How Banks Measure Market Risk | VaR, Expected Shortfall & Backtesting

Quick answer: banks measure market risk by asking how a portfolio could change when interest rates, credit spreads, equity prices, foreign-exchange rates, commodity prices and volatilities move. Value at Risk (VaR) estimates a loss threshold at a chosen confidence level. Expected Shortfall (ES) goes further and asks how large losses are, on average, once the model has entered the tail beyond that threshold. Backtesting compares model predictions with realised or hypothetical trading outcomes. Stress testing deliberately leaves the comfortable centre of the distribution and asks what happens under severe scenarios.

VaR tells us where the tail begins. Expected Shortfall asks how deep the tail is.

Why this is a mathematics problem

Market-risk measurement brings together probability distributions, quantiles, conditional expectation, covariance, simulation, nonlinear pricing and statistical testing. The important lesson is not that one formula produces “the risk.” The important lesson is that different mathematical objects answer different questions.

This connects directly to A Probability of 70% Does Not Promise Seven Successes Out of the Next Ten. A 99% risk threshold does not promise that the next 99 trading days will be safe. It is a statement about a modelled distribution, horizon and confidence level.

1. Value at Risk is a quantile

Let L represent portfolio loss over a specified horizon. At confidence level α, VaR is the α-quantile of the loss distribution. Informally, VaR_α is a threshold such that losses are expected to exceed it only in the remaining tail probability 1−α, subject to the model and data used.

If one-day 99% VaR is S$10 million, the model is not saying the maximum possible loss is S$10 million. It is saying that S$10 million is approximately the 99th-percentile loss threshold under the assumptions. The most dangerous misunderstanding is to confuse “rarely exceeded” with “cannot be exceeded.”

2. Expected Shortfall looks beyond the threshold

Expected Shortfall asks for the average loss in the tail beyond the VaR threshold. In a continuous distribution, a simplified expression is ES_α = E[L | L ≥ VaR_α]. The exact mathematical treatment needs care when distributions have jumps or repeated values, but the intuition is stable: ES measures tail severity, not just the point where the tail begins.

Suppose five severe simulated losses are S$12m, S$14m, S$18m, S$25m and S$31m, and these observations form the relevant tail. The threshold might begin around S$12m, while the average of those losses is S$20m. The two numbers answer different questions.

3. Why modern market-risk regulation moved toward Expected Shortfall

The Basel Committee’s fundamental review of the trading book shifted the internal-model capital framework from a 99% VaR measure toward 97.5% Expected Shortfall for modellable market risk. The reason is conceptual as much as regulatory: ES is more sensitive to the size of losses inside the tail. The Basel framework also incorporates different liquidity horizons so that a risk factor that takes longer to exit or hedge can attract a longer assumed horizon.

See the Basel Committee market-risk standard and the Basel market-risk terminology.

4. Backtesting asks whether the model meets the world

A risk model becomes useful only when it can be contradicted by observations. Basel backtesting compares one-day VaR measures with actual and hypothetical profit-and-loss outcomes. At bank-wide level the framework uses 99th-percentile VaR; at trading-desk level it examines both 97.5th- and 99th-percentile VaR over at least a year of observations. An exception occurs when the observed loss exceeds the modelled VaR threshold.

This may look odd at first: capital measurement can use Expected Shortfall while backtesting still uses VaR. The reason is that backtesting needs a clear exceedance event that can be counted repeatedly. The model therefore has several layers: one measure for tail severity, another test for whether quantile coverage behaves as claimed, and further profit-and-loss attribution tests for whether the risk representation matches the trading desk.

See Basel MAR32 on backtesting and P&L attribution.

5. Three common ways to generate the loss distribution

Method	Basic idea	Main weakness
Historical simulation	Revalue today’s portfolio under observed historical market moves	History may omit the next regime
Parametric / variance-covariance	Approximate returns with a distribution and covariance structure	Normality and linearity can understate tails and options
Monte Carlo simulation	Generate many scenarios from a stochastic model and revalue the portfolio	Outputs inherit model, calibration and computational assumptions

None is automatically “best.” Historical simulation carries observed relationships but is bounded by the history selected. Parametric methods are fast and transparent but can oversimplify. Monte Carlo is flexible but can create false confidence if the simulation model is elegant and wrong.

6. A simplified algorithmic pipeline

Inventory positions. Identify instruments, currencies, maturities, options and hedges.
Map risk factors. Link each position to rates, spreads, prices, volatilities and correlations that can move its value.
Collect and clean market data. Align timestamps, remove bad observations carefully and preserve economically important stress episodes.
Choose the scenario engine. Historical, parametric, Monte Carlo or a combination.
Revalue the portfolio. For nonlinear instruments, full repricing is often more reliable than a first-order approximation.
Construct the loss distribution. Sort simulated or historical P&L outcomes.
Calculate VaR and ES. Extract the chosen quantile and tail average.
Apply liquidity-horizon logic. Recognise that not every position can be exited at the same speed under stress.
Run prescribed and internal stress scenarios. Add events that may be poorly represented in the statistical sample.
Backtest. Compare model thresholds with realised or hypothetical P&L.
Diagnose exceptions. Determine whether a break came from data, missing risk factors, pricing, regime change or ordinary statistical variation.
Update or constrain the model. A model that repeatedly fails must not be defended merely because it once passed.

