Lesson 4 · Portfolio ManagementCFA L1

Portfolio Risk Management

Standard deviation and beta measure risk symmetrically and are hard to translate into "how much could I lose?" Value at risk (VaR) answers exactly that — a single, communicable loss threshold. This lesson covers VaR's definition and the three ways to compute it (historical simulation, the parametric normal method, Monte Carlo), how a factor model slashes the estimation burden, why the normal assumption understates crashes, and the tools that go beyond VaR: expected shortfall, backtesting and stress testing.

On this page

Types of risk Value at risk Historical simulation Parametric method VaR under a factor model Beyond normal Backtesting Expected shortfall & control

Finance faces many risks — market (price moves), credit (defaults), operational (failed processes/errors), liquidity (asset: can't trade quickly; funding: can't raise cash for obligations), and regulatory. This lesson focuses on market risk in a portfolio.

Learning outcomes

Define VaR and convert between percentage, dollar, and multi-horizon VaR.
Compute VaR by historical simulation, the parametric normal method, and Monte Carlo.
Use a single-index model to estimate the covariance structure efficiently.
Explain why the normal assumption fails and list the stylised facts of returns.
Backtest VaR and apply expected shortfall, stress testing and risk-control limits.

Why VaR — and the types of risk

Standard deviation and beta measure risk symmetrically and have no simple financial reading — they don't tell you how much capital to set aside, nor focus on the losses we intuitively call "risk". VaR summarises risk in one interpretable, communicable number tied to potential loss. Among the risk types above, this lesson targets market risk; the same VaR machinery is, however, applied across credit and other risks in practice.

Value at risk (VaR)

An industry standard since J.P. Morgan's 1994 RiskMetrics, VaR is a loss threshold a portfolio should not exceed over a time horizon at a confidence level. A "30-day 95% VaR of $V\%$" means: there is a 95% chance the portfolio will not lose more than $V\%$ over the next 30 days. Statistically, the %-VaR is the negative of the $(100-\alpha)$ percentile of the return distribution, reported as a positive loss magnitude.

Dollar VaR and horizon scaling

$$ \text{Dollar VaR}=\text{\%-VaR}\times\text{notional}, \qquad \text{$N$-day VaR}=\text{1-day VaR}\times\sqrt{N} $$

The $\sqrt{N}$ rule is exact only for i.i.d. zero-mean normal daily returns — otherwise an approximation.

Historical simulation

"History repeats itself": treat each past daily return as a future scenario and read VaR off the percentile of historical portfolio returns. Procedure: pick a data window; compute each asset's daily returns; compute the portfolio return each day (constant weights); take the $(100-\alpha)$ percentile (Excel percentile); scale by $\sqrt{N}$; multiply by notional for dollars. Pros: no distributional assumption, transparent, grounded in real events. Cons: no guidance on window length (and results are sensitive to it), purely backward-looking, and limited to what has happened — it cannot foresee a first-time "black swan."

The parametric (normal) method

Assume a distribution and read off its theoretical percentile. For the normal, any weighted average of normals is normal, so a portfolio of normal assets is normal. With portfolio mean $\mu$ and s.d. $\sigma$:

Parametric VaR

$$ \text{\%-VaR}=-\big(\mu+z(\alpha)\,\sigma\big), \qquad z(95)=-1.645,\ z(97.5)=-1.960,\ z(99)=-2.326 $$

Worked example

Two-asset VaR

Asset A: daily $\mu=0.05\%,\sigma=1.3\%$; B: $0.08\%, 2\%$; $\rho=0.7$; weights 40% A / 60% B. Find the 1-day and 10-day 95% VaR.

Show solution

$\mu_p=0.4(0.05\%)+0.6(0.08\%)=0.068\%$. $\sigma_p=\sqrt{0.4^2(1.3\%)^2+2(0.4)(0.6)(0.7)(1.3\%)(2\%)+0.6^2(2\%)^2}=1.607\%$. 1-day 95% VaR $=-[0.068\%+(-1.645)(1.607\%)]=\textbf{2.576%}$. 10-day $=2.576\%\times\sqrt{10}=\textbf{8.147%}$.

