Historical Simulation VaR: take the past N days of portfolio returns, sort from worst to best, and select the return at the desired percentile. For 99% 1-day VaR with 500 days of history, the 5th worst return (1% of 500) is the VaR estimate. This method makes no distribution assumptions and automatically captures non-normality, but it assumes future market conditions will resemble past conditions — an assumption that breaks down in novel crisis environments.

Parametric (Variance-Covariance) VaR: assume returns are normally distributed and use the portfolio's mean and standard deviation to calculate the VaR analytically. For 99% VaR, multiply the portfolio's daily standard deviation by 2.33 (the z-score at the 1% tail of a normal distribution). This is fast and transparent but understates VaR for assets with fat-tailed distributions — precisely the conditions that matter most. Monte Carlo VaR simulates thousands of return scenarios using assumed statistical models, allowing more complex dependency structures but inheriting any errors in the model assumptions.

VaR's most serious limitation is that it says nothing about the magnitude of losses that exceed the threshold. Two portfolios can have identical 99% VaR but radically different worst-case outcomes: one might lose slightly more than the VaR in the 1% scenario; the other might lose three or four times the VaR because of concentrated positions or options exposure. Conditional Value at Risk (CVaR), also called Expected Shortfall, addresses this by measuring the average loss given that the VaR threshold is exceeded.

CVaR is always worse than VaR — it measures the expected loss in the tail beyond the VaR threshold, not just the boundary of that tail. For a 99% VaR, CVaR is the average of the worst 1% of outcomes. CVaR is increasingly preferred in academic and regulatory risk management over VaR because it captures tail risk more completely and has better mathematical properties (it is 'coherent' — satisfies diversification-friendly axioms that VaR violates). Basel III regulations require banks to use Expected Shortfall rather than VaR for internal models.

VaR is used for position limits (no position can add more than X to 1-day 99% VaR), portfolio-level risk reporting (board and risk committee reporting), regulatory capital allocation (Basel framework mandates VaR-based capital requirements for trading books), and performance attribution (decomposing which positions contribute most to total portfolio VaR).

The most dangerous misuse of VaR is treating it as a worst-case loss rather than as a statistical threshold that will be exceeded roughly 1% of the time (approximately 2-3 trading days per year for a 99% metric). The 2008 financial crisis demonstrated catastrophically that investment banks whose models showed well-controlled VaR had exposures to correlated risks that materialized simultaneously — producing losses many times their VaR estimates. Risk managers who understood VaR's assumptions and limitations hedged tail risk separately through options or credit protection; those who treated VaR as their full risk picture suffered catastrophic losses.