Expected Shortfall (CVaR): Calculation, Backtesting, and Uses

Expected shortfall, also called conditional value at risk (CVaR), measures the average loss a portfolio would suffer during the worst outcomes beyond a chosen confidence threshold. Where value at risk (VaR) tells you the minimum loss you would face in, say, the worst 2.5% of scenarios, expected shortfall answers the harder question: once you have crossed that line, how bad does it actually get on average? The Basel Committee on Banking Supervision adopted expected shortfall at the 97.5% confidence level as the primary market risk metric under its Fundamental Review of the Trading Book, replacing VaR as the standard for setting bank capital requirements.¹

How It Differs From Value at Risk

Value at risk boils down to a single number: the loss threshold you will not exceed with a given probability over a set time horizon. A bank might report a one-day 99% VaR of $10 million, meaning that on 99 out of 100 trading days, losses should stay below that figure. The problem is that VaR says nothing about the one day it gets breached. The loss could be $11 million or $500 million, and VaR treats both identically because it only marks where the tail begins, not what lives inside it.¹

Expected shortfall fills that gap by averaging every loss scenario beyond the VaR cutoff. If a portfolio’s 97.5% VaR is $8 million, expected shortfall collects all the outcomes in the worst 2.5% of the distribution and computes their mean. That single number tells a risk manager how deep the hole goes on genuinely bad days. Research by the Bank for International Settlements found that VaR systematically underestimated the risk of portfolios with fat-tailed loss distributions, while expected shortfall captured the magnitude of those extreme losses more reliably.²

The distinction matters in practice because VaR can be gamed. A trader could restructure a portfolio using options to push the VaR reading down while making the tail losses far worse. Writing a put option with a strike price just below the current VaR level and buying one with a strike above the desired VaR effectively sweeps risk under the rug. VaR would not flag it because it reads a single point on the distribution. Expected shortfall catches this manipulation because it accounts for the severity of every loss beyond the threshold, not just whether a loss exists.²

Why It Qualifies as a Coherent Risk Measure

Risk measurement theory requires that any useful metric satisfy four mathematical properties, collectively known as coherence. These properties were formalized in a 1999 paper by Artzner, Delbaen, Eber, and Heath, and they ensure that a risk measure behaves in ways that match financial common sense.³

Subadditivity. The risk of a combined portfolio must be no greater than the sum of its parts’ risks measured separately. This reflects the basic principle that diversification should not increase risk.
Monotonicity. If one portfolio always produces worse outcomes than another, its measured risk should be higher.
Positive homogeneity. Doubling the size of a position should double its measured risk.
Translation invariance. Adding a risk-free asset to a portfolio should reduce measured risk by exactly the amount of that addition.

Expected shortfall satisfies all four.⁴ Value at risk does not. VaR fails subadditivity, which means combining two portfolios can sometimes produce a higher VaR than the sum of their individual VaRs.⁵ That result defies the logic of diversification and can lead institutions to conclude, absurdly, that splitting a portfolio into pieces is safer than holding it together.

The subadditivity failure is not just a theoretical curiosity. Without it, a bank trying to allocate capital across trading desks could end up in a situation where each desk’s risk looks manageable, but the total somehow exceeds the sum. Expected shortfall avoids this by ensuring that aggregated risk always behaves predictably, making it a far more reliable foundation for capital allocation decisions.

How It Is Calculated

Choosing the Confidence Level and Horizon

The first decision is the confidence level. Under the Basel framework’s internal models approach, banks must use a 97.5th percentile, one-tailed confidence level.⁶ The Basel Committee chose 97.5% rather than 99% because a 97.5% expected shortfall produces capital requirements broadly similar to a 99% VaR when losses are approximately normally distributed, while delivering more stable model output and less sensitivity to extreme outlier observations.¹ Internal risk teams at firms not subject to Basel requirements sometimes use other levels, such as 95% or 99%, depending on their risk appetite.

The time horizon defines the period over which losses are measured. The Basel framework sets a base horizon of 10 trading days, with longer liquidity horizons required for less liquid asset classes. Large-cap equities can use the 10-day floor, while small-cap equities require 20 days, investment-grade credit spreads require 40 days, and certain illiquid positions can extend to 60 or 120 days.⁶

Isolating and Averaging the Tail Losses

With the confidence level and horizon set, the calculation itself is straightforward. Take a set of portfolio returns, sort them from best to worst, and identify the VaR cutoff point. At a 97.5% confidence level with 1,000 daily observations, VaR is the 25th worst loss. Expected shortfall is the arithmetic mean of those 25 worst losses.

Suppose the 25 worst daily losses in a portfolio range from $7 million down to $15 million. The VaR would be approximately $7 million, the boundary of the tail, while expected shortfall might come out to $10 million, reflecting the average depth of the hole across all 25 scenarios. That $3 million gap between the two figures represents the additional tail risk that VaR would have hidden.

