Skip to main content
Policy Authority
Category: Risk Analysis and Quantification

Value at Risk

Also known as: VaR, VAR, Value-at-Risk
Simply put

Value at Risk (VaR) is a statistical measure that estimates how much a portfolio of investments might lose over a set period of time, expressed with a given probability or confidence level. For example, it can indicate the potential loss that is not expected to be exceeded most of the time under normal conditions. It does not describe how large losses could become in the rare cases where that threshold is breached.

Formal definition

Value at Risk (VaR) is a summary statistic that quantifies the potential loss of a financial entity or portfolio over a specified time horizon at a specified probability (confidence) level. It is commonly expressed as a monetary amount representing a loss threshold that, according to the chosen model and assumptions, is not expected to be exceeded with the stated probability. VaR characterizes losses up to that confidence level but does not, by construction, measure the magnitude of losses beyond it (tail losses); complementary measures are typically used for that purpose. VaR estimates depend heavily on modeling choices, assumptions, and input data, and this entry does not cover specific calculation methods, parameter selection, or implementation.

Why it matters

Value at Risk (VaR) became a widely adopted summary statistic because it condenses the potential loss of a portfolio or financial entity into a single monetary figure tied to a specified time horizon and confidence level. This makes it a convenient common language for communicating market risk to boards, risk committees, and management, and for comparing risk across desks, portfolios, or business lines. Within a risk management context, VaR supports functions such as risk limit setting, capital allocation, and internal reporting on the level of financial risk within a firm.

Its principal limitation is equally important for governance and risk professionals to understand. By construction, VaR characterizes losses only up to the chosen confidence level; it does not measure how large losses could become in the rare cases where that threshold is breached. Relying on VaR as if it captured worst-case or tail losses is a common misuse. Because estimates depend heavily on modeling choices, assumptions, and input data, two firms measuring the same exposures can produce materially different VaR figures.

For these reasons, VaR is typically treated as one input among several rather than a complete picture of risk. Risk functions commonly pair it with complementary measures designed to describe losses beyond the VaR threshold, and with stress testing and scenario analysis, so that decision-makers are not lulled into treating a single number as an assurance against extreme outcomes.

Who it's relevant to

Risk managers
Risk managers use VaR as a summary measure of the level of financial risk within a portfolio or firm over a specified horizon, often to inform risk limits and internal reporting. They are also responsible for recognizing its limitations, including that it does not measure tail losses, and for pairing it with complementary measures and stress testing.
Governance bodies and risk committees
Boards, risk committees, and senior management receive VaR as part of risk reporting because it condenses potential loss into a single, comparable figure. Those exercising oversight should understand that VaR reflects model choices and assumptions and does not describe worst-case outcomes, so it should not be treated as a standalone assurance of risk coverage.
Internal auditors and assurance functions
Assurance functions may review how VaR is produced, governed, and used, focusing on the appropriateness of modeling choices, assumptions, and input data rather than performing the risk measurement themselves. Their interest lies in whether the reliance placed on VaR is proportionate to its known limitations, maintaining a clear distinction between assurance over the measure and the management activity of calculating it.

Inside VaR

Confidence Level
The probability threshold at which the potential loss is estimated, commonly expressed as 95% or 99%. It defines how much of the loss distribution's tail is excluded from the estimate.
Time Horizon
The period over which the potential loss is measured, such as one day or ten days. The appropriate horizon typically depends on the liquidity of positions and the intended use of the measure.
Loss Threshold (VaR Estimate)
The monetary or percentage loss value that is not expected to be exceeded over the chosen horizon at the chosen confidence level, under normal market conditions.
Calculation Methodologies
Common approaches include the historical simulation method, the variance-covariance (parametric) method, and Monte Carlo simulation. Each relies on different assumptions about how returns are distributed and can produce differing estimates.
Underlying Distributional Assumptions
VaR estimates depend on assumptions about the distribution of returns and the historical or modeled data used. These assumptions materially affect the resulting figure.

Common questions

Answers to the questions practitioners most commonly ask about VaR.

