Skip to content

FRM Exam Part II · Validating Bank Holding Companies' Value-at-Risk Models for Market Risk

Backtesting VaR Models and Counting Exceptions

Updated 11 October 2026 · Fact-checked

Backtesting compares each day's VaR forecast with that day's actual trading P&L. A day when the loss is larger than VaR is an exception. You count exceptions over a window, then judge whether that count fits the confidence level. At 99% VaR over 250 days, you expect about 2.5 exceptions.

Understand Backtesting VaR Models and Exception Counting

A VaR number is a forecast. A 1-day 99% VaR of $10 million says that a loss above $10 million should happen on about 1% of days. Backtesting checks whether that claim holds in real data.

The method is simple. Each day you record the VaR forecast made at the start of the day. At the end of the day you record the actual trading P&L. If the loss is bigger than VaR, you record an exception (also called an exceedance or a breach). Then you count exceptions over a window, often 250 trading days.

If the model is right, each day is a Bernoulli trial with probability of an exception equal to 1 − confidence level. Over T days, the number of exceptions follows a binomial distribution with parameters T and p. The expected count is T × p. Too many exceptions suggest the model understates risk. Too few suggest it is too conservative and ties up capital.

The P&L you use matters. Dirty (actual) P&L includes everything: intraday trading, fees, commissions and reserve changes. Clean (hypothetical) P&L holds the end-of-previous-day portfolio fixed and revalues it with the new day's market moves. Clean P&L tests the model itself. Dirty P&L shows what the bank really lost. Supervisors usually look at both. Using clean P&L is the better test of model accuracy because intraday trades are not in the VaR forecast.

A count alone has limits. Exceptions that cluster together in a few days are a warning even if the total looks fine. That is why independence tests exist, and why the Basel traffic light system is only a first screen.

Key formulas to remember

Exception probability
p = 1 − confidence level
For 99% VaR, p = 0.01. For 95% VaR, p = 0.05.
Expected number of exceptions
E(N) = T × p
T is the number of days in the backtest window. 250 days at 99% gives 2.5.
Standard deviation of exception count
σ(N) = √(T × p × (1 − p))
Binomial standard deviation. 250 days at 99% gives about 1.57.
Exception rate
x ÷ T
Observed exceptions x divided by days T. Compare it with p.
Z-score (normal approximation)
z = (x − T × p) ÷ √(T × p × (1 − p))
Rough test only. It works poorly for small p and small T. Reject at 5% (two-sided) if |z| > 1.96.
Kupiec unconditional coverage (POF) statistic
LR_uc = −2 ln[(1 − p)^(T − x) × p^x] + 2 ln[(1 − x/T)^(T − x) × (x/T)^x]
Compared with chi-square with 1 degree of freedom. 5% critical value is 3.84. It tests only the frequency of exceptions, not their timing.
Basel traffic light zones (250 days, 99% VaR)
Green: 0 to 4 exceptions. Yellow: 5 to 9. Red: 10 or more.
Multiplier add-on to the capital multiplier rises through the yellow zone. Red zone normally gives the maximum add-on and the model is presumed flawed.

How to solve Backtesting VaR Models and Exception Counting questions

Use this order for any exception counting question. It works for Kupiec, traffic light and interpretation questions.

  1. 1Write down the VaR confidence level and compute p = 1 − confidence level.
  2. 2Note the window length T and the number of exceptions x. Check that you count a day only if the loss exceeds VaR.
  3. 3Check which P&L is used. Clean P&L tests the model. Dirty P&L includes intraday trades and fees.
  4. 4Compute the expected exceptions T × p and compare with x.
  5. 5If the question gives a test, apply it: z-score, Kupiec chi-square against 3.84, or the traffic light zone.
  6. 6State the conclusion: reject or do not reject the model, or name the zone.
  7. 7Add the interpretation: too many exceptions means risk is understated, too few means the model may be too conservative. Mention clustering if the dates are given.

Quickest way: Fast exception check

When to use it: Use it when the question gives T, the confidence level and an exception count and asks whether the model is acceptable.

  1. Compute T × p in your head. For 250 days at 99%, expect 2.5. At 95%, expect 12.5.
  2. Is the count in the green zone (0 to 4) for 99% and 250 days? If yes, a traffic light question is answered.
  3. For a rough statistical check, find the standard deviation √(T × p × (1 − p)) and see if x is within about two of the expected value.
  4. If options include a Kupiec value, compare with 3.84 and eliminate options that do not match the direction.
  5. Check the P&L type last. Clean P&L is the answer when the question asks which P&L best tests the model.

