Value at risk and expected shortfall
Value at risk gives one number for a bad outcome: the loss that was reached or passed in the worst few years. Expected shortfall adds the average of those worst years. This lesson computes both from 97 years of real S&P 500 returns, compares them with a normal curve, and shows what the numbers hide. A calculator changes the amount, the confidence level and the length of history, and shows how Morgan Stanley reports the measure and how a model change at JPMorgan halved a reported figure in 2012.
- Level
- Beginner
- Reading time
- About 26 minutes
- Know this first
- Risk and return
By the end you will be able to:
- compute value at risk and expected shortfall from a list of returns
- say what a 95% confidence level does and does not promise
- compare the historical method with a normal curve and see where the curve is wrong
- explain why expected shortfall can differ between portfolios with the same value at risk
- describe how banks report the measure and why regulators moved to expected shortfall
One number for a bad year
A risk manager is often asked a simple question: how much could we lose? The honest answer is that it depends on how bad “bad” is allowed to be. If the answer is “anything”, the loss is the whole amount invested. Value at risk, usually shortened to VaR, picks a cut-off. It is the loss that was reached or passed in only a small share of the periods, such as the worst one year in twenty. The share is set by the confidence level: a 95% VaR looks at the worst 5% of outcomes.
The lesson on risk and return measured spread with the standard deviation, which treats a big gain and a big loss alike. VaR looks only at the loss side, and at one place on it. This lesson computes it from 97 years of real annual returns of the S&P 500, adds a second measure that looks inside the bad tail, and shows where each can mislead.
Value at risk from a list of returns
The historical method needs no formula for the shape of returns. Take the returns that actually happened, sort them from worst to best, and decide how many belong in the tail. With n years and a tail share of 5%, the tail holds n × 5% years, rounded up to a whole year. The value at risk is the loss in the last year of the tail, which is the mildest of the tail years. Every year in the tail lost at least that much.
For the 97 years from 1928 to 2024, 5% of 97 is 4.85, so the tail is the five worst years. Here they are, with the loss on $100,000 invested at the start of each year.
| Year | S&P 500 return | Loss on $100,000, $ |
|---|---|---|
| 1931 | −43.84% | 43,840 |
| 2008 | −36.55% | 36,550 |
| 1937 | −35.34% | 35,340 |
| 1974 | −25.90% | 25,900 |
| 1930 | −25.12% | 25,120 |
| Average of the five (expected shortfall) | 33,350 |
The fifth worst year, 1930, lost 25.12%. On $100,000 that is $25,120, so the 95% value at risk is $25,120. In the sample, all five years in the tail lost at least that much. Read in words: in about one year in twenty, history shows a loss of $25,000 or more on each $100,000. It does not say that the loss stops there, and the next section shows what that leaves out.
Expected shortfall: inside the tail
Value at risk marks the edge of the tail and says nothing about how far the bad years go beyond it. Expected shortfall, also called conditional value at risk, answers the next question: given that the loss reached the cut-off, what was the average loss? It is the average of the tail years. In the table above the five losses average $33,350 on $100,000, against a VaR of $25,120.
The difference matters when two portfolios share the same VaR. Take two invented portfolios observed over 100 years, with a tail of the five worst years each.
| Worst year, ranked | Portfolio X, $ thousand | Portfolio Y, $ thousand |
|---|---|---|
| 1 | 28 | 100 |
| 2 | 27 | 80 |
| 3 | 26 | 60 |
| 4 | 25 | 40 |
| 5 | 25 | 25 |
| Value at risk (fifth worst) | 25 | 25 |
| Expected shortfall (average of five) | 26.2 | 61.0 |
Both have a value at risk of $25 thousand, because the fifth worst year lost the same amount. Portfolio X’s other bad years are close to that figure. Portfolio Y’s are far worse, and one lost $100 thousand. Value at risk cannot tell them apart. The expected shortfall can: $26.2 thousand for X against $61.0 thousand for Y.
The normal-curve shortcut
When there is little history, a common shortcut assumes returns follow a bell-shaped normal curve with the same average and spread as the data. Then value at risk follows from a formula. The z-value is how many standard deviations below the average the cut-off sits.
| Confidence level | Share of years in the tail | Z-value |
|---|---|---|
| 90% | 10% | 1.2816 |
| 95% | 5% | 1.6449 |
| 99% | 1% | 2.3263 |
For the 97 years the average return is 11.79% and the standard deviation is 19.50%. At 95% confidence the loss at the cut-off is 1.6449 × 19.50% − 11.79%, about 20.27%, so the curve gives a value at risk of $20,273 on $100,000. The data gave $25,120. The curve understates the tail by $4,847, because real stock returns have more very bad years than a bell curve allows. The lab below shows that this is not true at every confidence level.
How banks and regulators use it
A bank’s trading desks buy and sell every day, so banks measure value at risk over one day rather than one year. Morgan Stanley’s quarterly supplement reports its “Trading VaR (Average Daily 95% / One-Day VaR)” for Institutional Securities: $59 million for the quarter ended 30 September 2025, $50 million for the one ended 30 June 2025 and $46 million a year earlier. By the definition of the measure, the model expects the trading book to lose at least that much on about one trading day in twenty.
