Expected Shortfall

Back in what VaR measures, we flagged a gap and promised to come back to it: a 99% VaR tells you a threshold that's rarely crossed, but says nothing about how bad things get on the rare days it is crossed. Two portfolios can share an identical VaR while one has a merely-bad worst day and the other could end the firm. Expected Shortfall (also called Conditional VaR or CVaR) is the fix: instead of asking "where's the cutoff?", it asks "given that we're past the cutoff, how bad is it on average?"

Definition: the average loss, beyond the cutoff

The c% Expected Shortfall is the average loss conditional on the loss exceeding the c% VaR:

\text{ES}_c = \mathbb{E}\bigl[\,L \;\big|\; L > \text{VaR}_c\,\bigr].

In a historical-simulation or Monte Carlo sample of M scenarios, this is entirely mechanical: sort the scenarios worst to best exactly as before, but instead of reading off one value at rank k=\lceil (1-c)M\rceil, take the average of all k worst scenarios:

\text{ES}_c = \frac{1}{k}\sum_{t=1}^{k} \text{P\&L}_{(t)}, \qquad k = \lceil (1-c)M \rceil,

where \text{P\&L}_{(1)} is the worst scenario, \text{P\&L}_{(2)} the second worst, and so on. Because it averages a whole slice of the tail rather than pinpointing its edge, Expected Shortfall is always at least as large as VaR at the same confidence level — it can never be smaller.

Worked example: extending the historical simulation

Recall the 20-day historical sample from historical simulation, reweighted onto a $10,000,000 portfolio, with worst-to-best returns -3.4\%, -2.2\%, -1.5\%, -1.1\%, \dots. The 90% VaR needed k=\lceil 0.10\times 20\rceil = 2, landing on the second-worst day alone: \text{VaR}_{90} = 0.022 \times \$10{,}000{,}000 = \$220{,}000.

Expected Shortfall instead averages those same two worst days:

\text{ES}_{90} = \frac{(-3.4\%) + (-2.2\%)}{2}\times \$10{,}000{,}000 = -2.8\%\times \$10{,}000{,}000 = \$280{,}000.

\$280{,}000 > \$220{,}000 — exactly as guaranteed. The VaR figure only ever saw the boundary of the tail; the ES figure looked inside it, and reported a bigger, more honest number.

Picture it: two lines on the same tail

On the standardized P&L bell curve, VaR is the dashed cutoff line; Expected Shortfall is a second, solid line sitting further into the tail — the probability-weighted average of everything past the cutoff. The shaded region is identical to the one you met before; now it has two landmarks instead of one.

Why "coherent" matters: VaR can call diversification bad

A risk measure is called coherent if it satisfies four sensible axioms, the most important of which is subadditivity: combining two positions into one portfolio should never make the reported risk go up. Diversification should never look like a bad idea. Remarkably, plain VaR can violate this.

Take two independent bonds, each with a 4% chance of defaulting (a $100 loss) and a 96% chance of paying in full (no loss). At 95% confidence:

Sum of the individual VaRs: \$0 + \$0 = \$0. VaR of the combined, diversified portfolio: \$100. Holding both independent bonds together looks riskier, by VaR's own arithmetic, than holding either alone — precisely the failure subadditivity forbids. Expected Shortfall, by contrast, is provably coherent: no portfolio of independent (or any) positions can ever make ES claim that diversifying increased risk.

The 2007–09 financial crisis exposed VaR's blind spot in the worst possible way: banks that reported comfortable VaR numbers right up until the crisis were then hit by losses far beyond anything their VaR figure had hinted at, because VaR had never been asked to describe the tail — only to mark its edge. The academic case for something better was already decades old (Philippe Artzner, Freddy Delbaen, Jean-Marc Eber and David Heath formalized "coherent" risk measures, with Expected Shortfall as the star example, in a landmark 1999 paper), but it took the crisis to force regulators' hands. Basel III's Fundamental Review of the Trading Book (finalized 2016) replaced VaR with Expected Shortfall as the standard measure banks must hold capital against for market risk — a direct, practical consequence of the subadditivity failure above.

The single most common misreading of a VaR number is treating it as a worst-case estimate. VaR tells you a threshold is crossed some fraction of the time — it says absolutely nothing about how bad things get once it's crossed. A 99% VaR of $1M is exactly as consistent with a worst day of $1.01M as it is with a worst day of $50M; VaR alone cannot tell those two firms apart. Expected Shortfall exists specifically to answer the question VaR cannot: not "is the threshold crossed?" but "how bad is it, on average, when it is?"