From a sentence to a number
The first guide of this rung handed you the board's job: state a risk appetite — how much chance of failure the firm will live with — and let that statement govern the whole balance sheet. But "we will tolerate a 1-in-200 year" is a sentence, and a balance sheet runs on numbers. A risk measure is the machine that turns that sentence into one figure: feed it the full probability distribution of next year's loss, and it returns the single amount of money that distribution is *worth worrying about*. Choose the measure well and the capital you hold honours the promise; choose it badly and you can satisfy the words while betraying their meaning.
Formally, a risk measure is just a function that takes a random loss and spits out one real number — a price tag on uncertainty. You already met its spirit in the previous rung, when you ran ruin theory backwards to find a required cushion. The difference now is altitude: there, one line of business and one surplus process; here, *every* risk on the enterprise rolled into a single loss distribution, and one measure applied to all of it. The two measures this guide builds — VaR and Tail VaR — are the two the whole regulated world actually argues over.
Value at Risk: the height of the cliff edge
Value at Risk answers one crisp question: *what is the loss I will not exceed, with a stated probability, over a stated horizon?* Pick a confidence level — say 99.5% — and a year. The 99.5% VaR is the loss figure such that, in 199 years out of 200, the actual loss comes in *below* it. It is, quite literally, a percentile of the loss distribution: line up every possible outcome from best to worst, walk 99.5% of the way along, and read off the number standing there. That number is the height of the cliff edge — the worst loss of a "normal" bad year, just before things tip into the rare and catastrophic.
VaR became the language of regulation for good reasons. It is intuitive — a board member with no statistics can grasp "the loss we will not breach 199 years in 200." It collapses a whole distribution to one comparable number. And it maps cleanly onto a solvency rule: hold capital equal to the 99.5% VaR, and you have, on paper, a 1-in-200 chance of being overwhelmed in the year. That last sentence is exactly how economic capital under a framework like Solvency II is defined — the regulatory capital target *is* a VaR, at a confidence level chosen to match the appetite the board declared.
The blind spot: VaR never looks over the edge
Here is the danger, and it is fatal to take lightly. VaR tells you *where* the cliff edge is. It says nothing — nothing at all — about how far you fall once you go over it. A 99.5% VaR is a statement about the 199 good years; it is completely silent about what the 1 bad year actually costs. By construction it ignores the entire tail beyond the percentile. Two firms can report the *identical* VaR while one, in its worst 0.5% of years, loses a survivable amount and the other loses ten times its whole capital. VaR cannot tell them apart.
This is not pedantry — it is precisely where insurance risk lives. Recall the lesson from ruin theory: under a heavy-tailed severity — catastrophe, liability, large-fire, cyber — disaster arrives as one colossal claim, sitting far out in the very region VaR refuses to look. The measure was, notoriously, blamed for letting banks hold thin capital before 2008: their VaR looked tame because the model assumed a thin tail, and the loss that actually arrived lived in the part of the distribution VaR had been built to ignore. Optimising to a VaR limit can even *reward* a firm for hiding risk just beyond the cutoff, where it adds nothing to the reported number but everything to the true danger.
Tail VaR: the average of the catastrophe
The fix is to ask a deeper question. Instead of "where is the edge?" ask "*given* that we have gone over the edge, how bad is it on average?" That is Tail Value at Risk — also called Conditional Tail Expectation, or, in a continuous distribution, expected shortfall. The 99.5% TVaR is the *average loss across the worst 0.5% of years* — the mean of everything in the tail that VaR threw away. Where VaR reads the height of the cliff edge, TVaR walks over the edge and reports the average depth of the fall. By construction TVaR is always at least as large as VaR at the same level, and usually larger — the gap between them is a thermometer for how heavy the tail is.
Make it concrete with a tiny scenario set — twenty equally likely outcomes, the worst few being the only ones that bite. Suppose nineteen years lose modest amounts but one year, the catastrophe, loses 1,000. The 95% VaR (the worst-1-in-20 threshold) sits at the *edge* of that bad year and barely registers the 1,000. But the 95% TVaR averages the worst 5% — here, that single 1,000 year — and so it stares straight at the disaster. Swap the catastrophe for one losing 5,000 instead, and the VaR may not move at all while the TVaR multiplies fivefold. TVaR *felt* the change; VaR was blind to it. That is the whole argument in one example.
20 equally likely yearly losses, sorted worst-first: Year: 1 2 3 ... 20 Loss: 1000 90 80 ... 5 (only year 1 is the catastrophe) 95% VaR = threshold at the worst 1-in-20 = ~90 (edge of the bad year) 95% TVaR = mean of the worst 5% (= worst 1) = 1000 (the catastrophe itself) Now make the catastrophe 5000 instead of 1000: 95% VaR ~= 90 (UNCHANGED -- blind to the tail) 95% TVaR = 5000 (x5 -- it averages what is actually out there)
Coherence: why TVaR earns the trust
TVaR's advantage runs deeper than "it looks at the tail." There is a short list of properties any *sensible* risk measure ought to obey, and a measure that obeys all of them is called a coherent risk measure. The most important is subadditivity: the risk of two portfolios combined should never exceed the sum of their separate risks — merging two books of business cannot *create* danger out of thin air, because diversification can only help, never hurt. This is the mathematical backbone of why an insurer holds less capital than the sum of its parts, the whole logic of diversification credit.
Here is the punchline that decides the contest: VaR is *not* coherent. It can violate subadditivity — there are real cases where combining two portfolios makes the reported VaR go *up*, as if diversifying had manufactured risk. That is not a quirk; it is a logical absurdity that can mislead a firm into splitting a book to game its capital, or into refusing a diversifying merger that would genuinely have made it safer. TVaR, by contrast, *is* coherent: it is always subadditive, so the diversification arithmetic always points the right way. Looking into the tail and respecting diversification turn out to be the same virtue, and TVaR has both.
Honest about both
Choosing TVaR over VaR fixes a real flaw, but it does not buy you safety — only honesty about where the danger sits. Both measures are computed from a *model* of the loss distribution, and the answer is dominated by the very tail you have the least data to pin down. TVaR's strength — that it averages the whole tail — is also its fragility: a single assumption about how the far tail behaves can swing the number wildly, while VaR, looking only at one percentile, at least does not over-commit to a shape it cannot see. Neither measure is reality; both are a story you tell about reality, and the story's weakest chapter is always the extreme.
So treat a risk measure as the *start* of the conversation, never the end. A single number — VaR or TVaR — is a summary, and any summary throws information away. The mature practice pairs it with the tools that probe the tail directly: extreme-value methods, and above all the stress and scenario tests of the next guides, which ask "what *specific* disaster breaks us, and could we survive it?" rather than trusting one percentile of one fitted curve. The measure tells you how much capital the model thinks you need; the stress test tells you whether the model is fooling you.