Value at Risk (VaR) and expected shortfall, explained

By Daniel Tolenaar · Updated 1 November 2026

Value at Risk (VaR) is the loss a portfolio should not exceed over a set period, except with a small, chosen probability. A one-day 99% VaR of $32,000 means that on 99 days out of 100 the portfolio should lose less than $32,000, and on the remaining day it could lose more.

VaR became the standard risk number for banks in the 1990s, after J.P. Morgan published its RiskMetrics method in 1994. It answers “how bad is a bad day?” in a single currency amount. What it does not say is how bad the worst days get, which is what expected shortfall adds.

The definition

VaR has two settings: a confidence level (commonly 95% or 99%) and a horizon (commonly one day or ten). The 99% one-day VaR is the loss at the 1st percentile of the distribution of one-day profit and loss.

Three ways to calculate VaR

1. Historical simulation. Take the actual returns of the last few hundred days, apply them to today’s portfolio, and read off the 1st percentile. No distribution assumed.
2. Parametric (variance-covariance). Assume normal returns. Then VaR = −(μ + z·σ) × value, with z = −2.326 at 99%. Fast, but blind to fat tails.
3. Monte Carlo. Simulate thousands of scenarios from a model and read off the percentile, as in Monte Carlo option pricing. Handles options and non-linear positions.

This code computes the first two, and expected shortfall, for a $1,000,000 portfolio. The returns are simulated with fat tails (a Student t distribution), as real daily returns have:

import numpy as np
from statistics import NormalDist

rng = np.random.default_rng(seed=1)
value = 1_000_000                      # portfolio value in dollars
# 1,000 days of daily returns: mean 0.05%, volatility 1.2%, fat tails (Student t, 4 dof)
t = rng.standard_t(df=4, size=1000)
returns = 0.0005 + 0.012 * t / np.sqrt(4 / (4 - 2))

conf = 0.99
# 1. Historical VaR: the loss at the 1st percentile of past returns
hist_var = -np.percentile(returns, 100 * (1 - conf)) * value
# 2. Parametric (normal) VaR: mean and volatility only
mu, sd = returns.mean(), returns.std(ddof=1)
z = NormalDist().inv_cdf(1 - conf)
param_var = -(mu + z * sd) * value
# 3. Expected shortfall (CVaR): the average loss on the days beyond VaR
cutoff = np.percentile(returns, 100 * (1 - conf))
cvar = -returns[returns <= cutoff].mean() * value

print(f"1-day 99% historical VaR  = ${hist_var:,.0f}")
print(f"1-day 99% parametric VaR  = ${param_var:,.0f}")
print(f"1-day 99% expected shortfall (CVaR) = ${cvar:,.0f}")
print(f"10-day 99% VaR (square-root-of-time) = ${hist_var * np.sqrt(10):,.0f}")

1-day 99% historical VaR  = $32,321
1-day 99% parametric VaR  = $27,315
1-day 99% expected shortfall (CVaR) = $45,434
10-day 99% VaR (square-root-of-time) = $102,209

The normal assumption gives a VaR about 15% lower than the historical one, because it does not see the fat tail. That gap is typical of real markets and is the main criticism of parametric VaR.

Expected shortfall (CVaR)

Expected shortfall, also called conditional VaR (CVaR), is the average loss on the days that are worse than the VaR. In the example it is $45,434, against a VaR of $32,321: when a 1-in-100 day comes, the loss averages about 40% more than the VaR figure.

Expected shortfall looks into the tail instead of stopping at its edge, and unlike VaR it never rewards concentrating risk (it is “subadditive”). For these reasons the Basel Committee’s Fundamental Review of the Trading Book replaced 99% VaR with 97.5% expected shortfall for banks’ market-risk capital.

Scaling to longer horizons

If daily returns are independent, risk grows with the square root of time, so a 10-day VaR is about √10 ≈ 3.16 times the one-day VaR: $102,209 in the example. Real returns cluster in volatile spells, so this rule is a convenience, not a law.

What VaR does not tell you

• How big the loss is beyond the threshold: use expected shortfall.
• What happens in conditions the data never saw: use stress tests and scenarios.
• Risk-adjusted performance: that is the job of the Sharpe ratio.

VaR also depends on how the portfolio is built. The efficient frontier shows how diversification lowers volatility, and with it every one of these risk numbers.