Common mistakes in Backtesting VaR Models and Exception Counting

  • Using the wrong p, for example 0.99 instead of 0.01.

    The confidence level is written as 99%, so students plug it straight in.

    Fix: Always write p = 1 − confidence level first. The exception probability is the tail.

  • Treating the traffic light zones as applying to any window or any confidence level.

    Students memorise 0 to 4, 5 to 9 and 10 or more without the conditions.

    Fix: State that these zones are for 250 days of 99% one-day VaR. Other setups need the binomial distribution.

  • Saying zero exceptions proves the model is good.

    Fewer breaches feel safer.

    Fix: Too few exceptions mean VaR is too high and capital is overstated. Statistical tests can reject a model with too few exceptions.

  • Thinking Kupiec tests whether exceptions are independent.

    Both Kupiec and Christoffersen appear in the same chapters.

    Fix: Kupiec tests only the number of exceptions (unconditional coverage). Independence is tested by Christoffersen.

  • Mixing up clean and dirty P&L.

    Both are called trading P&L.

    Fix: Clean (hypothetical) P&L freezes the portfolio and strips out fees and intraday trades. Dirty (actual) P&L includes them. Clean P&L isolates model error.

  • Counting a day as an exception when the loss equals or is below VaR, or counting gains.

    Students confuse the sign convention of VaR and P&L.

    Fix: An exception needs a loss strictly larger than VaR. Compare the size of the loss with the VaR figure, not the raw P&L sign.

Worked examples

Example 1

A bank backtests its 1-day 99% VaR over 250 trading days and records 7 exceptions. (a) How many exceptions are expected? (b) Which Basel traffic light zone applies? (c) What does this suggest?

Show the solution
  1. p = 1 − 0.99 = 0.01.
  2. Expected exceptions = 250 × 0.01 = 2.5.
  3. Seven exceptions fall in the range 5 to 9, which is the yellow zone.
  4. Seven is well above 2.5, so the model may understate risk, although the yellow zone does not mean the model is certainly wrong.

Answer: Expected: 2.5 exceptions. Zone: yellow. The model may understate risk, and supervisors may apply a higher capital multiplier.

Example 2

A desk uses 95% 1-day VaR over 500 days and records 40 exceptions. Using the normal approximation, compute the z-score and say whether the model is rejected at the 5% two-sided level.

Show the solution
  1. p = 0.05, T = 500.
  2. Expected exceptions = 500 × 0.05 = 25.
  3. Standard deviation = √(500 × 0.05 × 0.95) = √23.75 = 4.873.
  4. z = (40 − 25) ÷ 4.873 = 3.078.
  5. Compare with 1.96. Since 3.08 is greater than 1.96, reject.

Answer: z ≈ 3.08, which is above 1.96, so the model is rejected. It has too many exceptions and understates risk.

Exam tips

  • Convert the confidence level into p first. Many wrong answers come from this one step.
  • Remember the zone boundaries only for 250 days at 99%: green 0 to 4, yellow 5 to 9, red 10 or more.
  • When a question asks which P&L isolates model error, answer clean (hypothetical) P&L.
  • If exception dates are given and they cluster, say the model fails independence even if the count passes.
  • Read the direction: too many exceptions means VaR is too low. Too few means VaR is too conservative.

Practice questions from Validating Bank Holding Companies' Value-at-Risk Models for Market Risk

Backtesting VaR Models and Exception Counting in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Backtesting VaR Models and Exception Counting: frequently asked questions

What is an exception in VaR backtesting?

It is a day when the actual loss is larger than the VaR forecast for that day. At 99% VaR you expect exceptions on about 1% of days. Counting them over a window lets you test the model.

What is the difference between clean P&L and dirty P&L?

Clean (hypothetical) P&L revalues the previous day-end portfolio using the new day's market moves. Dirty (actual) P&L also includes intraday trades, fees and reserve changes. Clean P&L is better for testing the model, and dirty P&L shows true results.

What does the Kupiec test check?

The Kupiec proportion of failures test checks whether the observed exception rate equals the rate implied by the confidence level. It uses a chi-square statistic with 1 degree of freedom. It does not test whether exceptions are clustered.

How does the Basel traffic light approach work?

It sorts a model into green, yellow or red based on the number of exceptions over 250 days at 99% VaR. Green is 0 to 4, yellow is 5 to 9 and red is 10 or more. The zone drives the capital multiplier add-on.