Value at Risk (VaR) & CVaR

Definition

Value at Risk (VaR) is a risk measure that answers one very specific question in dollars: "With X% confidence, I won't lose more than $Y over horizon Z." It takes the abstract statistics of a portfolio — its volatility, its return distribution — and compresses them into a single loss figure attached to a probability and a time frame.

Every VaR statement has exactly three moving parts, and all three must be quoted for the number to mean anything:

• A confidence level — usually 95% or 99%.
• A time horizon — one day, one month, one year.
• A loss amount — in dollars or as a percentage of the portfolio.

Decode a typical statement: "a 1-month 95% VaR of $20,000 on a $500,000 portfolio." In plain English: in 95 months out of 100, this portfolio's one-month loss should stay smaller than $20,000. Flip it around and the same sentence says something less comforting — a loss worse than $20,000 is expected in roughly 1 month in 20. VaR is not a worst case. It is the fence line between "ordinary" months and the bad 5% that live beyond it.

VaR's close companion is CVaR — Conditional Value at Risk, also called expected shortfall. Where VaR marks the fence, CVaR asks the follow-up question VaR ignores: *when the loss does clear the fence, how big is it on average?* CVaR is the average of the losses in the tail beyond VaR, which is why it is always a larger number and why professional risk desks now lean on it. Both metrics are built from the same raw material as standard deviation — they just re-express spread as dollars at risk.

Why It Matters

For income investors, VaR's real value is translation. A statistic like "the portfolio has a 9% annualized standard deviation" is technically informative but emotionally mute. A statement like "in a bad month — the kind that arrives about once every 20 — you could be down $20,000 or more" is something you can actually plan around. It puts risk in the same units as your grocery bill, your distributions, and your cash buffer.

That translation matters in three concrete ways:

• It sizes risk against your income cushion. Suppose a portfolio throws off roughly $2,500 a month in distributions (illustrative). A 1-month 95% VaR of $20,000 says a bad month can erase the equivalent of eight months of income from the account's value — a trade-off now stated in dollars, not Greek letters.
• It frames withdrawal risk. Anyone drawing income from a portfolio faces sequence-of-returns risk: losses hurt more when you are selling into them. A VaR figure gives you a rough size for the hole a bad month could punch, which helps answer "how much cash should sit outside the portfolio?"
• It makes different portfolios comparable in dollars. A dividend-growth sleeve, a covered-call sleeve, and a bond sleeve all have VaRs. Comparing them side by side shows where the dollar risk actually lives — often not where the yield numbers suggest.

One honest caveat belongs up front: VaR is a planning tool, not a guarantee. The most common version assumes returns follow a tidy bell curve, and real markets do not — they have fat tails, meaning extreme losses arrive more often than the bell curve predicts (the subject of the companion article on tail risk). In 2008 and again in March 2020, losses blew through many models' VaR fences repeatedly, in clusters, on days the models said should almost never happen. VaR built on normal-distribution math tends to understate crash risk. Use it to set expectations for ordinary turbulence, not to bound the worst case — that job belongs to max drawdown and tail-risk thinking.

Example

The simplest version — parametric VaR — builds the number directly from the portfolio's volatility. The sketch:

VaR ≈ portfolio value × z × σ

  portfolio value = current dollar value
  σ               = standard deviation of returns over the horizon
                    (e.g., monthly σ for a 1-month VaR)
  z               = how many standard deviations the confidence level
                    pushes into the loss tail
                    z ≈ 1.65 at 95% confidence
                    z ≈ 2.33 at 99% confidence

Worked example (all numbers illustrative). Take a $500,000 portfolio of income ETFs — say a blend along the lines of SCHD, QQQI, and BND — with a monthly standard deviation of 2.5% (roughly 8.7% annualized, a moderate profile). The 1-month 95% VaR:

VaR(95%, 1 month) ≈ $500,000 × 1.65 × 0.025
                  ≈ $500,000 × 0.04125
                  ≈ $20,625  →  call it ~$20.6k

So the model says: about 19 months in 20, the portfolio's monthly loss stays under roughly $20,600. About 1 month in 20, it does not — and VaR alone says nothing about how much worse that month gets. That is where CVaR comes in. Under the same bell-curve assumptions, the numbers line up like this (same $500,000 portfolio, same 2.5% monthly σ, all illustrative):

Read the table in two directions. Across a row: at 95% confidence, the fence sits near $20,600, but the months that clear it average roughly $25,800 in losses — the tail is always worse than the fence. Down a column: moving from 95% to 99% confidence pushes the fence from about $20,600 to about $29,100, a reminder that the "rare" losses are not just slightly larger than the common ones. The tail widens as you look deeper into it — and that is under *friendly* bell-curve math. With real-world fat tails, the deep-tail numbers are typically worse than the table suggests.

The Three Flavors of VaR

The formula above is one of three standard ways to compute VaR, each with a one-sentence identity:

• Parametric (variance–covariance). Assume returns follow a known distribution (usually the bell curve) and read the loss quantile straight off the formula — fast and simple, but it inherits the bell curve's blindness to fat tails.
• Historical. Line up the portfolio's actual past returns, sort them worst-to-best, and take the loss at the 5th percentile as the 95% VaR — no distribution assumed, but it can only "see" crashes that already happened in your data window.
• Monte Carlo. Simulate thousands of possible future paths from a model of how the holdings behave and read the VaR off the simulated loss distribution — the most flexible flavor, and the same engine described in the companion article on Monte Carlo simulation.

