Start with the sentence everyone in finance has heard and almost nobody can finish precisely: "our 99% one-day VaR is 2 million dollars." Finish it properly and it reads: "under our model, we expect a one-day loss larger than 2 million dollars on roughly 1 trading day out of every 100 (no more, no less) and we are silent about how much larger than 2 million a loss could be on that unlucky day." Every clause in that expanded sentence is doing real work, and dropping any one of them is exactly how VaR gets misused in practice.
What do the confidence level and holding period mean?
The confidence level is not optional and not a nicety. A "99% VaR of 2 million" and a "95% VaR of 2 million" are not the same claim dressed differently, the 99% number is a rarer, more extreme quantile of the same distribution, and it will always sit farther out in the tail (a larger loss) than the 95% number computed on identical data. Quote a VaR figure without its confidence level and you have quoted nothing, it is like reporting a distance without stating the units.
The holding period is baked in. A one-day VaR and a ten-day VaR of a position are not simply the first multiplied by some fixed constant unless you are willing to assume returns are independent and identically distributed day to day (the "square-root-of-time" scaling rule you may have seen (VaR_10day ≈ VaR_1day × sqrt(10)) is a consequence of exactly that assumption, and it quietly breaks the moment volatility clusters, which it always does in real markets). This module works entirely in a single holding period (one day) throughout, to keep the machinery clean; production systems that need multi-day VaR either re-simulate at the longer horizon directly or carry the square-root-of-time assumption explicitly, as a stated model choice, not a free fact.
Advertisement
What does value at risk leave out?
VaR is silent about the tail beyond itself, and that silence is the single most important limitation in this entire module. A 99% VaR of 2 million tells you nothing about whether the bad 1% of days average a 2.1 million loss or a 200 million loss. Two portfolios can share an identical VaR number while one of them is hiding a catastrophic, thin-probability, enormous-magnitude tail that VaR is structurally blind to. This is precisely the gap Expected Shortfall (ES, sometimes still called CVaR. Conditional VaR) exists to close: ES is the average loss, conditional on the loss already being worse than the VaR threshold. It answers "given that we are in the bad 1% of days, how bad is it on average?", a question VaR cannot even parse. You will implement both, side by side, for every method in this module, precisely so this distinction stops being an abstraction and becomes a number you compute yourself and can see move independently of VaR.
Three genuinely different engineering approaches exist to actually produce these numbers, and the rest of the core content builds all three, in order of increasing assumption and increasing flexibility.