Value at risk (VaR) vs CVaR: definitions, formulas and an example
On this page
Key takeaways
- Monthly VaR at 95% answers: in the worst one month out of twenty, the loss was at least how large? CVaR at 95% answers: in those worst months, what was the average loss?
- Historical VaR reads the threshold straight from past returns; parametric VaR assumes a normal distribution and uses the mean minus 1.645 standard deviations. The two differ whenever returns have fat tails or skew.
- Two portfolios can share the same VaR and have very different tails, because VaR ignores everything beyond its threshold. CVaR does not.
- CVaR is a coherent risk measure: the CVaR of a combined portfolio is never above the sum of its parts' CVaRs. VaR can break that rule, which is why regulators and risk theory moved toward expected shortfall.
- MarketHeist reports historical monthly VaR at 95% and 99% and CVaR at 95%, computed from the sorted monthly returns of the whole window, with no distribution assumed.
Definition
Value at risk (VaR) is the loss threshold that a portfolio's return falls below only in a chosen small share of periods, such as the worst 5% of months. Conditional value at risk (CVaR), also called expected shortfall, is the average return in those worst periods, so it measures how bad the tail is rather than only where it starts.
Also known as: VaR, CVaR, expected shortfall, ES, conditional VaR, historical VaR, parametric VaR, tail risk.
How it works
Sort a portfolio's monthly returns from the lowest to the highest. With 400 months, the worst 5% are the worst 20 months, and the historical 95% VaR is the return at that boundary; MarketHeist takes the 21st worst month, and other conventions differ by a place or interpolate. The 99% VaR is read the same way at the 1% boundary. Nothing is assumed about the shape of the distribution; the past months are taken as they were.
Parametric, or normal, VaR takes a shortcut. It assumes returns follow a bell curve, measures the mean and the standard deviation, and puts the 95% threshold 1.645 standard deviations below the mean. The formula is simple and smooth, but real returns have more extreme months than a bell curve allows, so it can misjudge where the tail starts and says nothing about how far it goes.
CVaR, or expected shortfall, looks past the threshold. It is the average of all the months at or beyond VaR. If the worst months were only slightly worse than the VaR, CVaR sits close to it; if a few months were disasters, CVaR moves far below it.
VaR is like a flood-plain map that marks the line the water crosses once a century, without saying how deep it gets past the line. CVaR is the average depth of the water on the days it does cross.
VaR was popularised by J.P. Morgan's RiskMetrics in 1994 and became the standard bank risk number. In 1999 Artzner, Delbaen, Eber and Heath set out the properties a sound risk measure has; VaR fails one of them, subadditivity, because combining two positions can produce a VaR larger than the sum of their VaRs. CVaR satisfies all of them, and Rockafellar and Uryasev showed in 2000 that it can be minimized with linear programming.
Formula
- VaR_α
- value at risk at confidence α, written as a return (negative = loss)
- α
- confidence level, 0.95 or 0.99
- N
- number of monthly returns in the window
- r₍ₖ₎
- the k-th smallest monthly return (r₍₁₎ is the worst month)
- ⌊x⌋
- x rounded down to a whole number
With N = 400 and α = 0.95 this is r₍₂₁₎, the 21st worst month. Some texts interpolate between neighbouring months or take r₍⌈(1 − α)N⌉₎; the differences are small in long samples.
- CVaR_α
- conditional value at risk: the average return of the months at or below VaR
- K
- the set of months whose return is at or below VaR_α
- |K|
- number of such months
- rₜ
- return in month t
- r̄
- mean monthly return
- s
- standard deviation of monthly returns
- z_α
- the standard normal quantile for confidence α
Exact only if returns are normally distributed. Fat tails push the true 99% loss well beyond this figure.
- X, Y
- the returns of two positions, in money terms
- CVaR_α(·)
- CVaR written as a return, so a larger (less negative) value is less risk
Subadditivity, stated for measures written as returns: the combined position's tail is never worse than the sum of the separate tails, so diversification never looks harmful. The same inequality can fail for VaR.
Worked example
US real estate investment trusts (VNQ) and the S&P 500 (SPY), 364 monthly returns from Jun 1996 to Sep 2026.
At 95% confidence the two look alike. VNQ's historical monthly VaR was -7.7% and SPY's -7.4%: in the worst twentieth of months, each returned that or worse.
