Richard Bennett, EMEA president of Razor Risk Technologies, outlines the role of VaR in a holistic approach to risk management

Following the financial crisis of 2007/2008, the Value at Risk (VaR) calculation method - arguably the most broadly utilised method of risk management - has come under increasing levels of scrutiny for its failure to provide accurate results. This paper examines the reasons behind the perceived failure of risk management up to and during the economic downturn. It also outlines how VaR can be a highly accurate measure if it can measure and factor in dynamic changes in the underlying portfolio holdings, ensuring that 'non-normal' events and cyclical macro-economic issues are taken into account. This paper will then explain why VaR is simply one of many measures of risk that should be used when aiming for best practice risk management, which ultimately demands a holistic approach.

What is VaR?
VaR is a mathematical methodology, based on a number of assumptions. Its usefulness depends upon the degree to which these assumptions hold: one of the largest assumptions in traditional VaR calculations is that a portfolio is static over the calculated period of time, which of course in reality it is not.

The financial crisis and risk management: what went wrong?
The scale of financial losses in the past three years has led investors, senior board executives and the general public alike to reconsider their previous confidence in risk measurement and risk management. Both the models used to calculate risk and the regulatory standards that were supposed to ensure a conservative risk approach have been called into question, seriously undermining the credibility of risk management methodologies.

Since VaR was the most widely touted method of risk calculation prior to the financial crisis, it is no surprise that VaR is also the measure that has come under the highest level of scrutiny. In January 2008, VaR models reported that Merrill Lynch's highest one-day VaR in the third-quarter of 2008 was US$92m, indicating that the firm's maximum expected cost during the 63 trading day period would be US$5.8bn.

In fact, according to Bloomberg, the firm wrote down US$8.4bn from the value of CDOs, subprime mortgages and leveraged finance commitments. This was 45% more than predicted. The error in the VaR measure at Merrill Lynch, and indeed at many other institutions, was due to a number of simplifying assumptions in the calculation methodology that were simply not true, leading to an incorrect risk assessment and catastrophic results.

There are a number of reasons behind the perceived failure of risk management, including:

• In many instances, the financial institution's appetite for risk was not effectively set nor communicated down to employees by the Board
• Assumptions used in risk models were driven by regulatory requirements, not real world risks
• Different job functions had different 'wants' within each institution - e.g. traders versus business analysts versus risk analysts. This cultural mismatch resulted in a risk management mismatch
• Executives who did not fully understand how VaR is calculated just looked at the single number the models generated, ignoring the base assumptions.

This leads to the question: what should and what realistically can be done to improve risk management? Industry executives rightly expect more regulation and increased investment in risk management. However, instead of focusing on compliance-driven risk management, companies should look to implement a holistic risk management approach that can restore stakeholders' trust and drive business value for the long term.

VaR as part of holistic risk management
The recent financial crisis has shown that in the world of finance, what does not get measured does not get managed. Most firms continue to measure risk in silos and therefore total enterprise risk exposure is not transparent.

Consequently, senior management within a financial organisation are unable to obtain an overarching view of how credit, liquidity, market and other risks are interacting and potentially compounding exposures throughout the firm - leading to crippling losses or outright firm failure. It is therefore vital that a single coherent, or holistic, approach to risk management is taken.

Another vital element of best practice risk management is the deployment of a range of risk measures. Alongside accurate VaR, other risk measures, such as stress testing, must also be used.

Recognising this, regulators around the world have begun to instigate changes towards an improved, more holistic approach to risk management. In Australia and the UK, the Australian Prudential Regulatory Authority and the Financial Services Authority made liquidity stress testing mandatory for banks and many different types of financial institutions.

Stress testing assumptions and correlations can be particularly important when seeking a single view of the bank or firm. Key to the success of this measure is the ability of the risk manager to seek out potential crises and then to accurately describe them, in order for them to be meaningfully incorporated into the stress testing.

Any risk measure is based on some assumptions. The more widespread the use of the technique, the more likely human nature will lead financial institutions to seek 'work-arounds' or forget the assumptions that the chosen technique is based upon, as was the case with VaR. A holistic approach helps avoid over-reliance on just one measure, providing a more balanced guide.

Achieving accurate VaR calculations
There are some major discrepancies in the approach to calculating VaR in different financial institutions, resulting in varying degrees of accuracy. So, how can firms obtain the best accuracy from VaR models?

There are three key ways in which risk professionals need to adjust their calculations:

1. Move to a forward-looking VaR calculation over a multi-period basis, allowing for dynamic changes in the underlying portfolio holdings, like trades maturing, cashflows reinvested or options being exercised - the characteristics of any portfolio changes with the passage of time. Bonds are a very pertinent example of this. As they approach maturity, their value approaches face value and their volatility diminishes and disappears altogether at maturity, when the bond can be redeemed at face value. Options - another example - behave differently. They tend to lose value as they approach expiration, all other things being equal. Therefore, any VaR calculation looking to provide greater accuracy should take into account these changes.

2. Extend market risk VaR models to incorporate credit defaults as these best capture 'non-normal' events faced by institutions today. This extension to the VaR model to cover default, migration, spread and equity risks - including correlations within and across those risks - is an instrumental step in managing the real risks of today, by ensuring a holistic approach.

3. Incorporate cyclical macroeconomic stress test factors into the risk process to avoid having a 'Charles Prince'¹ moment.

In addition, the assumptions built into the VaR models must be communicated at all times to traders, analysts and senior management and the models themselves must be independently reviewed.

Conclusion
Instead of focusing on compliance-driven risk management, financial institutions should look to implement a holistic risk management approach that can restore stakeholders' trust and drive business value for the long term. Firms and regulators need risk measures that not only work today, but can also act as a guide if markets suddenly change as they did in 2007 and 2008. Ensuring accurate VaR plays a key role in achieving this.

Changing VaR to a multi-period, default-adjusted calculation taking into account dynamic changes in the underlying portfolios, while incorporating macroeconomic stress events, will help rebuild the confidence of investors and other stakeholders of the world's financial services companies. They must be confident that robust risk management capabilities are in place to mitigate the kinds of risks that have undermined the global economy. These improvements in the accuracy of VaR models will help to deliver this confidence.

Footnotes
¹ Charles Prince, former ceo of Citigroup Inc, famously said "...as long as the music is playing, you've got to get up and dance. We're still dancing." to the Financial Times in July 2007, in response to queries about the risks and dangers of MBS and CDOs. Prince resigned in November 2007, after Citigroup posted a 57% drop in quarterly profits, caused by losses in the subprime mortgage market. Citigroup went on to report a US$40bn loss caused by the subprime crisis, the most of any bank.