Measuring risk: probability, VaR, CVaR and sensitivities

One cannot modify a risk without measuring it, and the main reason to measure is to check whether the risk being taken fits the tolerance set by governance.

Where does risk come from?

Use it

Risk drivers are the fundamental underlying factors that create risk. They sit at three levels: global and domestic macroeconomies (set partly by governments and central banks through taxes, regulation and monetary and fiscal policy), industries (some stable, some highly cyclical) and individual companies.

Risk management can control some of this but not all. A risk manager may reduce the chance that the company defaults, but cannot control interest rates. The aim is to position the company so that its exposure fits its tolerance. Idiosyncratic company risk can be diversified away by an investor, yet it still matters to company management and to poorly diversified investors. Something that looks unsystematic can turn out to be systematic: poor credit risk management at a bank that is too big to fail can become a global crisis.

Which measure fits which risk?

Use it

The metrics of risk are quantitative measures of exposure. No single one fits every asset.

Risk measuresmatch the measure to the source of risk

• General
  • Probability Use it how likely, not how large
  • Standard deviation Use it dispersion; weak with fat tails
• Asset-specific
  • Beta Use it equity sensitivity to the market
  • Duration Use it bond price sensitivity to rates (first order)
• Derivatives: the Greeks
  • Delta Use it price change per small move in the underlying (first order)
  • Gamma Use it change in delta; larger moves (second order)
  • Vega Use it sensitivity to the underlying's volatility
  • Rho Use it sensitivity to interest rates
• Tail measures
  • VaR Memorize minimum loss at a probability over a period
  • CVaR Memorize average loss beyond VaR
  • Expected loss given default Use it credit analog of CVaR
• What-if methods
  • Scenario analysis Use it a package of stress tests with a theme
  • Stress testing Use it extreme moves that could destabilize

Measure	What it captures	Note
Probability	How likely an outcome is	Objective (a die) or subjective (chance of a rate rise). Not enough alone: a 25% chance of loss does not say how big
Standard deviation	Dispersion of outcomes	In a normal distribution about 68% of outcomes lie within one standard deviation of the mean, about 95% within two and about 99% within three. Weak for non-normal distributions and fat tails
Beta	Sensitivity of returns to the market	The risk an asset adds to a well-diversified equity portfolio. Equity, not bonds
Duration	Sensitivity of a bond’s price to yields	First order, analogous to delta
Delta	Derivative price change for a small change in the underlying	First order. The most important derivatives measure
Gamma	How much delta changes	Second order. Captures larger moves
Vega	Derivative price change for a change in the underlying’s volatility	First order
Rho	Derivative price change for a change in interest rates	Usually small for options, except options on interest rates, where rates are the underlying

Derivatives are used to manage risk but they take on other risks. They are highly leveraged, so their risk must be measured with specialized tools.

Interest-rate and option sensitivities

For a small yield change, a bond’s price moves in the opposite direction by about duration times the yield change.

$$\%\Delta P \approx -D \times \Delta y$$

For a small move in the underlying, an option’s price changes by about delta times the move. Delta is limited to small moves because it changes as the underlying moves; gamma measures that change.

$$\Delta C \approx \delta \times \Delta S$$

How do you read a VaR?

Memorize

Value at risk (VaR) measures the size of the tail of the distribution of profits and losses. A VaR statement has three elements: an amount in currency, a time period and a probability.

A bank states a 5% one-day VaR of GBP 3 million. It expects to lose at least GBP 3 million on 5% of days, which is about one day in twenty.

The word minimum is the key. VaR says nothing about the maximum, which is the whole equity of the organization or the whole value of the portfolio. VaR is a minimum extreme loss.

$$N = T \times p$$

Move the confidence level and watch the shaded tail. Turn on fat tails and the 95% VaR stays about the same, but the CVaR, the average of the shaded area, moves out. That is the gap that VaR alone hides.

CVaR and expected loss given default

Conditional VaR (CVaR) is the weighted average of all the loss outcomes that exceed the VaR. It answers: “When we are in the tail, how bad is it on average?” Its credit analog is expected loss given default : if the borrower defaults, how much do we lose on average?

The limits of VaR

VaR is simple but controversial. It is accepted by most banking regulators, but:

• It rests on an assumed distribution and on inputs. If either is wrong the VaR is wrong, so it carries model risk. Real returns have more extreme negative outcomes than a normal distribution implies (tail risk).
• It can give a false sense of security: a tolerable-looking VaR may hide a bad tail.
• It says nothing about the maximum loss.

Two common-sense methods supplement it. Scenario analysis defines a set of conditions, such as a sharp rise in interest rates together with a fall in a currency, and evaluates the loss. It can be thought of as a package of stress tests with a common theme. Stress testing proposes specific, extreme price moves that would be rare but could destabilize the organization. Central banks now require major banks to stress test. Both are still exposed to model risk, but they ask the direct question: “If this happens, how are we affected?”

How do you measure credit and operational risk?

Know the idea

Market risk is the most measurable because there is plenty of data. Credit and operational events are rare for any one organization, which makes their probability hard to estimate. A firm that has never defaulted may still default.

• Credit risk. Lenders use credit ratings but also their own analysis of liquidity (current ratio), solvency (interest coverage), profitability (return on assets) and leverage (debt to assets). Measures include the probability of default, expected loss given default, credit VaR and the chance of a rating change. Because default is rare, risk managers pool companies with similar characteristics, and read the price of a credit default swap as a market-implied cost of default.
• Operational risk. Very hard to measure. A third party usually aggregates events across many companies and publishes the statistics.
• Changes in accounting rules, laws, tax rates and regulation. These are driven by politics, have no real numeric measure and are judged subjectively.

Go deeper Three ways to estimate VaR

There are several ways to estimate VaR, and they can give very different answers. The parametric method assumes a distribution, often the normal, and reads the tail from its standard deviation. The historical method ranks past returns and reads off the tail. Monte Carlo simulation generates many random outcomes from a model. Computing them is outside this module.

For a feel of the parametric method with a normal distribution and a mean of about zero, VaR ≈ z × σ × value. The 95% one-tailed z is 1.645, so for a USD 100 million portfolio with a daily standard deviation of 1.2%, the one-day VaR is 1.645 × 0.012 × 100,000,000 = USD 1,974,000. Scaling to ten days multiplies by the square root of 10, giving about USD 6.24 million.

One-day VaR, then ten days

TI BA II Plus HP 12C

1. 1.645×0.012×100000000= 1974000
2. ×10√x= 6242336

√x square root

1. 1.645ENTER0.012×100000000× 1974000
2. 10g√x× 6242336

ENTER enter (on the HP, puts the number on the stack) · g blue shift key · √x square root

Go deeper Sensitivity versus scenario, and why VaR is paired with stress tests

A sensitivity such as duration or delta moves one factor by a small amount and reports the change. A scenario moves several factors by a lot at the same time. After the financial crisis, risk managers and regulators paired VaR with stress tests because VaR said little about the extreme outcomes that actually hurt. Extreme value theory, long used in insurance, also studies the statistics of large tail outcomes.