7. Stress testing is not “VaR with a scarier number”

Statistical risk measures estimate a distribution from a chosen model and dataset. Stress testing can deliberately impose scenarios outside the comfortable statistical centre: a sharp yield-curve twist, simultaneous equity and credit-spread shock, volatility jump, currency dislocation or evaporation of market liquidity.

A good stress scenario therefore has a different purpose. It asks whether the portfolio contains structural weak points that a probability model can hide. This is the same logical reason one counterexample can be enough to weaken an overconfident claim.

8. Correlation is most dangerous when it is treated as permanent

A diversified portfolio may look safe because risk factors historically moved imperfectly together. In stress, correlations can change. Assets that appeared to offset one another can fall together, while hedges can become less effective because basis relationships move.

This is one reason a covariance matrix should never be treated as a law of nature. It is an estimate from a particular sample. A useful diagnostic is to re-run the model with stressed correlations or without selected diversification benefits and observe how much of the apparent safety disappears.

9. Options make linear risk approximations fragile

For a small move, a portfolio may be approximated with sensitivities such as delta, duration or DV01. But option values also depend on curvature and volatility. As markets move, the sensitivities themselves change. A model built only from first derivatives can therefore miss nonlinear loss.

This links directly to How Banks Measure Interest-Rate Risk: Duration, Convexity and Scenario Shocks. Duration is a local approximation; market-risk models must decide when local approximations are no longer adequate.

10. Failure modes

Thin tails in the model. A Gaussian assumption can produce too few extreme losses for assets with fat-tailed behaviour.
Regime blindness. A calm calibration window can make risk appear structurally smaller.
Stale or asynchronous prices. Apparent low volatility may come from poor data rather than low risk.
Missing risk factors. A position may depend on volatility, basis or optionality not represented by the model.
Liquidity blindness. Mark-to-market loss can be smaller than the loss incurred while actually exiting a large position.
Correlation instability. Diversification assumed in normal periods may vanish in stress.
Modelled hedge failure. The hedge may track the exposure imperfectly when markets dislocate.
Aggregation masking. A moderate bank-wide number can conceal a concentrated trading-desk weakness.

11. Diagnostics and falsifiers

How many VaR exceptions occurred, and are they clustered?
Does ES rise sharply when stress periods are added to the calibration sample?
Which risk factor contributes most to the tail?
What happens if historically favourable correlations are removed?
Does full repricing disagree with sensitivity-based approximation?
Which positions cannot realistically be exited within the assumed horizon?
Would a volatility shock change option exposures faster than the hedge can adjust?
Does the same model explain both calm and stressed periods?
Which missing observation would reverse the model’s conclusion?

Suppose someone claims, “The portfolio’s 99% VaR is only S$5 million, so a larger daily loss is practically impossible.” A single observed S$20 million loss does not automatically prove the whole model is invalid—rare tail events are expected—but repeated or structurally unexplained exceptions can falsify the claim that the model provides the stated coverage under its current assumptions.

12. Verification and update triggers

reconcile positions to front-office and accounting records;
independently validate pricing and risk sensitivities;
compare historical, parametric and simulation outputs;
track VaR exceptions and P&L attribution results;
repeat stress tests after major portfolio changes;
update models when volatility, liquidity or correlation regimes change;
review new instruments before forcing them into old risk-factor mappings;
challenge any model whose accuracy appears to improve only after troublesome data are removed.

Connections across the finance-and-banking algorithms lane

Yield-curve algorithms — market-risk scenarios often begin by moving the curves used to price cash flows.
Bank capital models — where risk measurement becomes a regulatory constraint.
Interest-rate risk — a related but distinct banking-book problem.
A Formula Can Be Correct and Still Be the Wrong Model — the governing caution behind every statistical risk number.

Research anchors

The deeper lesson

Market-risk mathematics is strongest when the model remains answerable to outcomes. VaR compresses a distribution into a threshold. Expected Shortfall opens the tail again. Backtesting asks whether predicted coverage survives contact with realised P&L. Stress testing asks whether the distribution itself may be the wrong map. The sequence matters: measure, challenge, observe, revise.

Educational note: This article explains mathematical and public regulatory concepts. It is not investment advice, trading advice, a recommendation regarding any financial instrument, or institution-specific regulatory guidance.

Small Group Tutorials

How Banks Measure Market Risk: Value at Risk, Expected Shortfall, Backtesting and Stress Scenarios