Expected Shortfall (CVaR): Formula, Calculation, and Examples

Expected Shortfall — also called Conditional Value at Risk (CVaR) or Expected Tail Loss (ETL) — answers the question that Value at Risk leaves open: when losses exceed the VaR threshold, how bad are they on average? While VaR tells you the boundary of the tail, CVaR tells you what happens inside it. This distinction earned Expected Shortfall a central role in modern risk management — the Fundamental Review of the Trading Book (FRTB) under Basel III reforms replaced 99% VaR with 97.5% ES as the standard for market risk capital. This guide covers what CVaR measures, how to calculate it, how it compares to VaR, and why regulators made the switch.

What is Expected Shortfall?

Expected Shortfall is the average loss in the tail of a portfolio’s return distribution — specifically, the average of all losses that fall at or beyond the VaR threshold. If 95% VaR tells you “losses won’t reach $X on 95% of days,” then 95% CVaR tells you “on the 5% of days when losses do reach at least $X, the average loss is $Y.”

The concept goes by several names in academic and industry literature:

• Expected Shortfall (ES) — the term used by regulators and the Basel Committee
• Conditional Value at Risk (CVaR) — common in optimization and academic finance
• Expected Tail Loss (ETL) — descriptive name emphasizing the tail average
• Average Value at Risk (AVaR) — occasionally used in mathematical finance

An intuitive way to think about the relationship: VaR is the “door” to the tail of the distribution. It marks where extreme losses begin. CVaR looks at what is behind that door — it measures how severe losses are, on average, once you are inside the tail. This makes CVaR a more informative measure of downside risk than VaR, which says nothing about the magnitude of tail losses.

The CVaR Formula

Before presenting the formula, a brief note on notation used throughout this article:

• α — the confidence level (e.g., 0.95 for 95%)
• 1-α — the tail probability (e.g., 0.05 for 5%)
• L — loss, expressed as a positive number (a $30,000 loss is L = 30,000)

In words: CVaR at confidence level α is the average of all losses that are at least as large as VaR_α. Because every observation in this average is at least VaR, CVaR is always at least as large as VaR (CVaR_α ≥ VaR_α). In rare edge cases — for example, if the loss distribution has a single point mass exactly at the VaR level — CVaR can equal VaR, but it can never be smaller.

For historical simulation, CVaR has a straightforward calculation:

For example, with 1,000 trading days and 95% confidence: n = ⌊(1 – 0.95) × 1,000⌋ = 50 tail observations. CVaR is the average of the 50 worst daily losses. When (1-α) × N is not an integer — for example, 252 days at 97.5% confidence gives 6.3 — common practice is to take the floor (6 observations) or use linear interpolation for the fractional observation.

How Expected Shortfall is Estimated

In practice, Expected Shortfall can be estimated using three main approaches — the same methods used for VaR, but applied to the tail average rather than a single quantile:

CVaR vs VaR

CVaR and VaR are complementary risk metrics, but they answer fundamentally different questions. Understanding when to use each — and why regulators shifted from one to the other — is essential for modern risk management.

The sub-additivity property deserves special attention. A risk measure is sub-additive if the risk of a combined portfolio is no greater than the sum of the risks of its components: Risk(A+B) ≤ Risk(A) + Risk(B). CVaR satisfies this property, which means it properly rewards diversification — combining portfolios can never increase measured risk beyond the sum of individual risks. VaR is not guaranteed to satisfy sub-additivity, which can produce counterintuitive results where merging two portfolios appears to increase total risk.

Expected Shortfall Example

Consider a $1,000,000 equity portfolio evaluated using 100 trading days of historical returns at 95% confidence.

Why Regulators Prefer CVaR

The Fundamental Review of the Trading Book (FRTB), finalized under the Basel III reforms, replaced 99% VaR with 97.5% Expected Shortfall as the primary risk measure for market risk capital in banks’ internal models. In practice, the FRTB framework also incorporates stressed-period calibration and varying liquidity horizons by risk factor category — but the headline change from VaR to ES reflected fundamental concerns about VaR’s limitations as a regulatory risk measure.

Three factors drove the shift:

1. Tail sensitivity — VaR reports only the threshold of the tail. Two portfolios can have identical VaR but vastly different tail risk. One might have modest losses beyond VaR; the other might face catastrophic losses. CVaR distinguishes between these cases by measuring the average severity inside the tail.