When the risk model uses a continuous probability distribution rather than a discrete set of observations, the procedure switches to mathematical integration. The analyst integrates the loss function across the entire tail region beyond the VaR threshold, then divides by the probability of being in that tail (0.025 at the 97.5% level). Every possible extreme outcome is weighted by its probability, producing a single figure that smooths over the full shape of the tail.

Three Common Computation Methods

Firms typically estimate expected shortfall using one of three approaches, each with meaningful tradeoffs.

Historical simulation reprices the current portfolio under each day’s actual market movements over a lookback window, typically 250 trading days or more. It naturally captures fat tails and nonlinear instrument behavior without any distributional assumptions. Its weakness is that it treats the lookback window as the entire universe of possible outcomes and adjusts slowly to structural market changes.

The parametric or variance-covariance method assumes portfolio returns follow a known distribution, usually normal, and calculates expected shortfall using a closed-form formula based on the portfolio’s volatility. It is fast and analytically clean but struggles with options and other nonlinear instruments, and the normality assumption understates tail risk in most real portfolios.

Monte Carlo simulation generates thousands of hypothetical market scenarios from a specified stochastic process, then fully revalues the portfolio under each one. It is the most flexible method, capable of handling nonlinear positions, non-normal distributions, and path-dependent payoffs. The cost is heavy computation and significant model risk, since results depend entirely on the assumed process and its calibrated parameters.

The Basel framework requires expected shortfall to be calculated directly using the appropriate horizon returns rather than scaling up from shorter-period estimates. For the 10-day base horizon, banks cannot simply multiply one-day expected shortfall by the square root of 10. Scaling is permitted only for extending beyond the 10-day base to meet the longer liquidity horizon requirements for less liquid asset classes.⁷

Calibration to a Stressed Market Period

A critical feature of regulatory expected shortfall is that it must be calibrated to a stressed market period, not just current conditions. The Basel framework requires banks to identify the most stressful 12-month window in their historical data and calculate expected shortfall based on that period’s returns.⁸ In practice, many banks have used periods like August 2008 through July 2009 as their stress window.⁷

The logic is simple. A risk model trained only on calm markets will dramatically understate exposure when conditions deteriorate. The 2008 financial crisis exposed exactly this flaw in pre-crisis VaR models, which had been calibrated to benign conditions and produced reassuringly low capital requirements right up until the moment they failed. Stressed calibration forces the metric to answer a harder question: how much could you lose in an environment that actually resembles a crisis?

Implementation is more demanding than it sounds. Banks must identify a reduced set of risk factors that can be mapped from the current portfolio back to the stress period, then demonstrate that this reduced set captures a sufficient share of the variation in the full expected shortfall. The exercise requires ongoing maintenance as portfolios change and new asset classes emerge.

Where It Is Used and Where It Is Not

The Basel Committee formally proposed replacing VaR with expected shortfall in its 2012 consultative paper on the Fundamental Review of the Trading Book (FRTB). The stated rationale was VaR’s “inability to capture tail risk” and the need for a metric that considers “both the size and the likelihood of losses above a certain confidence level.”¹ The final FRTB framework requires banks using the internal models approach to calculate expected shortfall at the 97.5th percentile, calibrated to a stressed period, with differentiated liquidity horizons by asset class.⁶

Most Basel III requirements entered into force in the European Union on January 1, 2025, but the FRTB’s market risk rules have been subject to repeated delays. As of mid-2025, the European Commission proposed postponing the FRTB market risk requirements by an additional year, partly to maintain competitive alignment with other major jurisdictions. In the United States, implementation of the broader Basel III endgame package, which includes the FRTB, has not been finalized. The Federal Reserve and other banking agencies have been working through a rulemaking process that has faced significant industry pushback and remains in flux heading into 2026.

Outside of banking, expected shortfall has not displaced VaR everywhere. The SEC’s derivatives risk framework for U.S. registered investment funds still relies on value at risk. Rule 18f-4 requires funds using derivatives to monitor leverage risk using VaR at a 99% confidence level over a 20-trading-day horizon, based on at least three years of historical data.⁹ The rule does not mention or permit expected shortfall as an alternative. For fund managers, VaR remains the binding regulatory metric even as banking regulators move toward expected shortfall.

