# Cash Flow at Risk (CFaR) Explained

Source: https://gravam.com/blog/cash-flow-at-risk-cfar
Author: Tan Gravam
Published: 2026-07-24
Updated: 2026-09-02
Reviewed: 2026-09-02
Summary: Cash Flow at Risk measures the worst shortfall in a company's cash flow versus plan over a period at a chosen confidence level — the corporate answer to VaR.

**Cash Flow at Risk (CFaR) measures the largest shortfall a company might see in its cash flow — or its earnings — over a defined period at a chosen confidence level.** It's the corporate-treasury cousin of Value at Risk, but it answers a different and, for most companies, far more useful question: not "how much could the mark-to-market value of our portfolio move today?" but "how bad could our cash flow be versus the plan we're relying on?" That shift — from portfolio value to cash against budget — is the whole point, and it's why CFaR fits a corporate treasury in a way that [VaR](https://gravam.com/blog/value-at-risk-var-in-treasury) often doesn't.

_(This is a plain explanation of a measurement concept, not investment or hedging advice for any particular situation.)_

## What CFaR actually measures

VaR was built for trading desks. It answers: over a short horizon — a day, a few days — how much could the value of this portfolio fall, at a given confidence level? That's the right question when your positions are revalued constantly and you can trade out of them in the morning.

A corporate treasury isn't a trading desk. Its exposures aren't tradeable positions revalued each night — they're the currency its sales come in, the floating rate on its debt, the cost of an input it buys. What the business cares about is whether the _cash it planned for_ actually arrives. CFaR answers exactly that: over a period — usually a quarter or a year — what's the worst shortfall in cash flow (or earnings) we might realistically see against plan, at, say, a high confidence level? It's the same statistical machinery as VaR — a worst outcome at a confidence level — pointed at cash flow instead of portfolio value, and stretched over months instead of days.

The term isn't loose usage. RiskMetrics Group defined it in the _CorporateMetrics Technical Document_ (first edition, April 1999), alongside Earnings-at-Risk, as:

> Cash-Flow-at-Risk (CFaR). The maximum shortfall of net cash generated, relative to a specified target, that could be experienced due to the impact of market risk on a specified set of exposures, for a specified reporting period and confidence level.

Four things in that sentence are load-bearing, and each one is a place I've seen a CFaR go wrong. **Relative to a specified target** — it's a shortfall against a plan, not against zero, so if nobody agrees what the target is there is no measure. **Due to the impact of market risk** — it prices rates and prices moving, not customers paying late; that's a different discipline. **On a specified set of exposures** — the number covers what you put in it and nothing else. **For a specified reporting period and confidence level** — a CFaR quoted without both parameters is not a number, and the table below shows how far apart two legitimate answers can sit.

## Why it fits corporates better than VaR

I've watched treasuries try to run their FX and rate risk on a VaR number lifted from a bank, and it rarely tells them anything they can act on. The horizon is wrong, and the thing being measured is wrong.

Think about what a corporate is exposed to. Its foreign-currency revenues land over quarters. Its floating-rate interest cost accrues over the life of a facility. Its budget was built at a set of rates months before the cash shows up. None of that behaves like a trading book you mark to market at 5pm, so a one-day change in portfolio value is close to meaningless — the business will still be sitting on the same exposure tomorrow, and the day after.

CFaR lines up with how the business is actually run and funded. It's expressed in the currency of the plan: cash, earnings, budget rate. When a treasurer tells a CFO "at 95% confidence our cash flow won't come in more than _X_ below plan over the year," that's a sentence the CFO can do something with. A VaR figure on a notional portfolio usually isn't.

> VaR asks what your portfolio could lose overnight. CFaR asks what your cash flow could miss against plan over the year. For a company that lives on the second question, the first one is answering the wrong exam.

