VaR vs. CVaR: Which Risk Measure Should You Actually Use?

A Risk Measure That Ignores the Worst Outcomes

In 1999, a team of four mathematicians (Philippe Artzner, Freddy Delbaen, Jean-Marc Eber, and David Heath) published a paper that fundamentally changed how the finance profession thinks about risk measurement. Their argument, laid out in "Coherent Measures of Risk" in Mathematical Finance, was deceptively simple: the most widely used risk measure in the world, Value at Risk (VaR), has a mathematical flaw that can actively mislead risk managers. The measure they proposed as an alternative, Conditional Value at Risk (CVaR, also called Expected Shortfall), has since become central to banking regulation, portfolio optimization, and institutional risk management.

Understanding the difference between VaR and CVaR is not merely academic. It determines how institutions size positions, set capital reserves, and (critically) whether they underestimate the losses that matter most: the tail events that can destroy portfolios.

What VaR Tells You (and What It Hides)

Value at Risk answers a specific question: "What is the maximum loss I can expect at a given confidence level over a given time horizon?" A 95% daily VaR of $1 million means that, on 95% of trading days, the portfolio will lose no more than $1 million. Equivalently, on 5% of trading days (roughly once per month) losses will exceed $1 million.

VaR became the industry standard for risk measurement in the 1990s, largely through J.P. Morgan's RiskMetrics system. Its appeal was clarity: a single number that summarized the risk of an entire portfolio. Regulators adopted it, board members could understand it, and risk managers could compute it for complex multi-asset portfolios.

But VaR has a critical blind spot. It tells you nothing about what happens beyond the threshold. If your 95% VaR is $1 million, you know that losses will exceed this amount 5% of the time. But the losses on those 5% of days could be $1.1 million or $50 million; VaR does not distinguish between these scenarios. It tells you where the door to the tail is, but not how deep the room behind it goes.

This blind spot is not just theoretical. During the 2008 financial crisis, many institutions had risk systems reporting comfortable VaR numbers even as the actual tail losses were orders of magnitude larger. Their VaR models said "you might lose $X on a bad day," while the actual bad days delivered losses of 5X or 10X.

The Coherence Problem

Artzner et al. (1999) formalized the problem by defining four properties that any "coherent" risk measure should satisfy:

1. Translation invariance. Adding a risk-free asset to a portfolio should reduce measured risk by the amount of that asset. If you add $1 million in cash, risk should decrease by $1 million.

2. Subadditivity. The risk of a combined portfolio should be no greater than the sum of the risks of its parts. This is the diversification principle; combining positions should not increase risk. Mathematically: ρ(X + Y) ≤ ρ(X) + ρ(Y).

3. Positive homogeneity. Doubling a position should double the risk.

4. Monotonicity. If portfolio X always yields at least as much as portfolio Y, then X should have equal or lower risk.

VaR satisfies three of these properties but fails subadditivity. This failure is not a mathematical curiosity (it has practical consequences. Consider two traders, each holding a concentrated position. Trader A's 95% VaR is $1 million. Trader B's 95% VaR is $1 million. If the firm merges the two books, the combined 95% VaR can exceed $2 million) the sum of the parts. Diversification, the most fundamental principle of risk management, can appear to increase risk under VaR.

This happens because VaR only looks at a single quantile. Merging two portfolios can change the shape of the loss distribution beyond the VaR threshold in ways that push the threshold itself outward, even if the overall distribution has thinner tails. The measure is "blind" to the distribution's shape and only reports a single cut point.

CVaR: The Risk Beyond VaR

CVaR (also known as Expected Shortfall or Conditional Tail Expectation) asks a different question: "Given that losses exceed the VaR threshold, what is the expected loss?" If 95% VaR is $1 million, the 95% CVaR is the average of all losses on the worst 5% of days.

CVaR satisfies all four coherence axioms, including subadditivity. Merging two portfolios will never produce a CVaR that exceeds the sum of the individual CVaRs. Diversification always works under CVaR.

More importantly, CVaR captures the severity of tail losses, not just their frequency. Two portfolios can have identical VaR but vastly different CVaR:

Portfolio B has the same VaR as Portfolio A but more than three times the CVaR. A risk manager using only VaR would treat these portfolios as equally risky. A risk manager using CVaR would immediately flag Portfolio B as carrying substantially more tail risk.

The Optimization Breakthrough

Rockafellar and Uryasev (2000) contributed a second crucial advance: they showed that CVaR can be minimized using linear programming. This was a computational breakthrough because VaR minimization is a non-convex optimization problem; difficult to solve reliably, prone to multiple local minima, and computationally expensive for large portfolios.

CVaR minimization, by contrast, is a convex problem. It has a unique global solution, can be solved efficiently even for portfolios with thousands of positions, and integrates naturally into mean-risk portfolio optimization frameworks. Rockafellar and Uryasev demonstrated that minimizing CVaR simultaneously provides a bound on VaR, so a CVaR-optimal portfolio is also VaR-controlled.

This result removed the last practical objection to adopting CVaR. Before Rockafellar and Uryasev, critics could argue that even if CVaR was theoretically superior, VaR was computationally easier to work with. After their paper, CVaR became both theoretically and computationally preferred.

Where VaR Still Has Advantages

Despite its theoretical shortcomings, VaR retains several practical advantages that explain its continued dominance in parts of the industry.

Backtesting. VaR is straightforward to backtest: count the number of times losses exceed the VaR estimate and check whether this frequency matches the specified confidence level. If a 99% VaR is exceeded more than 1% of the time, the model is underfitting. This binary test is simple, intuitive, and easy to automate. CVaR backtesting is harder because it requires estimating the average magnitude of tail losses, not just their frequency. This requires larger samples and more complex statistical procedures.