All three answer the same question; they differ only in where the picture of "possible returns" comes from. When two sources quote different VaRs for the same portfolio, the flavor (and the data window) is usually why.

VaR's Blind Spot — and Why CVaR Exists

VaR has a famous, structural blind spot: it tells you the frequency of bad outcomes but nothing about their severity. A 95% VaR of $20,600 is satisfied equally well by a portfolio whose worst months lose $22,000 and by one whose worst months lose $80,000. Both stay under the fence 95% of the time. VaR literally cannot tell them apart, because it only marks where the tail begins — it never looks inside.

CVaR (expected shortfall) fixes exactly this. It averages the losses in the tail *beyond* the VaR fence: "given that this is one of the bad 5% of months, how much do I lose on average?" In the illustrative table above, the 95% CVaR of ~$25,800 is the average of all the worse-than-$20,600 outcomes. Two portfolios with identical VaR can have wildly different CVaRs — and the CVaR is the one that is honest about which portfolio's bad months are dangerous.

This is not academic. After 2008 exposed how badly VaR behaved in a crisis — losses beyond the fence were both more frequent and far larger than models implied — banking regulators moved the industry's market-risk standard from VaR to expected shortfall, precisely because CVaR pays attention to the depth of the tail rather than just its starting line. For an individual investor the lesson is the same at smaller scale: when you see a VaR, ask for the CVaR next to it. And because both are usually computed from models with thin tails, treat even CVaR as a floor for crisis math, not a ceiling — the deeper logic is covered in tail risk.

Common Mistakes

• Reading VaR as a maximum loss. It is the opposite: VaR is the loss you expect to *exceed* with a stated frequency (5% of the time at 95% confidence). The worst case lives beyond it, unmeasured — that is CVaR's and max drawdown's territory.
• Ignoring the horizon and confidence level. "$20,000 VaR" is meaningless alone. A 1-day 99% VaR and a 1-year 95% VaR of the same dollar amount describe utterly different portfolios. Never compare two VaRs without matching both settings.
• Trusting bell-curve VaR through a crisis. Parametric VaR assumes normal returns; real returns have fat tails. In 2008 and 2020, "once-in-decades" losses arrived in bunches. Treat model VaR as a fair-weather gauge and stress-test separately.
• Stopping at VaR without CVaR. Two portfolios with the same VaR can hide very different tails. If severity matters to you — and for anyone living on portfolio income, it does — the CVaR is the number that reveals it.
• Treating VaR as stable. VaR is estimated from a window of data. Measured across a calm stretch, it shrinks; add a crash to the window and it jumps. The portfolio's true risk did not change that day — the estimate did.
• Confusing dollar risk with income risk. VaR describes swings in portfolio *value*. A fund can post an ugly VaR month while its distributions continue on schedule — and vice versa. Judge income durability with tools like distribution coverage, not VaR.

FAQ

What does a 95% VaR actually mean?

A 1-month 95% VaR of $20,000 means the model expects your one-month loss to stay under $20,000 in 95% of months — and to exceed $20,000 in the other 5%, roughly one month in twenty. It is a frequency statement, not a severity statement: it tells you how *often* losses should clear that fence, but nothing about how far past it they go. Always read a VaR with its confidence level and horizon attached, because the same dollar figure means completely different things at different settings.

What is the difference between VaR and CVaR?

VaR marks where the bad tail *begins*; CVaR (expected shortfall) measures how bad the tail *is*. Formally, CVaR is the average of all losses worse than the VaR threshold — "given that this is one of the bad 5% of months, what's my average loss?" CVaR is always at least as large as VaR, and it distinguishes portfolios whose tails are merely unpleasant from those whose tails are catastrophic — a distinction identical VaRs cannot make, and the reason regulators shifted the industry standard toward expected shortfall after 2008.

Why did losses exceed VaR in 2008?

Three compounding reasons. First, most VaR models assumed returns follow a bell curve, but real markets have fat tails — extreme moves happen far more often than the normal distribution predicts. Second, the models were calibrated on recent, relatively calm data, so their volatility inputs were too low right when risk was peaking. Third, correlations spiked: assets that normally offset each other fell together, so diversification the models counted on evaporated. The result was losses beyond the VaR fence that were both more frequent and far deeper than the stated confidence implied — the case study behind tail risk.

Is a lower VaR always better?

No — a low VaR usually reflects low volatility, and low volatility is a trade-off, not a free win. A portfolio of short-term bonds has a tiny VaR and, typically, modest long-run returns; a growth-tilted income portfolio carries a bigger VaR alongside higher expected return and income growth. The useful question is whether the dollar risk is *appropriate for you* — sized against your cash cushion, withdrawal needs, and timeline — and whether you are being compensated for it, the same logic behind risk-adjusted measures like the Sharpe ratio.

What time horizon should I use for VaR?

Match the horizon to your decision. Trading desks use 1-day VaR because they can reposition daily; a long-term income investor gets more use from a 1-month or 1-year figure, since that is the scale on which they review a portfolio and fund withdrawals. Because volatility grows roughly with the square root of time, longer horizons produce larger VaRs from the same portfolio — one more reason never to compare VaR figures quoted over different horizons.

Does VaR say anything about my dividend income?

Not directly. VaR models fluctuations in portfolio *value*, while distributions are governed by what the underlying funds pay out — two related but distinct things. A covered-call fund can have a middling VaR yet variable distributions; a dividend-growth ETF's payments can keep rising straight through a month that breaches its VaR. Use VaR to plan for swings in account value (and what they mean if you must sell), and use payout-focused tools — distribution coverage and income stability — to judge the income stream itself.