VaR Tells You Your Likely Worst Day. It Says Nothing About How Bad the Days Beyond That Actually Get
5 min read
Loading...
5 min read
Your portfolio's one-day 95% Value at Risk is 2.5%. That number is supposed to be reassuring: only about 1 day in 20 should be worse than that. But it never says how much worse. Conditional Value at Risk (CVaR), also called Expected Shortfall, answers the question VaR leaves open: once you're inside that worst 5%, what does the average day in there actually cost you?
Value at Risk draws a line: the loss level you should not expect to exceed, at a chosen confidence level, over a set period. It answers "how often." It never answers "how deep." A 95% VaR of 2.5% looks the same whether the worst 5% of days average out to 3% losses or 15% losses. VaR cannot tell the difference. It stops counting the moment it crosses the line.
CVaR takes one more step. Instead of naming where the line sits, it averages every loss that falls past it. A 95% CVaR is the average loss across the worst 5% of outcomes, not just the single cutoff observation VaR reports. That makes it a tail-depth measure, not a tail-frequency one, and it is why regulators now lean on it more than VaR alone, covered further down.
The Value at Risk post built an illustrative historical simulation: a hypothetical Rp50 million portfolio, 60% BBCA, Indonesia's largest bank by market value, and 40% Bitcoin. It ranked 100 days of daily returns from worst to best and read the 95% VaR off the 5th-worst observation:
| Rank | Daily return |
|---|---|
| Worst day | −4.8% |
| 2nd worst | −3.6% |
| 3rd worst | −3.0% |
| 4th worst | −2.7% |
| 5th worst (the 95% VaR cutoff) | −2.5% |
That table stops at the cutoff. CVaR keeps going: it averages all five of these worst days instead of stopping at the fifth one.
The 95% CVaR here is 3.32%, or about Rp1.66 million on this Rp50 million portfolio, this row's own calculation applied to the same illustrative dataset, not a separately sourced figure. That is roughly a third deeper than the Rp1.25 million the VaR number alone implies. VaR told you the threshold. CVaR just told you that crossing it costs meaningfully more than the threshold itself suggests.
Both VaR and CVaR are read off a specific historical window, so neither one is a hard ceiling. A calm few years produces a reassuring number that a single volatile month can blow past.
On 5 June 2026, the S&P 500 fell 2.64%, closing at 7,383.74, its sharpest one-day drop since October 2025, as a sudden sell-off in AI and semiconductor stocks hit the market (CNBC, TheStreet). That single day already sits past a typical 95% VaR cutoff on its own, and it happened without any crisis narrative attached, just an ordinary sector sell-off.
Now compare it to a genuine tail event. During the COVID crash, the S&P 500 fell 12% in a single trading day on 16 March 2020 (CNBC). That is roughly three and a half times deeper than the illustrative 95% CVaR figure above. It is exactly the kind of day CVaR, calculated from a calmer window, would not have anticipated. Expected Shortfall improves meaningfully on VaR, but it is still a statistical estimate bounded by the data it is built from, never a guarantee of the worst that can happen.
This is not just a blog-post nuance. Under the Basel III Fundamental Review of the Trading Book (FRTB), global bank regulators replaced 99% VaR with 97.5% Expected Shortfall as the standard for calculating how much capital a bank must hold against its trading-book risk, precisely because VaR's blindness to tail severity was judged a real weakness in bank risk models, not a theoretical one (AnalystPrep, Bank Policy Institute). The 97.5% confidence level was chosen specifically so the new Expected Shortfall figure stays roughly comparable in scale to the old 99% VaR figure it replaced, under a normal-distribution assumption, while actually accounting for how bad the tail gets rather than just where it starts.
If the institutions that price and hold the riskiest books in the financial system decided VaR alone was not enough, that is a reasonable signal for an individual investor's own risk checks too.
VaR and CVaR both start from the same input: your portfolio's own volatility and return history. Neither one is a number you calculate once and file away, since both shift as your holdings and market conditions change.
Your Portfolio Health card on NetWort shows your portfolio's annualized volatility, Sharpe ratio and max drawdown. Use the same quick parametric approach the VaR post lays out to get a working VaR estimate from that volatility figure, then treat any CVaR you calculate on top of it as a deeper floor, not a ceiling. The tail beyond even that number is where a real bad day, like 16 March 2020, actually lives.