2. Sub-additivity — CVaR satisfies the sub-additivity property: CVaR(A+B) ≤ CVaR(A) + CVaR(B). This means a combined portfolio’s measured risk is no greater than the sum of its components’ risks — properly reflecting the risk reduction from diversification. VaR is not guaranteed to satisfy this property, which can create situations where a bank’s desk-level VaR figures sum to less than the firm-wide VaR. This mathematical property is one of four axioms that define a coherent risk measure, a framework CVaR satisfies and VaR does not.

3. Reduced perverse incentives — Under VaR-based regulation, it was possible to construct portfolios with concentrated tail risk that stayed just below the VaR threshold — positions that rarely triggered losses but were catastrophic when they did. CVaR reduces (though does not entirely eliminate) this incentive because it accounts for the magnitude of losses, not just their frequency.

Common Mistakes

These are the most frequent errors practitioners and students make when working with Expected Shortfall:

1. Confusing CVaR with worst-case loss — CVaR is the average loss in the tail, not the single worst outcome. In the example above, the worst single-day loss was $42,000, but the CVaR was $32,000. CVaR smooths across all tail observations, which makes it more stable but also means it is not a worst-case measure.

2. Confusing confidence level with tail probability — At 95% confidence, the tail is the worst 5% (1-α), not the worst 95%. This confusion leads to dramatically wrong CVaR estimates — averaging 95% of observations instead of 5% produces a near-average loss, not a tail measure.

3. Using the wrong confidence level — 95% CVaR and 99% CVaR are not interchangeable. At 99% confidence, the tail contains only the worst 1% of observations — producing a much larger CVaR. Always confirm which confidence level is being used when comparing CVaR estimates across sources or systems.

4. Too few tail observations — CVaR requires enough data in the tail to produce a stable average. With 100 trading days at 99% confidence, the tail contains just 1 observation — that is not an average, it is a single data point. Use at least 250-500 days for 95% CVaR and 1,000+ days for 99% CVaR to get meaningful estimates.

5. Assuming CVaR eliminates model risk — CVaR is a better risk measure than VaR in several respects, but it is still sensitive to the assumed return distribution. Parametric CVaR under a normal distribution will understate tail risk if returns are fat-tailed. Historical CVaR will understate risk if the historical window was unusually calm. The choice of estimation method matters.

6. Mixing sign conventions — Some sources define CVaR as a positive number representing the loss magnitude (e.g., CVaR = $32,000). Others define it as a negative return (e.g., CVaR = -3.2%). Mixing conventions within the same analysis causes errors. This article uses the loss-positive convention — a larger CVaR means a worse outcome.

Limitations of Expected Shortfall

1. More data-intensive — Accurately estimating a tail average requires more observations than estimating a single quantile. VaR needs enough data to identify the threshold; CVaR needs enough data to characterize the entire tail. With limited data, CVaR estimates are unstable.

2. Model-dependent — Parametric CVaR depends on the assumed distribution. Under a normal distribution, CVaR has a clean closed-form expression — but normal distributions understate tail risk. Fat-tailed distributions (e.g., Student’s t) produce higher CVaR estimates. Historical CVaR avoids distributional assumptions but is limited by the historical window.

3. Sensitive to extreme outliers — A single catastrophic observation can dominate the CVaR estimate, especially with limited data. When a new extreme loss enters the historical window (or an old one drops out), the CVaR estimate can jump discontinuously. This regime-sensitivity means CVaR should be monitored over time, not treated as a static number.

4. Harder to communicate — “The average loss in the worst 5% of outcomes is $32,000” is less intuitive to non-technical stakeholders than VaR’s “there is a 95% chance daily losses will stay below $24,000.” This communication gap sometimes leads organizations to report both VaR and CVaR side by side.

5. Not a complete risk framework — ES captures average tail behavior under the model’s assumptions, but it does not account for scenarios that have never occurred or that fall outside the model. Stress testing, scenario analysis, and maximum drawdown analysis complement CVaR by addressing different dimensions of risk. For a comprehensive view of portfolio risk, combine CVaR with measures like standard deviation (for overall volatility) and beta (for systematic risk exposure).