1-day 95% VaR = 2.576%; 10-day = 8.147%

VaR under a single-index model

For $n$ assets, the portfolio s.d. needs every pairwise covariance — $n(n-1)/2$ estimates (124,750 for 500 stocks!). A single-index model collapses this. For a well-diversified portfolio $\sigma_p\approx\beta_p\sigma_M$; and even otherwise, covariances simplify to $\operatorname{Cov}(r_i,r_j)=\beta_i\beta_j\sigma_M^2$ — so 500 stocks need just 501 estimates (500 betas + the market variance) instead of 124,750.

Worked example

Portfolio VaR via SIM

Well-diversified A ($\mu=0.05\%,\beta=0.5$), B ($0.12\%,1.6$), C ($0.08\%,1.1$); benchmark daily s.d. 0.95%; weights 30/20/50. Find the 30-day 99% VaR.

Show solution

$\mu_p=0.3(0.05)+0.2(0.12)+0.5(0.08)=0.079\%$; $\beta_p=0.3(0.5)+0.2(1.6)+0.5(1.1)=1.02$; $\sigma_p\approx1.02\times0.95\%=0.969\%$. 1-day 99% VaR $=-[0.079\%-2.326(0.969\%)]=2.175\%$; 30-day $=2.175\%\times\sqrt{30}=\textbf{11.9%}$.

βp=1.02, σp=0.969%; 30-day 99% VaR = 11.9%

Beyond the normal assumption

The normal is a poor model of crashes: under it, the Dow's −25.6% on 19 Oct 1987 should occur once in $\sim10^{15}$ years. Its tails are simply too thin. Real returns show three stylised facts: negative skewness (big drops more common than big rises), excess kurtosis (fat tails — extreme moves too frequent), and volatility clustering (big moves follow big moves). Remedies: heavy-tailed distributions (Student-$t$, extreme-value), or time-varying-volatility models such as RiskMetrics' EWMA: $\sigma_t^2=\lambda\sigma_{t-1}^2+(1-\lambda)r_{t-1}^2$.

Monte Carlo simulation

Fix a statistical model, generate many simulated return scenarios, compute portfolio returns, and read VaR from their percentile. It is a hybrid: like the parametric method it needs a model, but like historical simulation it reads VaR off observed (here, simulated) data. It handles many assets and sophisticated models — at the cost of computation and a "black-box" feel.

Backtesting

Backtesting checks the VaR procedure: count the fraction of days the actual loss breached the VaR. For a good 95% VaR, breaches should be $\approx5\%$ — too many means the VaR is too lenient; too few means it is too conservative (tying up capital needlessly). Compute breaches over a window, avoiding lookahead bias (don't use data on/after the estimation day). One example — 95% VaR on an S&P 500 ETF over 2018–2020 via historical simulation — produced almost 8% breaches, well above the expected 5%.

Expected shortfall, stress testing and risk control

VaR's weaknesses: it says nothing about how bad losses are once breached, is hard to aggregate across books, and is very methodology-sensitive. Expected shortfall (ES / CVaR) fixes the first — the average loss given a breach:

Expected shortfall

$$ \text{ES}=-\,E\big[r \mid r\le -\text{VaR}\big] \;\ge\; \text{VaR} $$

ES is always at least VaR, and much larger when tails are heavy and skewed. Whereas VaR and ES are statistical measures, stress testing is a "what-if": project losses under extreme scenarios (all global equities −30%, a +5% parallel yield-curve shift, option vol +100%, or historical events like 2008/COVID) without assigning probabilities. Finally, risk control uses limits: risk budgeting (set total risk, then allocate it across strategies), position limits (caps on notional/market value), scenario limits (caps on a scenario's loss), and stop-loss limits (cut exposure once losses pass a threshold).

Key takeaway

VaR states the worst loss at a confidence level over a horizon — computed by historical simulation (no assumptions, backward-looking), the parametric normal method ($\text{VaR}=-(\mu+z(\alpha)\sigma)$, scaled by $\sqrt{N}$), or Monte Carlo; a factor model makes the covariance estimation tractable ($\beta_i\beta_j\sigma_M^2$). But the normal assumption understates crashes — returns are skewed, fat-tailed and cluster — so VaR is backtested and supplemented by expected shortfall (the loss beyond VaR), stress tests (probability-free what-ifs), and hard risk limits.

Saved in your browser — your progress bars update automatically.