CVaR / Expected Shortfall: Sizing the Losses That Live Beyond VaR

VaR at confidence α is a quantile: the smallest loss exceeded on only the worst (1−α) of days. Read that definition again and notice what it does not say — nothing about how much you lose on those days. VaR is a threshold, not an average, so it is structurally blind to everything beyond itself. A ten-line thought experiment makes the blindness concrete: build two 1,000-day P&L histories that agree on 990 benign days and on the day that sets the 99% quantile, but whose ten worst days differ by a factor of six.

Both books report a 99% VaR of 2.40%, so a risk report built on VaR alone calls them equally risky. Yet book A's CVaR is 2.60%against book B's 7.26%, with worst days of −2.60% and −15.00% — identical VaR, 2.8× the expected tail loss. CVaR — the mean loss conditional on breaching the VaR quantile — separates the two books instantly, because it averages over the whole tail instead of reading one point at its edge.

Now the real thing. HYG (iShares high-yield corporate bond ETF) and VWO (Vanguard emerging-markets equity) are chosen because they are risky in opposite ways. EM equity is honestly volatile — it looks risky and it is. Credit is the trap: it collects small, steady coupons in calm markets and hands them back all at once in a crisis. On paper HYG's 11.2%annualised vol looks far safer than VWO's 27.1% — until you notice that the quiet series hides a worst day of -8.10%. The aligned sample runs 2007-04-11 (HYG's listing) to 2024-12-31. A Student-t fitted to HYG's daily returns lands at ν ≈ 1.98 degrees of freedom — below 2, which means the fitted distribution does not even possess a finite variance. Read that as a diagnostic as much as an estimate: an unconditional iid fit has nowhere to put 2008's volatility clustering except the tail parameter, so it buys realism at the extremes by overstating how wild a typical day is. (Condition on a GARCH filter and the residual df comes out higher; the unconditional fit is the honest worst case.)

The horizontal gap between the two dashed lines — 2.09% to 3.37% — is everything VaR does not price, and HYG's gap is the widest of the three books we measure.

Estimating CVaR comes down to two philosophies. The historical estimator trusts the data: sort, take the quantile, average everything beyond it. The parametric route trusts the model: fit a Student-t and use Acerbi's closed-form expected shortfall — the analytic mean of the t's tail — which can extrapolate to days worse than anything the sample has actually seen:

def var_hist(x, a):
    return -np.quantile(x, 1 - a)

def cvar_hist(x, a):
    q = np.quantile(x, 1 - a)
    return -x[x <= q].mean()

def cvar_t(params, a):                    # Acerbi & Tasche closed form
    nu, loc, scale = params
    p = 1 - a
    xp = stats.t.ppf(p, nu)
    return -loc + scale * stats.t.pdf(xp, nu) * (nu + xp**2) / ((nu - 1) * p)

Three things to read off that table:

• The FRTB calibration at work — HYG's 97.5% CVaR (2.29%) sits close to its 99% VaR (2.09%): similar magnitude, but the CVaR number keeps growing when the tail does.
• The t extrapolates past the sample — its CVaR (4.09%) exceeds the historical one because with ν ≈ 1.98 the fitted tail expects days worse than any yet observed.
• The small-sample caveat — at 99% the historical CVaR is the mean of just 45 observations. The estimator with the best theoretical properties stands on the fewest data points, which is the practical argument for fitting a parametric tail and letting it extrapolate.

Read the first and fifth columns together. HYG's volatility is well under half of VWO's, yet its CVaR/VaR ratio of 1.62× is the highest in the table — credit's deceptively quiet variance hides the most disproportionate tail. Any tool that ranks these assets by σ alone has the risk ordering half wrong.

In 1999, Artzner, Delbaen, Eber and Heath wrote down four axioms any sane risk measure should satisfy. VaR fails one — and it is the one your intuition cares most about: subadditivity, ρ(A+B) ≤ ρ(A) + ρ(B), the rule that diversification must never create risk. The classic counterexample needs only two independent bonds, each defaulting with probability 0.7%. Held alone, each has zero 99% VaR: a 0.7% loss probability hides entirely below the 1% threshold, so VaR literally cannot see it. Mix them 50/50 and the book loses on 1.4% of scenarios — above 1% — so the diversified book has strictly positive99% VaR. Diversifying “created” risk, says VaR. The risk was there all along, of course. VaR was hiding it.

It is not just a parlour trick. On the full HYG/VWO sample the 50/50 portfolio behaves — 99% VaR of 3.26% against a weighted blend of 3.47%. But scan calendar-year subsamples across confidence levels and historical VaR breaks subadditivity 64 times; the worst case is 2009 at α = 98.8%, where the portfolio's VaR of 4.48% exceeds the blend's 3.95%. CVaR, by construction — Rockafellar & Uryasev's convex formulation makes this explicit — never violates: 4.92% for the portfolio versus 5.26% for the blend at 99%, and it passes at every year and level where VaR fails.

HYG's full-sample 99% VaR is 2.09%. Now watch the crisis ignore it: from September 2008 through March 2009, HYG breached that threshold on 24 of 146 trading days — a 1% tail arriving at 24× its expected frequency of ~1.5 days. The worst prints came fast: -8.10% on 2008-09-29, -6.67% on 2008-10-10, -6.01% on 2008-09-17 — every one of them multiples of the VaR line, in an ETF marketed as a bond fund.

At the trough a dollar invested at HYG's listing was worth $0.69. VaR answered "how often?" — and even that answer failed under regime change. CVaR at least asks the question that mattered in 2008: how bad is it when it happens?

So far CVaR has been the better thermometer. The sharper question is whether it changes what you do. With two assets, pure risk-minimising is degenerate here — volatility and tail agree that HYG is the quieter asset, so both rm="MV" and rm="CVaR" corner at 100% HYG. The measures diverge the moment you spend a risk budget. Hand two desks the same mandate — an expected loss on the worst 1% of days of at most 4% — and let each maximise return against it. The MV desk speaks only volatility, so it must translate the budget through a normal distribution (ES₉₉ = 2.665σ for a Gaussian, so σ ≤ 1.50% daily); the CVaR desk constrains the realised tail directly:

import riskfolio as rp

p_mv = rp.Portfolio(returns=rets[["HYG", "VWO"]])
p_mv.assets_stats(method_mu="hist", method_cov="hist")
p_mv.upperdev = 0.015                    # 4% ES budget, normal-translated
w_mv = p_mv.optimization(model="Classic", rm="MV", obj="MaxRet", hist=True)

p_cv = rp.Portfolio(returns=rets[["HYG", "VWO"]])
p_cv.assets_stats(method_mu="hist", method_cov="hist")
p_cv.alpha = 0.01
p_cv.upperCVaR = 0.04                      # the tail budget itself
w_cv = p_cv.optimization(model="Classic", rm="CVaR", obj="MaxRet", hist=True)

Same stated risk appetite, radically different books: 83.8% VWO through the variance lens versus 24.7% through the CVaR lens. Because both assets' tails are fatter than the Gaussian used in the translation, the MV desk's realised 99% CVaR of 6.37% overshoots its own 4% mandate by roughly 59% — the tail it was told to cap is exactly what its risk measure could not see.