Backtesting and Model Validation

Any risk model is only as good as its ability to predict real outcomes, which is where backtesting comes in. For VaR, backtesting is relatively simple. Count how many days actual losses exceeded the VaR estimate, then check whether the exception rate matches what the model predicted. The Basel framework uses a traffic-light system based on 250 days of observations. Zero to four exceptions lands in the green zone, five to nine in the amber zone, and ten or more in the red zone.¹⁰

Backtesting expected shortfall is harder. A 2011 discovery that expected shortfall lacks a mathematical property called elicitability initially led to a widespread belief that it could not be backtested at all. That concern turned out to be overstated. Elicitability relates to model selection, not model testing, and researchers have since demonstrated that expected shortfall can be backtested efficiently, though the process requires storing more information about the predictive distribution rather than just counting exceptions.¹¹

The practical difference is significant. VaR backtesting requires recording only one number per day and checking it against realized losses. Expected shortfall backtesting requires information about the shape of the predicted loss distribution, because the question is not just whether the threshold was breached but whether the estimate of average breach severity was correct. That demands richer data and more sophisticated statistical tests. Under the Basel framework, banks must perform backtesting against both hypothetical trading outcomes (assuming positions are unchanged) and actual trading outcomes, using the higher exception count of the two for compliance purposes.¹⁰

Limitations

Expected shortfall is a better risk measure than VaR in most respects, but it has real weaknesses that practitioners should understand.

The most consequential is estimation instability. When the underlying loss distribution has fat tails, as most financial return distributions do, expected shortfall estimates tend to be less precise than VaR estimates calculated from the same number of observations. The reason is intuitive. Expected shortfall depends on the average of extreme observations, and extreme observations are inherently noisy. A single outlier trading day can move the figure substantially, which means capital requirements calculated from expected shortfall can fluctuate more than those based on VaR.

Stressed-period calibration introduces its own problem. Banks must demonstrate that their model would have performed well during a different stress period, but they only have one historical stress window to work with. You cannot truly backtest a stressed model because you would need a second, independent crisis period for validation, and no two crises look the same.

The Basel framework’s requirement to use overlapping 10-day return periods for estimation creates additional noise. Overlapping observations are not statistically independent, so the effective sample size is much smaller than the number of data points suggests. The estimate remains unbiased but becomes noisier than most practitioners realize.

Finally, expected shortfall shares a limitation with all quantitative risk measures: it cannot predict risks that do not appear in the historical data or simulation assumptions. A crisis driven by a mechanism with no precedent in the lookback window will be invisible to the model regardless of whether it uses VaR, expected shortfall, or any other statistical metric. The measure is best understood as a disciplined way to think about tail risk, not a guarantee against it.

Use in Portfolio Optimization

Beyond regulatory compliance, expected shortfall offers a practical advantage in portfolio construction. Because VaR is not convex as a mathematical function, optimizing a portfolio to minimize VaR can produce multiple solutions with no guarantee that any of them is the true optimum. Expected shortfall is convex, meaning the optimization problem has a single global solution. Portfolio managers can formulate the asset allocation problem as a convex program and know they have found the best possible allocation rather than a local minimum that happens to look acceptable.¹²

This property also means expected shortfall optimization does not require the assumption that returns are symmetrically distributed. Traditional mean-variance optimization relies on the assumption that log-returns follow an elliptical (symmetric) distribution. Real financial returns are skewed and fat-tailed, which means mean-variance optimization can misallocate capital. Expected shortfall-based optimization handles asymmetric distributions naturally, making it a more general framework for investment situations involving options, structured products, or any asset with a nonlinear payoff profile.¹²

The subadditivity property carries directly into capital allocation. When a firm uses expected shortfall to measure risk across multiple trading desks or business units, the total firm-level risk will always be less than or equal to the sum of each unit’s standalone risk. The difference represents the diversification benefit, and allocating that benefit back to individual desks in a fair and consistent way is straightforward with a coherent measure. It becomes a genuinely useful tool for deciding where additional risk capacity should go.

1
Bank for International Settlements. Fundamental Review of the Trading Book: A Revised Market Risk Framework
2
Bank for International Settlements. Comparative Analyses of Expected Shortfall and Value-at-Risk Under Market Stress
3
ETH Zürich. Coherent Measures of Risk
4
Columbia University. IEOR E4602: Quantitative Risk Management – Risk Measures
5
Cornell University. Subadditivity Re-Examined: The Case for Value-at-Risk
6
Bank for International Settlements. MAR33 – Internal Models Approach: Capital Requirements Calculation
7
Bank Policy Institute. Why Is the FRTB Expected Shortfall Calculation Designed as It Is?
8
Bank for International Settlements. DIS50 – Market Risk
9
eCFR. 17 CFR 270.18f-4 Exemption From the Requirements of Section 18 and Section 61 for Certain Senior Securities Transactions
10
Bank for International Settlements. MAR99 – Guidance on Use of the Internal Models Approach
11
MSCI. Backtesting Expected Shortfall
12
KTH Royal Institute of Technology. Robust Portfolio Optimization with Expected Shortfall