## CFaR vs VaR vs EaR

Three measures get used interchangeably in treasury conversations and they answer three different questions. The definitions below are the source documents' own — CFaR and EaR from CorporateMetrics, VaR from the RiskMetrics Technical Document that CorporateMetrics was built to complement.

| Measure | What it measures | Typical horizon | What's "at risk" | Whose question it answers |
| --- | --- | --- | --- | --- |
| **CFaR** — Cash-Flow-at-Risk | Shortfall in net cash generated versus a specified target, caused by market-rate moves | The plan's reporting period; CorporateMetrics targets 2 to 24 months or beyond | Cash against plan | The treasurer asking whether the cash the business is funded against actually turns up |
| **EaR** — Earnings-at-Risk | Shortfall in earnings versus a specified target, caused by market-rate moves | Same — the reporting period the target was set for | Reported earnings against plan (per share, it's EPSaR) | The CFO asking whether a number already given to the board survives the rates moving |
| **VaR** — Value-at-Risk | Fall in the mark-to-market value of a portfolio of financial instruments | One day or one month, as RiskMetrics frames it | Portfolio value, measured in absolute terms rather than against a target | The desk asking how much a book could lose before it can be traded out of |

The split that matters is the last two columns. CFaR and EaR are **relative** measures — risk against a target the business already committed to — while VaR is an **absolute** one, a loss against today's mark. That's why a bank-style VaR lands flat in a corporate meeting: nobody in the room is managing a mark. CFaR and EaR differ only in which line of the plan they protect, cash or earnings, and for a company where cash and recognised earnings land in different periods those two numbers genuinely differ — CorporateMetrics makes exactly that point about a payment terms lag between an expense and the cash that settles it.

## How it's estimated, at a high level

You don't need the formulas to understand the shape of it. The estimation runs in three conceptual steps:

1. **Model the exposures.** Lay out the things that turn market moves into cash-flow moves — [FX-denominated flows](https://gravam.com/blog/fx-risk-transaction-translation-economic-exposure) (revenues, costs, intercompany settlements in foreign currency), floating-rate costs, and any other price the business is exposed to. This is where the forecast lives: CFaR needs a view of _what_ cash is expected, _when_, and _in what currency or rate_.
2. **Simulate market scenarios.** Generate a range of plausible futures for the relevant rates and prices — the currencies move, the reference rate moves — using whatever method fits (historical behaviour, a statistical model, [scenario sets](https://gravam.com/blog/stress-testing-and-scenario-analysis-treasury)). The point is to explore not one outcome but a distribution of them.
3. **Look at the distribution of resulting cash flows.** Push each scenario through the exposures and you get a spread of possible cash-flow outcomes against plan. CFaR is read off the bad tail of that distribution — the shortfall you wouldn't expect to exceed at your chosen confidence level.

That's the concept. The sophistication lives in how carefully you model exposures and simulate scenarios, but the intuition never changes: exposures plus scenarios gives a distribution of cash flows, and CFaR is how bad the tail of that distribution gets.

## A worked example, on assumed numbers

Those three steps describe a simulation, and a simulation needs a model. There's a parametric shortcut that doesn't, and it's worth knowing because it's how a first CFaR usually gets built — in a spreadsheet, before anyone has bought anything. Collapse the exposure to a single net amount, allow one risk factor, assume its returns are normally distributed, and the number falls out of a multiplication.

**The inputs below are assumed, for illustration. They are not a benchmark, not an observed market volatility, and not a recommendation** — the point is the arithmetic, not the figures.

Assume a euro-functional company with:

- **Net exposure over the next 12 months:** USD 40,000,000 of receipts, unhedged
- **Annualised volatility** assumed for the currency pair: 8%
- **Confidence level:** 95%, one-tailed, so z = 1.645

The formula is the parametric VaR formula pointed at a cash flow instead of a portfolio:

```text
CFaR ≈ net exposure × annualised volatility × √(horizon in months ÷ 12) × z
```

Over the full 12 months the square-root term is √(12 ÷ 12) = 1, so it drops out and two multiplications are left:

```text
40,000,000 × 0.08       = 3,200,000    ← one standard deviation, over a year
 3,200,000 × 1.645      = 5,264,000    ← the 95% one-tailed figure
```

**CFaR ≈ USD 5,264,000** — 5,264,000 ÷ 40,000,000 = 13.2% of the exposure. Quote it the way the definition demands, with both parameters attached: on these assumptions, cash from that exposure comes in more than USD 5.26m below a plan struck at today's rate in about one year in twenty.

