CVaR / Expected Shortfall: Sizing the Losses That Live Beyond VaR

VaR at confidence α is a quantile: the smallest loss exceeded on only the worst (1−α) of days. It is a threshold, not an average — so it is structurally blind to everything beyond itself. The demonstration takes ten lines: two 1,000-day P&L histories that agree on 990 benign days and on the day that sets the 99% quantile, but whose ten worst days differ by a factor of six.

Identical VaR, 2.8× the expected tail loss. CVaR — the mean loss conditional on breaching the VaR quantile — separates the two books instantly, because it integrates over the tail instead of reading one point of it.

HYG (iShares high-yield corporate bond ETF) and VWO (Vanguard emerging-markets equity) are chosen deliberately: EM equity is honestly volatile, while credit is the classic smile-now-cry-later asset — a 11.2% annualised vol that looks safer than VWO's 27.1%, wrapped around a worst day of -8.10%. The aligned sample runs 2007-04-11 (HYG's listing) to 2024-12-31. A Student-t fitted to HYG's daily returns lands at ν ≈ 1.98 degrees of freedom — below 2, which means the fitted distribution does not possess a finite variance at all. Read that as a diagnostic as much as an estimate: an unconditional iid fit has nowhere to put 2008's volatility clustering except the tail parameter, so it buys realism at the extremes by overstating how wild a typical day is. (Condition on a GARCH filter and the residual df comes out higher; the unconditional fit is the honest worst case.)

The horizontal gap between the two dashed lines — 2.09% to 3.37% — is everything VaR does not price. For HYG that gap is 1.62× the VaR itself, the widest of the three books we measure.

The historical estimator reads the empirical distribution directly: sort, take the quantile, average beyond it. The parametric route fits a Student-t and uses Acerbi's closed-form expected shortfall — the analytic mean of the t's tail — which extrapolates severity even past the worst observed day:

def var_hist(x, a):
    return -np.quantile(x, 1 - a)

def cvar_hist(x, a):
    q = np.quantile(x, 1 - a)
    return -x[x <= q].mean()

def cvar_t(params, a):                    # Acerbi & Tasche closed form
    nu, loc, scale = params
    p = 1 - a
    xp = stats.t.ppf(p, nu)
    return -loc + scale * stats.t.pdf(xp, nu) * (nu + xp**2) / ((nu - 1) * p)

Note the FRTB calibration at work: HYG's 97.5% CVaR (2.29%) sits close to its 99% VaR (2.09%) — similar magnitude, but the CVaR number keeps growing when the tail does. The t-parametric CVaR (4.09%) exceeds the historical one because with ν ≈ 1.98 the fitted tail expects days worse than any yet observed. One caveat belongs next to every number in this table: at 99% the historical CVaR is the mean of just 45 observations. The estimator with the best theoretical properties is also the one standing on the fewest data points — which is the practical argument for fitting a parametric tail and letting it extrapolate, rather than trusting 45 draws to have already shown you the worst.

Read the first and fifth columns together. HYG's volatility is well under half of VWO's, yet its CVaR/VaR ratio of 1.62× is the highest in the table — credit's deceptively quiet variance hides the most disproportionate tail. Any tool that ranks these assets by σ alone has the risk ordering half wrong.

Artzner, Delbaen, Eber and Heath (1999) axiomatised what a risk measure should do; the axiom VaR fails is subadditivity: ρ(A+B) ≤ ρ(A) + ρ(B), i.e. diversification must never create risk. The classic counterexample needs only two independent bonds, each defaulting with probability 0.7%. Held alone, each has zero 99% VaR — a 0.7% loss probability hides entirely below the 1% threshold. A 50/50 mix loses on 1.4% of scenarios, which is above 1% — so the diversified book has strictly positive 99% VaR. Diversifying "created" risk, says VaR.

It is not just a parlour trick. On the full HYG/VWO sample the 50/50 portfolio behaves — 99% VaR of 3.26% against a weighted blend of 3.47%. But scan calendar-year subsamples across confidence levels and historical VaR breaks subadditivity 64 times; the worst case is 2009 at α = 98.8%, where the portfolio's VaR of 4.48% exceeds the blend's 3.95%. CVaR, by construction — Rockafellar & Uryasev's convex formulation makes this explicit — never violates: 4.92% for the portfolio versus 5.26% for the blend at 99%, and it passes at every year and level where VaR fails.

HYG's full-sample 99% VaR is 2.09%. Now watch the crisis ignore it: from September 2008 through March 2009, HYG breached that threshold on 24 of 146 trading days — a 1% tail arriving at 24× its expected frequency of ~1.5 days. The worst prints came fast: -8.10% on 2008-09-29, -6.67% on 2008-10-10, -6.01% on 2008-09-17 — every one of them multiples of the VaR line, in an ETF marketed as a bond fund.

At the trough a dollar invested at HYG's listing was worth $0.69. VaR answered "how often?" — and even that answer failed under regime change. CVaR at least asks the question that mattered in 2008: how bad is it when it happens?

With two assets, pure min-risk is degenerate here — volatility and tail agree that HYG is the quieter asset, and both rm="MV" and rm="CVaR" corner at 100% HYG. The measures diverge the moment you spend a risk budget. Hand two desks the same mandate — an expected loss on the worst 1% of days of at most 4% — and let each maximise return against it. The MV desk translates the budget into a volatility cap via normality (ES₉₉ = 2.665σ for a Gaussian, so σ ≤ 1.50% daily); the CVaR desk constrains the realised tail directly:

import riskfolio as rp

p_mv = rp.Portfolio(returns=rets[["HYG", "VWO"]])
p_mv.assets_stats(method_mu="hist", method_cov="hist")
p_mv.upperdev = 0.015                    # 4% ES budget, normal-translated
w_mv = p_mv.optimization(model="Classic", rm="MV", obj="MaxRet", hist=True)

p_cv = rp.Portfolio(returns=rets[["HYG", "VWO"]])
p_cv.assets_stats(method_mu="hist", method_cov="hist")
p_cv.alpha = 0.01
p_cv.upperCVaR = 0.04                      # the tail budget itself
w_cv = p_cv.optimization(model="Classic", rm="CVaR", obj="MaxRet", hist=True)

Same stated risk appetite, radically different books: 83.8% VWO through the variance lens versus 24.7% through the CVaR lens. Because both assets' tails are fatter than the Gaussian used in the translation, the MV desk's realised 99% CVaR of 6.37% overshoots its own 4% mandate by roughly 59% — the tail it was told to cap is exactly what its risk measure could not see.