Past that threshold they part ways. CVaR, the average of the months at or beyond the 95% VaR, was -12.9% for VNQ and -9.6% for SPY. The 99% VaR was -19.4% against -10.7%, and VNQ's worst month, -31.7% in Oct 2008, was close to twice SPY's worst, -16.5%. A risk report that showed only the 95% VaR would have rated the two as equally risky.
The normal-distribution shortcut errs in both directions here. It put SPY's 95% VaR at -6.3%, milder than the -7.4% that actually happened, and VNQ's at -8.5%, beyond its historical -7.7%: a bell curve fitted to VNQ's mean and standard deviation spreads its risk evenly, while VNQ's actual damage was concentrated in a handful of extreme months.
Each of these figures is a monthly number. VNQ had positive or flat returns in 61.0% of months and SPY in 64.3%, and both counts of months at or below the 95% VaR, 19 and 19, are about one in twenty of 364, as the definition requires.
Data through Sep 2026. Reproduce id b8a478f9c57fec7a (this guide, its lab setup and the data month).
Interactive lab
The distribution of monthly returns for both picks over the same months, with the historical VaR, the CVaR and the normal-distribution VaR marked. Switch the confidence level or the portfolios.
| Measure | VNQ | SPY |
|---|---|---|
| Months in the window | 364 | 364 |
| Historical VaR 95% | -7.7% | -7.4% |
| Historical CVaR 95% | -12.9% | -9.6% |
| Historical VaR 99% | -19.4% | -10.7% |
| Historical CVaR 99% | -23.6% | -13.5% |
| Normal VaR 95% | -8.5% | -6.3% |
| Normal VaR 99% | -12.3% | -9.3% |
| Worst month | -31.7% (Oct 2008) | -16.5% (Oct 2008) |
| Positive months | 61% | 64% |
| Months at or below VaR 95% | 19 | 19 |
Historical VaR 95% is the 5th percentile month and 99% the 1st; CVaR is the average of the months at or below the VaR. Normal VaR is the mean minus 1.645 (95%) or 2.326 (99%) standard deviations. Positive months: a return of zero or more. A negative number is a loss. Jun 1996 to Sep 2026.
How MarketHeist computes it
Every choice an implementation has to make, as the code makes it today. The page is checked against the code each time it is built.
| Choice | How it is computed | In the code |
|---|---|---|
| Data | Monthly total returns (dividends reinvested). Funds younger than the period shown are extended backward with older funds, spliced on returns, not prices. | |
| Window | The worked example and the lab use the common window of the two portfolios compared, Jun 1996 to Sep 2026 (364 months), ending at the data month of this page. Another pick in the lab is read over its own common window. | |
| Portfolio streams | A fund is its proxy-extended monthly return stream. A built-in portfolio is read as the MarketHeist MCP reads it: its composed stream with its own rebalancing rule and overlay. A custom mix is rebalanced yearly. | |
| Historical VaR and CVaR | The monthly returns of the window are sorted. VaR is the return at position floor(p x N): the 5th percentile month for 95% and the 1st for 99%. CVaR is the average of the months at or below the VaR. The normal approximation is the mean minus 1.645 (95%) or 2.326 (99%) sample standard deviations. | |
| Returns | Monthly total returns of the portfolio over the common window (dividends reinvested, portfolios simulated with their own rebalancing rule). One month is the horizon of every figure. | simulatePortfoliopackages/portfolio/engine/portfolio.ts |
| Historical VaR | The returns are sorted from lowest to highest and VaR at 95% is the return at position ⌊0.05 · N⌋ counting from zero (the ⌊0.05 · N⌋ + 1-th worst month); VaR at 99% uses ⌊0.01 · N⌋. No interpolation and no distribution assumed. Reported as a return, so a loss is negative. | tailRiskpackages/portfolio/engine/metrics_extra.ts |
| CVaR | The mean of every month whose return is at or below the 95% VaR, the VaR month included. Ties at the threshold are all included, so the set can hold slightly more than 5% of months. | tailRiskpackages/portfolio/engine/metrics_extra.ts |
| Normal VaR (lab only) | Mean monthly return minus 1.645 (95%) or 2.326 (99%) sample standard deviations of the same months. Shown on this page for contrast; the app and the MCP report only the historical figures. | |
| Positive months | Share of months with a return of zero or more. | tailRiskpackages/portfolio/engine/metrics_extra.ts |
| Horizon | Monthly only. A monthly VaR does not scale to a yearly one by multiplying by √12 unless returns are independent and normal, which the sample above shows they are not; nor is it a daily figure of the kind banks report. | |
| Engine functions | The functions the portfolio app and the MarketHeist MCP tools run, called here on the same monthly returns. | tailRiskpackages/portfolio/engine/metrics_extra.ts |
Value at risk (VaR) and conditional value at risk (CVaR) compared with its neighbours
| Measure | What it answers | Sees beyond the threshold | Assumes a distribution | Coherent |
|---|---|---|---|---|
| Historical VaR | The loss exceeded in the worst x% of periods | No | No | No |
| Normal (parametric) VaR | The same, if returns were normal | No | Yes, normal | No in general |
| CVaR (expected shortfall) | The average loss in the worst x% of periods | Yes, averages the whole tail | No (historical version) | Yes |
| Worst month | The single largest monthly loss | Only its last point | No | Yes, but rests on one observation |
| Volatility | Typical size of monthly swings, both directions | No | No | Not a tail measure |
| Maximum drawdown | The deepest fall from a peak over the whole period | Over many months at once | No | Not a one-period measure |
Limitations
- Historical VaR and CVaR assume the past months are a fair sample of the future ones. A window with no crash in it reports a mild tail.
