What are the three main sources of model risk in VaR, and how can each one cause VaR to be wrong?

Model risk in VaR refers to the possibility that the VaR estimate is inaccurate because of flaws in how it is built, calibrated, or used. GARP's FRM curriculum identifies three primary sources:

Source 1: Incorrect Model Specification

The mathematical framework itself is wrong or inappropriate for the portfolio.

Examples:

• Using a normal distribution for returns that exhibit fat tails (underestimates tail risk)
• Using delta-normal VaR for a portfolio with large option positions (ignores gamma and convexity)
• Assuming constant correlations when correlations spike during crises
• Using a linear factor model for instruments with non-linear payoffs

Consequence: The VaR number is systematically biased. For a normal assumption on fat-tailed data, VaR at 99% might underestimate true risk by 30-50%.

Source 2: Incorrect Parameter Estimation

The model form is correct, but the parameters (volatilities, correlations, means) are estimated poorly.

Examples:

• Using a lookback window that's too short — captures recent regime but misses historical extremes
• Using a lookback window that's too long — includes irrelevant data (pre-crisis correlations dilute post-crisis reality)
• Stale data — using yesterday's prices for illiquid instruments that haven't traded in weeks
• Survivorship bias — excluding defaulted securities from the historical dataset

Consequence: VaR swings unpredictably as parameters change, or it consistently under/overestimates risk depending on the calibration window.

Source 3: Implementation / Coding Errors

The model is correctly specified and calibrated, but there are bugs or operational mistakes.

Examples:

• Mapping errors — a position is assigned the wrong risk factor
• Sign errors — a short position is treated as long
• Missing positions — newly traded instruments not yet in the risk system
• Day-count mismatches — using actual/365 when the instrument uses 30/360
• Data feed failures — prices not updating, causing VaR to appear artificially stable

Consequence: VaR can be wildly wrong in either direction, and the error may go undetected until a major P&L break.

Mitigants

1. Backtesting — compare VaR predictions to actual P&L; too many exceptions signals model problems
2. Stress testing — captures scenarios the VaR model might miss
3. Model validation — independent review of model assumptions, code, and calibration
4. Multiple VaR approaches — run parametric, historical sim, and Monte Carlo in parallel

For more on VaR methodology and model risk, explore our FRM course.