A reported VaR is only as good as the model behind it. In the first quarter of 2012 JPMorgan’s Chief Investment Office changed the model it used to calculate VaR. According to a Congressional Research Service report, the replacement model projected an extreme daily loss of up to $67 million, while the older model showed the unit at risk of losing as much as $129 million a day, nearly twice as much. JPMorgan’s management task force later said that errors in model implementation contributed to a further lowering of VaR and that the previous model was reinstated. The unit lost $1.6 billion in the first quarter of 2012 and $4.4 billion in the second. A VaR figure does not cause losses, but the episode shows that two models can give very different answers for the same positions.
Regulators have also moved. A Basel Committee explanatory note describes a 97.5% expected shortfall as the average of the worst 2.5% of losses, and says it is roughly equivalent to the 99th percentile value at risk used earlier in Basel 2.5. In January 2016 the Bank for International Settlements announced a shift from value-at-risk to an expected shortfall measure of risk under stress, which it said would help to ensure prudent capture of tail risk.
Compute it yourself
Set the amount invested, the confidence level, and how many of the most recent years to use. The calculator sorts the real S&P 500 returns, counts the tail, and shows the value at risk and expected shortfall, then repeats the calculation with a normal curve that has the same average and spread.
On $100,000 held for one year, using the 97 years from 1928 to 2024, the 5 worst years each lost at least $25,120, which is the value at risk at 95% confidence. The average loss in those 5 years, the expected shortfall, was $33,350. A normal curve with the same average and spread gives $20,273 and $28,416. The worst year, 1931, lost $43,840.
Four experiments. First, leave the settings alone: $100,000, 95% confidence and all 97 years. The tail is 5 years, the value at risk is $25,120 and the expected shortfall is $33,350. The normal curve gives $20,273 and $28,416, so it understates both. The worst year, 1931, lost $43,840. Second, raise the confidence level to 99%. The tail shrinks to one year, so the value at risk is the single worst year, $43,840, and the expected shortfall is the same figure. A 99% figure from 97 years rests on one observation. The curve gives $33,557 and $40,170, well below it. Third, return to 95% and cut the history to 30 years, which is 1995 to 2024. The tail is now 2 years, the value at risk falls to $21,970 and the expected shortfall to $29,260. The curve gives $17,431. The Great Depression is outside the window, so the same market looks safer. Fourth, return to 97 years and lower the confidence to 90%. The tail is 10 years. The value at risk is $11,850, and the normal curve gives $13,191, which is now higher than the data. The expected shortfall is $24,569 against $22,417 from the curve. At 90% the curve is above the data on value at risk and below it on expected shortfall, so it is not simply too gentle.
How to read the numbers
A value at risk is a statement about how often, not about how much. It says that losses at least this large were reached in a given share of the periods, and nothing about the biggest loss. Expected shortfall adds an average for the tail but still says little about the worst single outcome. Read both together with the length and the dates of the history behind them, since the third experiment shows that a different window gives a different answer. Treat a very high confidence level with suspicion when the sample is small, because the second experiment shows it resting on one year. The lesson on diversification shows why a portfolio’s tail depends on how its parts move together, and the lesson on sensitivity and scenario analysis covers the other approach, in which the analyst chooses a bad case and computes its effect directly.
What this lesson leaves out
- One year, one index. The data are annual total returns of the S&P 500 including dividends. Banks use daily data on many positions, and the daily and yearly numbers are not interchangeable.
- The past is the only input. The historical method assumes the next period is drawn from the same history. A different window, as in the third experiment, gives a different answer.
- Small samples. With 97 years the 5% tail holds five observations and the 1% tail one. Estimates built on so few points move a lot when one year is added or dropped.
- The cut-off, not the worst case. No value at risk limits the loss. Losses beyond it are expected in the tail share of periods.
- A simple normal curve. The shortcut ignores the shape of real returns. It is shown here to compare with the data, not as a method to rely on.
- No fees, tax or inflation. The returns are before fees and tax and are not adjusted for prices.
- No advice. The lesson shows how a risk measure is computed. It does not recommend an investment or a limit.
Common mistakes
Reading the value at risk as the most that can be lost
It is the cut-off of the tail. The worst year in the data lost $43,840 on $100,000, against a 95% value at risk of $25,120.
Quoting a very high confidence level from a short record
At 99% the 97-year record gives a tail of one year. The number is that year, and it may be far from what a longer record would show.
Ignoring which years are in the window
The last 30 years leave out the 1930s, and their value at risk is lower. A figure without its dates cannot be compared with another.
Treating the normal curve as the truth
It understated the 95% and 99% figures and overstated the 90% one. Its error is not in a single direction.
Comparing two portfolios by value at risk alone
Portfolios X and Y had the same figure and very different tails. Look at the expected shortfall as well.
Try it yourself
1. The five worst years in the table lost 43.84%, 36.55%, 35.34%, 25.90% and 25.12%. What is the 95% value at risk on $100,000?
Show the working
The tail holds the five worst years and the value at risk is the loss in the mildest of them, 25.12%. On $100,000 that is $25,120.