Now vary the two parameters that a CFaR is meaningless without. Every cell is the same USD 40m exposure and the same 8% volatility; only the confidence level and the horizon change.

| Confidence level | 3 months (√0.25 = 0.5) | 6 months (√0.5 ≈ 0.7071) | 12 months (√1 = 1) |
| --- | --- | --- | --- |
| **90%** (z = 1.282) | 2,051,200 | 2,900,835 | 4,102,400 |
| **95%** (z = 1.645) | 2,632,000 | 3,722,211 | 5,264,000 |
| **99%** (z = 2.326) | 3,721,600 | 5,263,137 | 7,443,200 |

_USD, rounded to the nearest dollar in the 6-month column. The z-values are the standard-normal critical values published in the NIST/SEMATECH e-Handbook: 1.282 for p = 0.900, 1.645 for p = 0.950, 2.326 for p = 0.990. RiskMetrics used the rounded 1.65 for 95% throughout its 1996 Technical Document; on the 12-month figure here that rounding is worth 3,200,000 × 0.005 = 16,000._

Two things fall out of that grid that are worth carrying around.

**Time enters as a square root, not as a multiple.** Going from 3 months to 12 quadruples the horizon but only doubles the number — √4 = 2, and 2,632,000 × 2 = 5,264,000. Annualise a quarterly risk figure by multiplying it by four and you report 10,528,000 where the same assumptions give 5,264,000 — twice the risk that's actually there.

**Raising confidence costs about the same as doubling the horizon.** 2.326 ÷ 1.645 = 1.414, and √2 = 1.414 — the same factor. Which is why 99% over 3 months (3,721,600) and 95% over 6 months (3,722,211) come out within 611 of each other: two completely different questions, one indistinguishable answer. If someone hands you a CFaR without its horizon and confidence level, that grid is what they've hidden.

### Why this is a planning aid, not a promise

The multiplication buys its simplicity with three assumptions, and all three are wrong to some degree.

- **Normality.** A z-value only converts a confidence level into a number of standard deviations if the returns are normally distributed. Real currency and rate returns have fatter tails than that, so the parametric figure understates the bad end — the identical criticism that lands on variance-covariance [VaR](https://gravam.com/blog/value-at-risk-var-in-treasury).
- **Square root of time.** Scaling volatility by √t assumes each period's move is independent of the last and drawn from the same distribution. Trends and mean reversion both break it, and over a 12-month horizon there's plenty of room for either.
- **One factor, one amount.** A real exposure is several currencies and rates, arriving on a schedule, partly hedged, correlated with each other and sometimes with the volumes themselves. Collapsing that to one number and one volatility throws away the interactions, which is exactly where the risk that surprises people tends to live.

That's why CorporateMetrics doesn't do it this way. Its method is the three-step one above: map the exposures, generate scenarios, revalue, then rank the resulting outcomes and read the percentile straight off them — at 95% confidence across 1,000 trials, the 50th-worst result. A simulation copes with fat tails, with correlations between factors, with timing, and with hedges that pay off non-linearly. The multiplication copes with none of that.

So use the arithmetic for what it's good for: sizing the thing before you've built anything, and sanity-checking a model that hands you a number ten times larger than you expected. It tells you how big the risk is _on the assumptions you fed it_. It does not tell you what will happen, and the gap between those two sentences is the whole of the caveat below.