Regulatory familiarity. Although Basel III's Fundamental Review of the Trading Book (FRTB) shifted regulatory capital requirements toward Expected Shortfall (CVaR) in 2019, many internal risk systems still report VaR, and the transition is ongoing. Historical VaR databases spanning decades exist at most large institutions, making comparisons and trend analysis straightforward.

Communication. "Our 95% VaR is $10 million" is easier for non-technical stakeholders to understand than "Our 95% CVaR is $15 million." VaR provides a clear threshold; CVaR provides an expected value conditional on exceeding that threshold, which requires more statistical literacy to interpret.

Model risk. CVaR's sensitivity to the far tail means it is more affected by estimation error in the tail of the distribution. If you misestimate the shape of the tail (a common problem with limited data) your CVaR estimate can be significantly wrong. VaR, because it depends only on a single quantile, is somewhat more robust to tail misestimation (though it pays for this robustness by ignoring tail severity entirely).

The Regulatory Shift: From VaR to Expected Shortfall

The Basel Committee on Banking Supervision's adoption of Expected Shortfall (the regulatory term for CVaR at the 97.5% confidence level) in the FRTB framework represents the most significant validation of Artzner et al.'s theoretical contribution. The regulatory shift was motivated by precisely the coherence concerns the paper identified.

Under the old framework (Basel II/II.5), banks computed 99% VaR for market risk capital. This allowed institutions to construct portfolios that satisfied VaR constraints while carrying significant hidden tail risk; a practice sometimes called "VaR arbitrage." A trader could sell deep out-of-the-money options that generated small, consistent premiums (invisible to VaR) but carried catastrophic loss potential in rare events.

The switch to 97.5% Expected Shortfall directly addresses this problem. Selling deep out-of-the-money options dramatically increases CVaR because the measure captures the expected loss in the tail, including the scenarios where those options are exercised. The arbitrage opportunity disappears.

Practical Decision Framework

For practitioners choosing between VaR and CVaR, the decision depends on the specific use case:

The strongest case for CVaR arises when the portfolio contains nonlinear instruments (options, structured products), when the return distribution has fat tails (commodities, emerging markets, crypto), or when the portfolio is complex enough that subadditivity matters (multi-desk, multi-asset class risk aggregation).

Computing VaR and CVaR in Practice

Both measures can be estimated using three main approaches, each with trade-offs:

Historical simulation. Sort past returns, identify the relevant quantile (VaR) or average beyond that quantile (CVaR). Simple and model-free, but limited by the historical sample. If the sample period does not include tail events, both VaR and CVaR will be underestimated.

Parametric (variance-covariance). Assume a distribution (typically normal or Student-t) and compute VaR and CVaR analytically. Fast and elegant, but only as good as the distributional assumption. Under normality, 95% CVaR is approximately 1.28x the 95% VaR. Under fat-tailed distributions, the ratio can be 2x or higher.

Monte Carlo simulation. Generate thousands of random scenarios from a fitted model, then compute VaR and CVaR from the simulated distribution. Most flexible (can handle nonlinear instruments, non-normal distributions, and complex dependencies) but computationally expensive.

When the CVaR-to-VaR ratio is close to 1.28, the return distribution is approximately normal and VaR is adequate. As the ratio rises above 2.0, the tails are fat enough that relying on VaR alone is dangerous; the losses beyond the VaR threshold are much worse than VaR implies.

What Neither Measure Captures

Both VaR and CVaR share important limitations that no single risk measure can overcome.

Liquidity risk. Both measures assume that positions can be liquidated at market prices. During crises, bid-ask spreads widen, market depth evaporates, and actual liquidation proceeds can be far worse than model prices suggest. Liquidity-adjusted VaR and CVaR variants exist but add significant model complexity.

Correlation breakdown. Both measures rely on estimated correlations or copulas to model multi-asset portfolios. During crises, correlations spike toward 1.0, reducing diversification benefits precisely when they are needed most. Neither VaR nor CVaR inherently accounts for this regime-dependent correlation behavior.

Model risk. Any risk measure is only as good as the model behind it. Misspecified distributions, incorrect correlation structures, or insufficient data can cause both VaR and CVaR to understate true risk. CVaR is more sensitive to tail misestimation; VaR is more sensitive to the choice of confidence level.

The appropriate response is not to choose one measure over the other, but to use both alongside stress testing, scenario analysis, and qualitative judgment. No quantitative risk measure substitutes for understanding the economic mechanisms that generate tail losses.

Where the Evidence Stands

Artzner et al. (1999) established that VaR is not a coherent risk measure and that its failure of subadditivity can mislead risk management. Rockafellar and Uryasev (2000) showed that CVaR can be efficiently optimized, removing the computational barrier to adoption. Together, these papers shifted both academic thinking and regulatory practice toward Expected Shortfall.

The practical reality is that both measures remain essential. VaR provides a simple, well-understood threshold that is easy to compute, backtest, and communicate. CVaR provides the tail-aware complement that captures what VaR misses. The choice between them depends less on which is "better" in the abstract and more on the specific portfolio, instrument complexity, and decision context.

For retail investors, the distinction matters most when evaluating products with nonlinear payoffs (options strategies, structured notes, leveraged ETFs) where VaR can dramatically understate the risk of rare but severe losses. For institutional risk managers, the post-FRTB regulatory environment has largely settled the debate in favor of Expected Shortfall as the primary risk measure, with VaR retained for backtesting and historical comparison.