2. Using the same five years, what is the expected shortfall on $100,000?
Show the working
(43.84 + 36.55 + 35.34 + 25.90 + 25.12) ÷ 5 = 33.35%, which is $33,350 on $100,000.
3. Portfolios X and Y both have a value at risk of $25 thousand. Which has the larger expected shortfall, and by how much?
Show the working
Y does. Its five worst losses average (100 + 80 + 60 + 40 + 25) ÷ 5 = $61.0 thousand, against (28 + 27 + 26 + 25 + 25) ÷ 5 = $26.2 thousand for X, which is $34.8 thousand more.
4. Returns have an average of 11.79% and a standard deviation of 19.50%, and z is 1.6449 at 95% confidence. What value at risk does the normal curve give on $100,000?
Show the working
1.6449 × 19.50% − 11.79% = 20.27%, so the curve gives about $20,273 on $100,000.
5. A record has 60 years. How many years are in the tail at 95% confidence, and at 99%?
Show the working
5% of 60 is 3, so the tail holds 3 years. 1% of 60 is 0.6, rounded up to 1, so the 99% figure is a single year.
Where this is used
- A bank’s risk team reports a one-day value at risk for each trading desk and sets limits against it.
- A regulator sets capital for trading books from a tail measure, which has moved from value at risk to expected shortfall.
- A fund compares the tail risk of two portfolios beyond their standard deviations.
- A model reviewer checks whether two models give very different answers for the same positions, as in the JPMorgan episode.
- An investor reads a stated value at risk together with the sample dates and the confidence level.
Key terms
- Value at risk
- The loss reached or passed in a stated small share of periods.
- Expected shortfall
- The average loss across the periods in the tail.
- Confidence level
- The share of periods that fall short of the cut-off, such as 95%.
- Tail
- The worst few outcomes beyond the cut-off.
- Historical method
- Computing a risk measure from the returns that actually occurred.
- Z-value
- The number of standard deviations below the average at which a normal curve reaches the cut-off.
- Horizon
- The period over which the loss is measured, such as one day or one year.
- Standard deviation
- A measure of how widely returns spread around their average.
Questions people ask
Does a 95% value at risk of $25,120 mean the most I can lose is $25,120?
No. It means that in the worst 5% of the years the loss was at least that large. The worst year in the data lost $43,840 on the same $100,000.
Why do regulators prefer expected shortfall?
It averages the tail, so a portfolio with severe losses beyond the cut-off shows a higher figure than one with mild losses. The Bank for International Settlements said the shift would help to capture tail risk.
Can a yearly figure be turned into a daily one?
This lesson does not convert between them. A yearly record of 97 points and a daily record of thousands use different data and horizons, so each is computed on its own.
Is a bigger sample always better?
It gives more tail observations, but it may include periods unlike today. The third experiment shows how much the window can matter.
Sources and review
- Aswath Damodaran, NYU Stern, Historical returns on stocks, bonds and bills: 1928-2024 (last updated 5 January 2026), for the annual returns of the S&P 500 including dividends for 1928 to 2024. The page names its data source as multiple data services.
- Aswath Damodaran, NYU Stern, Annual returns on stock, T.bonds and T.bills: 1928 - current (last updated 5 January 2019), an older edition of the same dataset, used to check the 1928 to 2018 values.
- Morgan Stanley, Third quarter 2025 earnings results, quarterly financial supplement, page 5, Institutional Securities, for the line “Trading VaR (Average Daily 95% / One-Day VaR)” of $59 million, $50 million and $46 million for the quarters ended 30 September 2025, 30 June 2025 and 30 September 2024.
- Congressional Research Service, JP Morgan Trading Losses: Implications for the Volcker Rule and Other Regulation (Report R42665, 16 August 2012), for the change in the Chief Investment Office’s VaR model in the first quarter of 2012, the figures of $67 million and $129 million a day, and the losses of $1.6 billion and $4.4 billion in the first and second quarters of 2012.
- JPMorgan Chase & Co., management task force update on the Chief Investment Office (Form 8-K, Exhibit 99.3, 13 July 2012), for the statement that errors in model implementation contributed to a further lowering of VaR and that the previous model was reinstated.
- Basel Committee on Banking Supervision, Explanatory note on the minimum capital requirements for market risk (published with the revised standard of January 2019), for the description of a 97.5% expected shortfall as the average of the worst 2.5% of losses and its rough equivalence to the 99th percentile value at risk used in Basel 2.5; and the Bank for International Settlements, press release of 14 January 2016, for the shift from value-at-risk to an expected shortfall measure.
How the numbers were checked: the annual returns for 1928 to 1999 were re-entered from the 2026 edition of the source and compared with the 2019 edition, which agrees for every year from 1928 to 2018, and the 2000 to 2024 values match those used in the lesson on risk and return. The value at risk, the expected shortfall, the normal-curve figures and the four experiments were recomputed in plain code, and the calculator, which runs separately, was compared with that code for every combination of settings it allows. The z-values were computed with the inverse of the standard normal distribution in Python and rounded to four places. The bank figures are quoted from the cited documents.