Risk Systems in Code — VaR, ES, Stress & Scenario

Learning objectives

By the end you can:

1. State what Value at Risk and Expected Shortfall each actually claim (and, just as importantly, what they do not claim) and explain why a single confidence level and a single holding period are inseparable from the number itself.
2. Implement historical simulation VaR and ES from a raw return sample with no distributional assumption, using a precisely-specified order-statistic procedure, and explain what it means for this method to have "no model" (and what that costs you).
3. Implement parametric (variance-covariance / delta-normal) VaR and ES from a Normal-distribution assumption, using the closed-form quantile and tail-expectation formulas, and state exactly which assumption is doing all the work.
4. Implement Monte Carlo VaR and ES by simulating a large seeded sample from an assumed model and reading the tail off the simulated sample, and demonstrate, numerically, that a correct Monte Carlo implementation converges to the parametric answer when the underlying model is the same.
5. Compare the three methods on the same data, explain the specific conditions (fat tails, skew, regime change) under which they diverge, and justify which method you would trust for a specific job.
6. Implement a full VaR backtest: count exceptions correctly (including the exact-boundary edge case), run the Kupiec proportion-of-failures test as a formal hypothesis test with a chi-square critical value, and classify a model's track record into the Basel traffic-light zones, and explain why too few exceptions is itself evidence against a model, not a reason to relax.
7. Implement stress testing (a single named, non-probabilistic shock applied to a real book) and scenario analysis (several named shocks compared side by side), and explain why these exist alongside VaR/ES rather than instead of them.
8. Name the two best-known theoretical limitations of VaR, that it is not, in general, a coherent risk measure (it can fail sub-additivity) and that it says nothing about the size of a loss beyond the threshold, and explain why Expected Shortfall was written into modern capital rules (FRTB) specifically to close those gaps.
9. (Productivity objective: R10 duality.) Use an AI coding assistant to scaffold the repetitive, boilerplate-heavy parts of a risk pipeline (report formatting, a pandas roll-forward loop, a plotting harness) after you can already derive and hand-verify every formula yourself, and catch the specific ways an AI-generated risk calculation goes silently wrong (a population-vs-sample variance mix-up, a hardcoded annualization factor, a 0 * log(0) crash on a perfect VaR track record, a numpy boolean masquerading as a Python one in a report that a downstream system trusts).

The duality, stated once (R10). As in every module in this program, this node carries two objectives at once. The understanding objective (items 1–8) is what the mastery gate rewards; you earn the pass by deriving the numbers correctly, by hand and in code, and by clearing the code pack's hidden tests on both an India-flavoured and a US-flavoured dataset, not by having an assistant produce a risk report you cannot defend to a risk committee. The productivity objective (item 9) is the payoff you keep afterward: knowing how to point a copilot at risk-systems code without being quietly misled by it. A tool can never buy you a pass on the gate.

Prerequisites & connections