Does Value at Risk (VaR) represent the maximum possible loss a portfolio can suffer?
No. VaR does not measure the maximum possible loss. It estimates a loss threshold that is not expected to be exceeded over a specified time horizon at a given confidence level. By construction, losses beyond the VaR figure can and do occur in the tail of the distribution; VaR is silent on how large those exceedances may be. For that reason it is commonly paired with complementary measures, such as expected shortfall (also called conditional VaR), that describe the magnitude of losses beyond the VaR threshold.
If a model reports a 99% one-day VaR, does that mean the stated loss will occur only once in a very long period and can otherwise be ignored?
Not quite. A 99% one-day VaR indicates that, under the model's assumptions, losses are not expected to exceed the stated amount on approximately 99% of days, implying exceedances on roughly 1% of days over time. This is a statistical expectation, not a guarantee, and it depends heavily on the modelling method, the data window, and the assumption that observed relationships hold. It does not imply that exceedances are rare enough to disregard, nor does it describe how severe an exceedance might be.
What inputs and choices does a VaR calculation typically require?
A VaR estimate typically requires selecting a confidence level, a time horizon, a portfolio composition and valuation approach, and a method of estimation. Common methods include the historical simulation, variance-covariance (parametric), and Monte Carlo simulation approaches, each with different assumptions about how returns are distributed. The choice of historical data window and the treatment of correlations between positions can materially affect the result. This entry does not prescribe specific parameter values, as appropriate settings vary by institution, portfolio, and applicable regulatory context.
How is VaR commonly validated after it is produced?
VaR outputs are commonly assessed through backtesting, which compares predicted VaR thresholds against actual realized outcomes over a period and counts how often losses exceeded the estimate. The observed exceedance rate can be compared against the rate implied by the chosen confidence level. Backtesting supports, but does not by itself confirm, model adequacy; supervisory expectations for backtesting differ across jurisdictions and sectors. This entry does not cover specific statistical test procedures or regulatory thresholds.
Who is typically responsible for producing, reviewing, and challenging VaR figures?
Responsibilities are often distributed across lines of accountability. In many organizations, risk-taking or business functions and a market or model risk function within management produce and use VaR figures, while an independent model validation or risk oversight function reviews methodology and assumptions. Assurance functions, such as internal audit, may separately evaluate the governance and controls around the VaR process without owning the calculation itself. Maintaining this separation preserves the independence of review and challenge. Specific role allocations depend on organizational structure and applicable governance frameworks.
What are the practical limitations to keep in mind when relying on VaR?
VaR is generally limited by its dependence on model assumptions and on historical data that may not capture future conditions, particularly during periods of stress or structural change. It typically does not describe losses beyond its threshold, may understate risk when correlations shift, and can behave differently across estimation methods. Because of these limitations, VaR is commonly used alongside stress testing, scenario analysis, and tail-risk measures rather than as a standalone indicator. This entry does not provide implementation guidance, tooling recommendations, or legal or regulatory advice.

Common misconceptions

VaR represents the maximum possible loss a portfolio can suffer.
VaR estimates a loss threshold that is not expected to be exceeded at a given confidence level under normal conditions; it says little about the magnitude of losses in the tail beyond that threshold, which can be substantially larger.
A single VaR number provides a complete picture of an organization's risk.
VaR is one measure among many and typically reflects normal market conditions. It may understate risk during stressed or illiquid periods, so it is commonly complemented by stress testing and other measures such as tail-focused metrics.
VaR results are objective and comparable regardless of how they are produced.
Because different methodologies and distributional assumptions can yield materially different estimates, comparability requires disclosure of the confidence level, time horizon, and calculation method used.

Best practices

Clearly document and disclose the confidence level, time horizon, and calculation methodology accompanying any reported VaR figure to support interpretation and comparability.
Complement VaR with stress testing and scenario analysis to address tail risk and conditions that VaR under normal-market assumptions may not capture.
Validate and back-test VaR models regularly, comparing predicted thresholds against realized outcomes to assess model performance.
Assess the appropriateness of the chosen time horizon against the liquidity of positions and the intended use of the measure.
Recognize and communicate the limitations of the underlying distributional assumptions, particularly during periods of market stress or reduced liquidity.
Maintain independent review of VaR models and their assumptions, keeping model development and validation appropriately segregated to preserve objectivity.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide