In the financial world, analysts devote considerable resources to evaluating the so-called value-at-risk (VaR). Although not exactly applicable to problems in security risk, the Value-at-risk offers lessons in understanding the likelihood and vulnerability components of security risk. The following figure illustrates this concept.

The probability distribution, which in this case takes the form of a so-called log-normal distribution, denotes losses on the horizontal axis versus the relative frequency of occurrence along the vertical axis. The extreme right portion of the curve (i.e., portfolio losses greater than 3%) is considered the Value-at-risk in worst case. In other words, there is a 1 in 100 chance that losses will be 3% or greater of the portfolio value. The total portfolio losses can be expected to exceed 3% on 1 out of 100 trading days.

Analysts are able to generate this curve because they have developed a financial model that (they hope) characterizes the value of assets in a portfolio based on factors that influence pricing. Because the value of stocks, bonds, options, etc., is measurable in tangible units (i.e., denominations of money), and financial analysts have faith in their model, they can determine their maximum exposure to portfolio loss with a specified confidence level. Value-at-risk

Notice that Value-at-risk does not specify the maximum exposure to loss. If you are really unskilled or just plain unlucky you can lose the whole portfolio, and that is not what Value-at-risk is measuring. Value-at-risk establishes confidence limits for potential loss. Recall our three coin flips where heads yields a $100 gain and tails results in a $50 loss. Although the coin flip example represents a highly simplified model, the same principle is used to develop a financial strategy. Value-at-risk

Clearly, the question of whether loss models so constructed are accurate in assessing risk is a legitimate one and serves to reinforce the fact that just because an analysis is quantitative does not mean life will turn out that way. There are indeed other lessons to be derived from the 2008–2009 global financial meltdown, but one of them is that genuinely rare events do occur.

Security professionals desire a similar tool to analyze their version of risk. An important caveat is that security risk assessments should not necessarily be focused on the monetary value of assets. The security professional must also protect human lives. Moreover, assets like technology and infrastructure-related items are usually not objects to be traded or sold like financial securities. However, estimates of potential loss based on appropriate statistical models of security incidents would likely be useful input for decision makers.

Over the past 20 years the value-at-risk analysis has become established as the industry and regulatory standard in measuring market risk. The demands placed on Value-at-risk and other similar techniques have grown tremendously, driven by new products such as correlation trading, multi-asset options, power-reverse dual currency swaps, swaps whose notional value amortizes unpredictably, and dozens of other such innovations. Value-at-risk

To keep up, the tools have evolved. For example, the number of risk factors required to price the trading book at a global institution has now grown to several thousand, and sometimes as many as 10,000. Valuation models have become increasingly complex. And most banks are now in the process of integrating new stress-testing analytics that can anticipate a broad spectrum of macroeconomic changes. Value-at-risk

Despite these accomplishments, Value-at-risk and other risk models have continually come up short. The 1998 crisis at Long Term Capital Management demonstrated the limitations of risk modeling. In the violent market upheavals of 2007–08, many banks reported more than 30 days when losses exceeded Value-at-risk, a span in which 3 to 5 such days would be the norm. In 2011, just before the European sovereign crisis got under way, many banks’ risk models treated eurozone government bonds as virtually risk free.

The essential choices in Value-at-risk design are the approach used to generate simulation scenarios (Monte Carlo versus historical simulation) and the valuation approach (full revaluation versus sensitivities). In the following sections, we explore the choices banks are making today, followed by a brief discussion of the growing importance of understanding Value-at-risk and the individual risks it comprises.

* Monte Carlo versus historical simulation* The Monte Carlo method is widely considered the better theoretical approach to simulation of risk. Its chief advantage is that it provides a more comprehensive picture of potential risks embedded in the “tail” of the distribution.

Moreover, it allows the bank to modify individual risk factors and correlation assumptions with some precision, making it a quite flexible approach. Proponents also argue for its greater consistency and synergies with other trading-book modeling approaches, such as the expected-potential-exposure (EPE) approach used for counterparty risk modeling.

But Monte Carlo, which typically requires about 10,000 simulations per risk factor, places a burden of complexity on the bank. Especially when used in combination with full revaluation, the result is often a computational bottleneck that leads to much longer reaction times compared with the easier but less accurate historical simulation.

In addition, many complain that it is a “black box,” which is not easily understood by either the businesses or management. As a result, only about 15 percent of banks surveyed use it as their main approach.

### Disclosure Shell plc, AR 2018 page 203 (as part of Financial Statements and supplements)

**Commodity price risk**

Certain subsidiaries have a mandate to trade crude oil, natural gas, LNG, refined products, chemical feed stocks, power and carbon-emission rights, and to use commodity derivative contracts (forwards, futures, swaps and options) as a means of managing price and timing risks arising from this trading activity. In effecting these transactions, the entities concerned operate within procedures and policies designed to ensure that risks, including those relating to the default of counter parties, are managed within authorised limits.

Risk management systems are used for recording and valuing instruments. Commodity price risk exposure is monitored, and the acceptable level of exposure determined, by market risk committees. There is regular reviewing of mandated trading limits by senior management, daily monitoring of market risk exposure using value-at-risk (Value-at-risk) techniques, daily monitoring of trading positions against limits, and marking-to-fair value of trading exposures with a department independent of traders reviewing the market values applied.

Although trading losses can and do occur, the nature of the trading portfolio and its management are considered adequate mitigants against the risk of significant losses.

Value-at-risk techniques based on Value-at-riskiance/coValue-at-riskiance or Monte Carlo simulation models are used to make a statistical assessment of the market risk arising from possible future changes in market values over a 24-hour period and within a 95% confidence level. The calculation of potential changes in fair value takes into account positions, the history of price movements and the correlation of these price movements. Models are regularly reviewed against actual fair value movements to ensure integrity is maintained.

The Value-at-risk year-end positions in respect of commodities traded in active markets, which are presented in the table below, are calculated on a diversified basis in order to reflect the effect of offsetting risk within combined portfolios.

### Disclosure Deutsche Bank AR 2018 page 72 – 73 (As part of Management Report)

**Market Risk Management**

**Market Risk framework**

The vast majority of our businesses are subject to market risk, defined as the potential for change in the market value of our trading and invested positions. Risk can arise from changes in interest rates, credit spreads, foreign exchange rates, equity prices, commodity prices and other relevant parameters, such as market volatility and market implied default probabilities.

One of the primary objectives of Market Risk Management, a part of our independent Risk function, is to ensure that our business units’ risk exposure is within the approved appetite commensurate with its defined strategy. To achieve this objective, Market Risk Management works closely together with risk takers (“the business units”) and other control and support groups.

We distinguish between three substantially different types of market risk: Value-at-risk

- Trading market risk arises primarily through the market-making and client facilitation activities of the Corporate & Investment Bank Corporate Division. This involves taking positions in debt, equity, foreign exchange, other securities and commodities as well as in equivalent derivatives. Value-at-risk
- Traded default risk arising from defaults and rating migrations relating to trading instruments. Value-at-risk
- Nontrading market risk arises from market movements, primarily outside the activities of our trading units, in our banking book and from off-balance sheet items.This includes interest rate risk, credit spread risk, investment risk and foreign exchange risk as well as market risk arising from our pension schemes, guaranteed funds and equity compensation. Non-trading market risk also includes risk from the modeling of client deposits as well as savings and loan products. Value-at-risk

Market Risk Management governance is designed and established to promote oversight of all market risks, effective decision making and timely escalation to senior management.

Market Risk Management defines and implements a framework to systematically identify, assess, monitor and report our market risk. Market risk managers identify market risks through active portfolio analysis and engagement with the business units. Value-at-risk

**Market Risk measurement**

We aim to accurately measure all types of market risks by a comprehensive set of risk metrics embedding accounting, economic and regulatory considerations. We measure market risks by several internally developed key risk metrics and regulatory defined market risk approaches. Value-at-risk

**Trading Market Risk**

Our primary mechanism to manage trading market risk is the application of our risk appetite framework of which the limit framework is a key component. Our Management Board, supported by Market Risk Management, sets group-wide value-at-risk, economic capital and portfolio stress testing limits for market risk in the trading book.

Market Risk Management allocates this overall appetite to our Corporate Divisions and individual business units within them based on established and agreed business plans. We also have business aligned heads within Market Risk Management who establish business limits, by allocating the limit down to individual portfolios, geographical regions and types of market risks.

Value-at-risk, economic capital and portfolio stress testing limits are used for managing all types of market risk at an overall portfolio level. As an additional and important complementary tool for managing certain portfolios or risk types, Market Risk Management performs risk analysis and business specific stress testing.

Limits are also set on sensitivity and concentration/liquidity, exposure, business-level stress testing and event risk scenarios, taking into consideration business plans and the risk vs return assessment.

Business units are responsible for adhering to the limits against which exposures are monitored and reported. The market risk limits set by Market Risk Management are monitored on a daily, weekly and monthly basis, dependent on the risk management tool being used.

**Internally developed Market Risk Models**

**Value-at-Risk (Value-at-risk)**

Value-at-risk is a quantitative measure of the potential loss (in value) of Fair Value positions due to market movements that should not be exceeded in a defined period of time and with a defined confidence level.

Our value-at-risk for the trading businesses is based on our own internal model. In October 1998, the German Banking Supervisory Authority (now the BaFin) approved our internal model for calculating the regulatory market risk capital for our general and specific market risks. Since then the model has been continually refined and approval has been maintained.

We calculate Value-at-risk using a 99 % confidence level and a one day holding period. This means we estimate there is a 1 in 100 chance that a mark-to-market loss from our trading positions will be at least as large as the reported Value-at-risk. For regulatory purposes, which include the calculation of our risk-weighted assets, the holding period is ten days.

We use one year of historical market data as input to calculate Value-at-risk. The calculation employs a Monte Carlo Simulation technique, and we assume that changes in risk factors follow a well-defined distribution, e.g. normal or non-normal (t, skew-t, Skew-Normal). To determine our aggregated Value-at-risk, we use observed correlations between the risk factors during this one year period.

Our Value-at-risk model is designed to take into account a comprehensive set of risk factors across all asset classes. Key risk factors are swap/government curves, index and issuer-specific credit curves, funding spreads, single equity and index prices, foreign exchange rates, commodity prices as well as their implied volatilities. To help ensure completeness in the risk coverage, second order risk factors, e.g. CDS index vs. constituent basis, money market basis, implied dividends, option-adjusted spreads and precious metals lease rates are considered in the Value-at-risk calculation.

For each business unit a separate Value-at-risk is calculated for each risk type, e.g. interest rate risk, credit spread risk, equity risk, foreign exchange risk and commodity risk. For each risk type this is achieved by deriving the sensitivities to the relevant risk type and then simulating changes in the associated risk drivers.

“Diversification effect” reflects the fact that the total Value-at-risk on a given day will be lower than the sum of the Value-at-risk relating to the individual risk types. Simply adding the Value-at-risk figures of the individual risk types to arrive at an aggregate Value-at-risk would imply the assumption that the losses in all risk types occur simultaneously.

The model incorporates both linear and, especially for derivatives, nonlinear effects through a combination of sensitivity-based and revaluation approaches.

The Value-at-risk measure enables us to apply a consistent measure across all of our fair value businesses and products. It allows a comparison of risk in different businesses, and also provides a means of aggregating and netting positions within a portfolio to reflect correlations and offsets between different asset classes. Furthermore, it facilitates comparisons of our market risk both over time and against our daily trading results.

When using Value-at-risk estimates a number of considerations should be taken into account. These include:

- The use of historical market data may not be a good indicator of potential future events, particularly those that are extreme in nature. This “backward-looking” limitation can cause Value-at-risk to understate future potential losses (as in 2008), but can also cause it to be overstated.
- Assumptions concerning the distribution of changes in risk factors, and the correlation between different risk factors, may not hold true, particularly during market events that are extreme in nature. The one day holding period does not fully capture the market risk arising during periods of illiquidity, when positions cannot be closed out or hedged within one day.
- Value-at-risk does not indicate the potential loss beyond the 99th quantile.
- Intra-day risk is not reflected in the end of day Value-at-risk calculation.
- There may be risks in the trading or banking book that are partially or not captured by the Value-at-risk model.

We are committed to the ongoing development of our internal risk models, and we allocate substantial resources to reviewing, validating and improving them. Additionally, we have further developed and improved our process of systematically capturing and evaluating risks currently not captured in our value-at-risk model.

An assessment is made to determine the level of materiality of these risks and material risks are prioritized for inclusion in our internal model. Risks not in value-at-risk are monitored and assessed on a regular basis through our Risk Not In Value-at-risk (RNIV) framework.

**Stressed Value-at-Risk**

Stressed Value-at-Risk (SValue-at-risk) calculates a stressed value-at-risk measure based on a one year period of significant market stress. We calculate a stressed value-at-risk measure using a 99 % confidence level. The holding period is one day for internal purposes and ten days for regulatory purposes.

Our SValue-at-risk calculation utilizes the same systems, trade information and processes as those used for the calculation of value-at-risk. The only difference is that historical market data and observed correlations from a period of significant financial stress (i.e., characterized by high volatilities) is used as an input for the Monte Carlo Simulation.

The time window selection process for the stressed value-at-risk calculation is based on the identification of a time window characterized by high levels of volatility in the top value-at-risk contributors. The identified window is then further validated by comparing the SValue-at-risk results to neighboring windows using the complete Group portfolio.

## Value-at-risk

*Annualreporting.info provides financial reporting narratives using IFRS keywords and terminology for free to students and others interested in financial reporting. The information provided on this website is for general information and educational purposes only and should not be used as a substitute for professional advice. Use at your own risk. Annualreporting.info is an independent website and it is not affiliated with, endorsed by, or in any other way associated with the IFRS Foundation. For official information concerning IFRS Standards, visit IFRS.org.*

```
```