidence level.

A 1-day 95% VaR of $1M means there is a 5% chance of losing more than $1M tomorrow. The historical method reads it off the return distribution; the parametric method assumes normality. VaR ignores how bad the tail gets - see Expected Shortfall.

One number, one dangerous tail: Value at Risk

Normal daily returns, μ = 0.05% and σ = 1.2%. The rose region is the worst slice of days; VaR is its fence.

z = -1.6449 · VaR = -(0.05% + z × 1.20%) = 1.9239% of €1,000,000 = €19,239 · ES = €24,251

confidence α95.0%

Slide α and the fence walks left while the shaded tail thins. VaR is a fence at the edge of the tail, ES asks how deep the tail goes past the fence: identical fences can hide very different tails, which is why the FRTB rules moved bank capital from VaR to ES.

The intuition

Value at Risk is a quantile of your profit-and-loss distribution dressed up as a single number. A one-day 95% VaR of €19,239 makes a precise claim: on 95 days out of 100 you should lose less than €19,239, and on the other 5 you will lose more. Formally, VaR_alpha = -quantile(returns, 1 - alpha): find the return that separates the worst 5% of days from the rest, flip its sign, and quote it as a loss. It is a fence at the edge of the left tail: it tells you where bad days begin, not how bad they get.

The chart above shows the machine behind the number. The blue curve is the distribution of daily returns, here normal with a mean of 0.05% and a volatility of 1.2%. The rose region is the tail VaR fences off, and the dashed rose line is the fence itself: the return sitting exactly at the 1 - α quantile. Drag the confidence slider from 90% towards 99% and watch the fence walk left as the shaded tail thins. The gold line deeper in the tail is Expected Shortfall, the average of everything beyond the fence; it always sits further out than VaR.

Quants compute VaR three ways. Parametric VaR assumes a distribution, usually normal, and reads the quantile from the mean, the volatility and a z-score, exactly as this page does. Historical VaR sorts a window of actual daily returns and takes the empirical percentile, with no distributional assumption at all. Monte Carlo VaR simulates thousands of scenarios from a fitted model. Banks run it daily to set trading limits and, for years, regulatory capital, which is why its blind spot matters: two books with identical VaR can hide very different tails, and only Expected Shortfall tells them apart.

Formula / theory

VaR_α = −quantile(returns, 1 − α)

In Python

import numpy as np
from scipy.stats import norm
# Historical 95% VaR
var_hist = -np.percentile(returns, 5)
# Parametric (normal) 95% VaR
var_param = -(returns.mean() + norm.ppf(0.05) * returns.std())

A 95% one-day VaR and ES for a €1,000,000 book

Fix the inputs: mean daily return μ = 0.05% = 0.0005, daily volatility σ = 1.2% = 0.012, confidence α = 95%, book value €1,000,000.
Find the z-score cutting off the worst 5% of a standard normal: z = Φ⁻¹(0.05) = -1.6449.
Turn it into a daily return: μ + zσ = 0.0005 + (-1.6449 × 0.012) = 0.0005 - 0.0197388 = -0.0192388, a return of -1.9239%.
Quote VaR as a positive loss: VaR = 0.0192388 × €1,000,000 = €19,238.80, so €19,239. Five days in a hundred should lose more than this.
For ES, evaluate the normal density at the cut-off: φ(1.6449) = exp(-1.6449² / 2) / √(2π) = exp(-1.352848) / 2.5066 = 0.10313.
ES = -(μ - σφ(z)/(1 - α)) = -(0.0005 - 0.012 × 0.10313/0.05) = -(0.0005 - 0.012 × 2.0626) = -(0.0005 - 0.0247512) = 0.0242512, so 2.4251% of the book, €24,251.
Check the ordering: ES €24,251 > VaR €19,239, as it must always be. VaR marks where the tail begins; ES measures its average depth.

Under a normal model the 95% fence sits at €19,239 and the average breach behind it costs €24,251, but real daily returns have fatter tails than the normal, so parametric VaR flatters you; the standard cross-check, historical VaR, simply takes the empirical 5th percentile of actual past returns.

Common pitfalls

Reading VaR as a worst case. A 95% VaR of €19,239 is the entry ticket to the worst 5% of days, not a ceiling: in the model above the average breach costs €24,251, and a fat-tailed reality can go far deeper. Always quote ES alongside.
Scaling one-day VaR to ten days with the square root of time. Multiplying by √10 assumes returns are independent and identically distributed; volatility clustering and autocorrelation in stressed markets break that assumption, usually in the direction of understating multi-day risk.
Trusting the normal distribution in the tail. Daily returns show excess kurtosis, so a normal fit calibrated on the middle of the distribution systematically understates the 99% quantile; desks cross-check parametric VaR against historical simulation for exactly this reason.
Forgetting that VaR is not subadditive. Merging two desks can report a combined VaR larger than the sum of the standalone numbers, making diversification look like added risk; Expected Shortfall does not have this defect, one reason FRTB moved market-risk capital from 99% VaR to 97.5% ES.

Frequently asked questions

What does a one-day 95% VaR of €1 million mean in plain English?

It means that on 5 trading days out of 100, roughly once a month, you should expect to lose more than €1 million; on the other 95 you lose less than that or make money. It is a statement about how often the fence is breached, not about the size of the breach: the loss on those bad days could be €1.1 million or €10 million.

What is the difference between VaR and Expected Shortfall?

VaR is the loss at the edge of the tail; Expected Shortfall is the average loss once you are inside it, so ES is always at least as large. ES also behaves better mathematically: it is subadditive, meaning diversification never increases it, which VaR cannot guarantee. That is why the Basel FRTB rules moved banks' market-risk capital from 99% VaR to 97.5% Expected Shortfall.

What is the difference between parametric and historical VaR?

Parametric VaR assumes a distribution, typically normal, and computes the quantile from the fitted mean and volatility with a z-score. Historical VaR makes no such assumption: sort the last 250 or 500 actual daily returns and read off the empirical 5th percentile. Parametric is smooth and fast but inherits the thin tails of the normal; historical captures fat tails, but only the ones your lookback window happened to contain.

Why did VaR fail in 2008?

Three compounding reasons. Models fitted to the calm years before the crisis produced tiny volatilities, so the fences stood far too close in. Real returns turned out far fatter-tailed than the normal assumption. And correlations between assets jumped towards one in the crash, so the diversification the models relied on vanished exactly when it was needed. Banks breached their 99% VaR dozens of times in a year that should have produced two or three breaches.

Test yourself

Practise Value at Risk (VaR) hands-on - free, in your browser

Your First Return CalculationPython Foundations · 5 min · no signup neededStart