- At 99% the estimates rest on a handful of months: with a few hundred months of data, the 99% VaR is set by the four or five worst, so one new crash can move it a lot.
- These are one-month figures. Losses over several months, such as a slow bear market, are better described by maximum drawdown.
- VaR is not subadditive, so adding up the VaRs of holdings does not bound the portfolio's VaR, and a portfolio optimized on VaR can hide risk just beyond the threshold.
- Long histories are extended backward with older funds or indexes where a fund is younger than the window, so early months approximate the fund rather than reproduce it.
Frequently asked questions
- What is the difference between VaR and CVaR?
- VaR is a threshold: the return that only the worst slice of months fell below. CVaR is the average of the months in that slice. VaR says where the tail starts; CVaR says how bad it is on average.
- Historical VaR vs CVaR for a portfolio: which is better?
- They answer different questions, but CVaR captures what VaR misses. Two portfolios with the same VaR can have very different average losses in their worst months, and only CVaR shows that. CVaR is also coherent, so it behaves sensibly when positions are combined.
- What is the difference between historical and parametric VaR?
- Historical VaR reads the threshold from the actual sorted returns. Parametric VaR assumes a distribution, usually normal, and computes the threshold from the mean and standard deviation. With fat-tailed returns the normal version tends to understate losses at high confidence.
- Is expected shortfall the same as CVaR?
- For continuous distributions, yes; the names are used interchangeably. Some texts distinguish them for discrete samples, depending on how ties at the threshold are handled.
- Why do banks use expected shortfall instead of VaR now?
- Because VaR ignores the size of losses beyond the threshold and is not subadditive. The Basel Committee's 2016 market-risk framework replaced VaR with expected shortfall for regulatory capital.
References
- J.P. Morgan (1994) RiskMetrics Technical Document. The methodology that popularised VaR (fourth edition 1996).
- Artzner, P., Delbaen, F., Eber, J.-M. and Heath, D. (1999) Coherent Measures of Risk. Mathematical Finance 9(3). The axioms; VaR is not subadditive.
- Rockafellar, R. T. and Uryasev, S. (2000) Optimization of Conditional Value-at-Risk. Journal of Risk 2(3). CVaR and its minimization by linear programming.
- Acerbi, C. and Tasche, D. (2002) On the Coherence of Expected Shortfall. Journal of Banking and Finance 26(7).
- Basel Committee on Banking Supervision (2016) Minimum Capital Requirements for Market Risk. Moves regulatory market-risk capital from VaR to expected shortfall.
Try it on your own holdings
Open the 60/40 portfolio and see its monthly VaR and CVaR →
Or ask an assistant connected to the MarketHeist MCP server (https://marketheist.io/mcp), which computes the same figures:
Using MarketHeist.io, what are the monthly 95% VaR and CVaR and the worst month of a portfolio of 50% VTI, 30% VNQ and 20% BND?Ask an AI assistant
The prompt opens in a new tab, already filled in. An assistant without the MarketHeist connector answers from its own knowledge, not from the figures on this page.
Historical simulation, not advice. Computed by the MarketHeist portfolio engine from monthly total returns, data through Sep 2026. Markdown version of this page: value-at-risk.md.