Historical simulation needs hundreds of scenarios reweighted and sorted every time you want a fresh VaR number — fine once a day, painful if a trading desk wants its risk figure to refresh every few minutes as the market moves. The variance-covariance method (sometimes called the analytic or parametric method, and the original engine behind RiskMetrics) trades that flexibility for speed: assume returns are normally distributed, and VaR collapses to a single closed-form multiplication — no sorting, no simulating, just one formula evaluated in microseconds across an entire book.

From individual volatilities to portfolio volatility

Suppose a portfolio holds dollar exposures w_1, \dots, w_n to n risk factors, each with daily volatility \sigma_i and pairwise correlation \rho_{ij} between factors i and j. Under the assumption that returns are (jointly) normal, the portfolio's own daily dollar P&L is itself normally distributed, with variance built from the full covariance matrix:

For just two positions this expands to a formula worth memorizing, because every diversification argument in finance is secretly this one line:

Once \sigma_p — the portfolio's own daily dollar standard deviation — is in hand, VaR falls straight out of the normal distribution's quantiles: it is simply \sigma_p scaled by the z-score for the chosen confidence level.

Worked example: two positions, one correlation

A desk holds a position whose returns contribute w_1\sigma_1 = \$300{,}000 of daily dollar volatility, and a second position contributing w_2\sigma_2 = \$400{,}000. If the two were completely uncorrelated (\rho_{12}=0), the cross term vanishes and the two volatilities combine at right angles — a 3-4-5 triangle in disguise:

Now suppose instead the two positions are positively correlated, \rho_{12} = 0.5 — perhaps both are long the same sector. The cross term switches on and pushes the combined volatility up to about \sigma_p = \sqrt{300{,}000^2 + 400{,}000^2 + 2(300{,}000)(400{,}000)(0.5)} \approx \$608{,}300 — over 20% higher, purely from the positions moving together more often. The 99% VaR follows immediately: 2.326 \times \$500{,}000 \approx \$1{,}163{,}000 in the uncorrelated case, versus 2.326 \times \$608{,}300 \approx \$1{,}415{,}000 once the correlation is switched on. Diversification is only as good as your correlation estimate.

Explore: diversification as a function of correlation

Fix the two dollar-volatility contributions with the sliders and watch the combined portfolio volatility trace out a curve as correlation moves from -1 (a perfect hedge) to +1 (moving in lockstep).

At \rho=-1 the curve bottoms out at |w_1\sigma_1 - w_2\sigma_2| — the positions almost cancel, a natural hedge. At \rho=+1 it peaks at w_1\sigma_1 + w_2\sigma_2 — no diversification benefit survives at all. Every value in between interpolates smoothly, which is exactly why correlation is the single most important number a risk manager can get wrong.

The one input this whole method still needs from somewhere else is \sigma_i itself — how volatile is each risk factor right now? A long-run historical average reacts far too slowly to changing market conditions, so in practice desks feed this formula with time-varying volatility estimates from GARCH models, which let today's volatility depend on how turbulent the market has been recently.