Seven Exceptions in the Yellow Zone: Is the VaR Model Fine?
A bank's internal model produces a 1-day 99% VaR. Over the last 250 trading days there were 7 exceptions (days when the loss exceeded VaR). All 7 occurred in a single 5-day window during a volatility spike; outside that window there was one exception in the remaining 245 days. Desk A and Desk B report standalone 1-day 99% VaR of $10 million and $15 million, and the risk system reports a combined diversified VaR of $20.4 million using an assumed correlation of 0.30 estimated from two years of daily P&L. The board has asked the CRO whether "the model is fine because 7 exceptions is inside the yellow zone" and whether the diversification benefit is defensible.
1. Compute the expected number of exceptions, state the supervisory zone and resulting multiplier, and assess the claim that the model is fine.
Read the worked answer
Expected exceptions = 250 × 1% = 2.5. Observed = 7, i.e. a 2.8% exceedance rate against a 1% target.
Basel backtesting zones (250 days, 99%):
- Green: 0–4 exceptions, plus factor 0.00
- Yellow: 5–9 exceptions, plus factor 0.40 (5), 0.50 (6), 0.65 (7), 0.75 (8), 0.85 (9)
- Red: 10+, plus factor 1.00 and supervisory action
So 7 exceptions is yellow, and the capital multiplier rises from 3.00 to 3.65 (a ~22% increase on the VaR-based component). "Inside the yellow zone" is not a clean bill of health; it is a supervisory penalty.
Why the clustering is the real problem. Under the independence assumption, exceptions cluster with probability far below what was observed: all 7 inside a 5-day window means the model was not slow on average, it was blind during the stress episode. A model can pass a count-based test and still be unusable for limit-setting. Outside the window the model had 1 exception in 245 days - consistent with 1% almost exactly. The failure is in the tail regime, precisely where the model's job is hardest.
Also check before concluding:
- Actual vs hypothetical P&L. If the exceptions are driven by intraday trading, fees, or reserves, the model may be correctly measuring market risk but being compared against the wrong P&L.
- Exception magnitude, not just count: an exception that is 3× VaR costs far more capital than one that is 1.05×.
- Model vintage. If the volatility spike followed a long calm period, an equally weighted or short-window model responds faster than a 500-day historical simulation.
Verdict: the model is not "fine". It is yellow-zone, it fails in the regime that matters, and it should be remediated and revalidated rather than defended.
2. Verify the combined VaR figure and assess whether the reported diversification benefit is defensible.
Read the worked answer
Check the aggregation. For two desks with correlation ρ = 0.30:
VaR_combined = √(10² + 15² + 2 × 0.30 × 10 × 15) = √(100 + 225 + 90) = √415 = $20.37 million
That matches the reported $20.4 million, so the arithmetic is right. The reported diversification benefit is 25.0 − 20.4 = $4.6 million (18%).
Why the number is nevertheless fragile:
- Correlation is regime-dependent. The 0.30 was estimated over two years that evidently included calm periods. In a stress episode (see the 5-day exception window) correlations across desks rise toward 1, and the diversified VaR converges to the $25 million undiversified sum - a 23% increase in the number overnight.
- VaR is not subadditive in general. Elliptical assumptions make the square-root formula look safe, but with fat tails and short options the true portfolio VaR can exceed the sum of components. The formula assumes the joint distribution is well specified; it is not a theorem.
- Tail dependence is invisible to a correlation coefficient. Two desks can have 0.30 correlation on ordinary days and still lose together in the tail. Only a copula or a stress/scenario approach captures that.
- Correlation estimated on P&L is contaminated by exactly the stale pricing and model limits already flagged.
Recommendation. Book the diversification benefit only with (a) a stressed correlation floor applied for capital purposes, (b) a regular backtest of the combined figure, not just the desks, and (c) an explicit tail-dependence or scenario overlay. Report both the diversified and the sum-of-components numbers to the board, with the assumption stated.
3. The CRO has one quarter to fix the model. What should the remediation plan prioritise, and how should the model be judged at the end of it?
Read the worked answer
Priorities, in order of risk reduction per unit of effort:
- Regime responsiveness. The failure is a lag: 7 of 8 exceptions came in one week. Shorten the effective estimation window or use a volatility-weighted / EWMA-filtered historical simulation so that the VaR reacts within days rather than months. Validate against the stress week specifically, not just the full 250 days.
- Tail methodology. Move the capital measure from VaR to expected shortfall for internal limit-setting (ES is subadditive and responds to the size of exceptions, not just their count), while retaining VaR for the regulatory calculation.
- Stressed calibration for the diversified total. Apply a stressed correlation floor and a stress-period scaling to the aggregate, and reconcile the combined number to the sum of the desks under the stress scenario.
- Data hygiene. Reconcile actual vs hypothetical P&L, remove intraday effects from the backtest series, and document any desk whose marks are appraisal-based.
- Governance. Pre-commit to a response ladder: e.g. one exception triggers a review; a cluster of three within ten days triggers an automatic add-on to limits.
How to judge success at quarter-end:
- Re-run backtesting on a holdout period including at least one stress episode: target is not zero exceptions (a 1% model should produce ~2.5 in 250 days) but no clustering and exceptions that are small in magnitude.
- Confirm the multiplier falls back to 3.00 only if the forward-looking test is clean - not by re-weighting the historical window until the count improves.
- Independent validation sign-off on the stress-week behaviour, and board-level reporting of both diversified and undiversified VaR.
The standard is not "did we pass the traffic light" but "would this model have constrained risk-taking during the week it failed."