Every VaR number on every risk dashboard is built around one assumption: returns are Gaussian. They aren’t. The fix has been in textbooks since 1937 and runs in a single line of code; almost no production risk system uses it. The reason is political.
The standard calculation
At any bank, asset manager, or quant shop, the calculation is the same one line. Take the portfolio’s trailing-window standard deviation. Multiply by 1.645 for 95% one-day VaR or 2.326 for 99%. The output feeds straight into the position-sizing layer, the margin engine, the risk-committee deck, the regulatory submission. No calibration step, no judgment call, no analyst between input and output.
It’s fast, blessed by Basel III’s standard internal-models approach, and trivially auditable. It is also structurally wrong: it assumes returns are Gaussian, and they never have been.
Two features of any real return distribution get dropped on the floor. Skewness: equity portfolios lose more on the bad days than they make on the good. Excess kurtosis: extreme moves of either sign are more frequent than a normal curve allows. Both push the actual fifth-percentile loss deeper into the tail than the formula will admit.
What the number means
Strip away the dashboards and VaR answers one concrete question: at what loss does the probability of doing worse fall to 5%? Or 1%, or 0.1% — pick the threshold that matches your appetite. Formally:
RT is the portfolio return over horizon T, α is the confidence level (0.95 and 0.99 do most of the work in practice), and the minus sign flips the quantile so VaR is reported as a positive loss.
The Gaussian shortcut replaces the unknown distribution of RT with a normal one matched on mean and variance, then reads the quantile off a standard-normal table: z0.95 = −1.645, z0.99 = −2.326.
That is the industry baseline. It is also the source of every bias downstream.
Where the assumption breaks
The Gaussian wants S = 0 and K = 3. Real portfolios aren’t close. SPX daily returns over the past twenty years cluster around S ≈ −0.4 (the left tail is fatter than the right) and K ≈ 9 to 12 (excess kurtosis of 6 to 9 above the Gaussian baseline). Individual stocks are worse. Concentrated portfolios are much worse. Crypto runs kurtosis into the dozens. Anything carrying embedded short-volatility exposure — vol-sellers, dispersion strategies, the rebalancing flow inside leveraged ETFs — combines heavy negative skew with extreme kurtosis at the same time.
How much it matters depends on which quantile you’re computing. At 95% the Cornish-Fisher correction on liquid US equity is modest — the skew and kurtosis terms partially cancel in the region around z = −1.65, and the corrected estimate lands within a few percent of the Gaussian. At 99% and deeper, the kurtosis term overwhelms everything else. The surface above quantifies it: at 99% with K ≈ 12 the corrected loss runs around twice the Gaussian; at 99.9% with the same K it runs around 3.5×; at 99.9% with crypto-grade K ≈ 22 it runs past 6×.
The correction
Cornish and Fisher published the fix in 1937 and tightened it in 1960. The expansion adjusts the standard-normal z-score to account for empirical skew and kurtosis:
Then VaR is just the modified-quantile formula:
Each term has a job. zα is the Gaussian baseline. (z2−1)·S/6 handles asymmetry — for negatively-skewed portfolios it pulls z̃ further into the loss tail. (z3−3z)·(K−3)/24 sharpens the tail when K exceeds 3. The cross-term −(2z3−5z)·S2/36 picks up the joint effect. That’s the entire correction. It fits on one line in any language and runs in constant time.
Run it for an SPX-typical portfolio — S = −0.5, K = 10 — at α = 0.99, the regulatory standard in most jurisdictions. The Cornish-Fisher z works out to z̃ ≈ −3.86. The Gaussian z0.99 is −2.326. The corrected loss estimate is 66% larger. At α = 0.999 the same portfolio gives z̃ ≈ −6.5, almost three times the Gaussian number. The surface plot earlier traces this across the full (confidence, kurtosis) grid; pick any corner and read off the multiplier.
How the gap behaves across regimes
In calm markets — realized skew near zero, kurtosis near 3 — the Cornish-Fisher and Gaussian estimates converge. The correction is in the noise, often inside 5%. This is the regime defenders point to when they say the Gaussian shortcut works fine in practice. It does. For most days, on most markets. The other days are why we’re having this conversation.
Normal equity sits at S between −0.3 and −0.5, K between 8 and 12. At 95% confidence the CF and Gaussian numbers stay within a few percent of each other. At 99% the gap opens to roughly 50%. Any sizing logic reading the 95% number is fine; anything reading 99% is structurally undersized in risk capital by half.
In stress, S drops past −0.7 and K climbs past 20. The estimates diverge sharply. The Gaussian number isn’t off by single digits anymore — it can be off by a factor of two at 99%, more at 99.9%. A dashboard quoting one VaR through a regime transition is reporting a number whose meaning quietly changed underneath it. Nothing on the dashboard says so.
Why this matters operationally
Everything downstream of VaR inherits the bias. Position sizing first: Kelly and its descendants compute weight as expected-return over some risk number, and if that risk number is too small the position is too large in lockstep. A model claiming a 1.5% edge against a 2% VaR holds twice the position of the same model evaluated against a 4% VaR. The choice between those two numbers is not taste — it changes the size of every trade in the book.
Stops and margin reserves carry the same bias. A drawdown past the Gaussian 99% interval gets labelled a “five-sigma event” — a phrase that ought to mean “should not occur in the lifetime of the universe” and that in fact means “every two or three years in equities.” When the risk model insists the event shouldn’t have happened, the operator is left without a playbook. With a tail estimated honestly, the same event is rare but expected, and the response is part of the system’s design rather than an emergency added at 4 am.
Backtest interpretation is the quieter cost. Reporting Sharpe or max-drawdown against a Gaussian VaR baseline confounds two different things: the strategy’s actual skill at avoiding losses, and the metric’s blindness to the loss distribution. A strategy that “outperforms on a risk-adjusted basis” under Gaussian VaR may simply be running identical risk in a worse-measured way. Switching to a Cornish-Fisher baseline doesn’t fix the strategy — it stops the metric from lying about it.
The historical record
October 19, 1987 was a twenty-sigma move against the Gaussian baseline of the prior decade. Its Gaussian probability is zero to many decimal places. LTCM imploded in September 1998 on a sequence of Russian-default-driven moves their own VaR model rated as effectively impossible. 2008 was a parade of model breaches whose backtests had passed cleanly, because the backtests used the same Gaussian assumption that was breaking under them in production. March 2020 was the most recent live demonstration: a 3% daily equity move is routine under Cornish-Fisher and still gets classified as a “tail event” by every Gaussian dashboard that watched it happen.
This is not new information. The Cornish-Fisher expansion sits in the back of every graduate econometrics textbook. It’s absent from production risk systems because the Gaussian baseline is what regulators ask for, what off-the-shelf risk packages ship with, and what risk committees have been reading for thirty years. Switching the formula changes position sizes, changes margin requirements, changes the Sharpe ratios senior management reports up the chain. The friction is institutional, not technical — which is why it persists.
The correction doesn’t buy precision; the third and fourth moments are noisy, and the expansion has well-known instabilities at low confidence levels. What it buys is honesty. The loss number on the dashboard becomes a number with the right order of magnitude for the regime the data is currently in. Everything downstream — position sizing, stops, margin, Sharpe — gets to mean what it says.
Both numbers, every cycle
Quark’s model-portfolio risk monitor publishes Gaussian and Cornish-Fisher VaR side by side. The spread between them — narrow in calm regimes, wide in stress — is itself a signal. Position sizing reads the corrected number.
View Model Portfolio Follow on X