## What treasurers use it for

CFaR earns its place because it feeds real decisions:

- **Setting hedge ratios.** If the potential shortfall is bigger than the business can stomach, that's the case for hedging more of the exposure — and CFaR sizes how much.
- **Protecting a budget rate.** When the plan was struck at a given FX or interest rate, CFaR quantifies how exposed that budget is to the rate moving against you before the cash lands.
- **Deciding how much risk to carry.** Risk management is about staying [within appetite, not chasing zero](https://gravam.com/blog/what-is-treasury-risk-management). CFaR turns "how much FX and rate risk are we comfortable carrying?" into a number you can hold against a limit.
- **Board reporting.** It states risk in cash-versus-plan terms a board already thinks in, which makes the risk conversation land rather than glaze over.

## The honest limits

Here's the part the textbooks underplay: **CFaR is only as good as the forecast underneath it.** The whole measure is built on a view of what cash is expected and when — so if that forecast is soft, every number downstream is soft too. Feed it a wishful [cash-flow forecast](https://gravam.com/blog/13-week-cash-flow-forecast) and CFaR becomes theatre: a precise-looking figure resting on a guess. I'd trust a rough CFaR on a disciplined forecast long before a sophisticated one on a forecast nobody stands behind.

The scenario assumptions carry the same warning. CFaR reflects the range of market moves you told it to consider; if reality serves up something outside that range, the measure quietly understates the risk. It's a tool for framing and sizing risk, not a promise about the future.

Used honestly, though, CFaR is one of the most useful things treasury can put in front of a CFO or a board: risk stated in the currency of the plan the business actually runs on. Pair it with its portfolio-value counterpart in [Value at Risk](https://gravam.com/blog/value-at-risk-var-in-treasury), and you've got both halves of the measurement picture — value and cash flow.

***

_See also [Value at Risk in treasury](https://gravam.com/blog/value-at-risk-var-in-treasury) and [FX risk: transaction, translation and economic exposure](https://gravam.com/blog/fx-risk-transaction-translation-economic-exposure)._

## Primary sources

The CFaR and EaR definitions, the 2-to-24-month horizon framing and the ranked-trials percentile method are quoted from the CorporateMetrics Technical Document, first edition (April 1999); the VaR horizon and the 1.65 multiplier from the RiskMetrics Technical Document, fourth edition (December 1996). Both are historical documents and are not revised. The worked example uses assumed inputs, and its z-values are standard-normal critical values — neither is version- or vendor-dependent.

- RiskMetrics Group — CorporateMetrics Technical Document, first edition (April 1999) — accessed 2026-09-02 — https://www.msci.com/documents/10199/8af520af-3e63-44b2-8aab-fd55a989e312
- J.P. Morgan/Reuters — RiskMetrics Technical Document, fourth edition (December 1996) — accessed 2026-09-02 — https://www.msci.com/documents/10199/5915b101-4206-4ba0-aee2-3449d5c7e95a
- NIST/SEMATECH e-Handbook of Statistical Methods — Cumulative Distribution Function of the Standard Normal Distribution (with critical values) — accessed 2026-09-02 — https://www.itl.nist.gov/div898/handbook/eda/section3/eda3671.htm

## Questions this article answers

**Q: What is Cash Flow at Risk?**

Cash Flow at Risk (CFaR) is a measure of the largest shortfall a company might see in its cash flow — or its earnings — over a defined period, such as a quarter or a year, at a chosen confidence level. It answers the question a corporate actually cares about: how bad could our cash flow be versus the plan or budget we're relying on? Rather than measuring the mark-to-market value of a trading portfolio, it measures the risk to the cash the business expects to have, driven by exposures like foreign-currency flows and floating-rate costs.

**Q: How is CFaR different from VaR?**

Value at Risk (VaR) measures the potential loss in the mark-to-market value of a portfolio over a short horizon — typically a day or a few days — which suits a trading book that's revalued and can be traded out of quickly. Cash Flow at Risk measures the potential shortfall in cash flow or earnings against plan over a much longer horizon — a quarter or a year — which suits a corporate whose exposures are its real business flows, not tradeable positions. Same statistical idea, a worst outcome at a confidence level, but VaR is about portfolio value and CFaR is about the cash you'll actually have.

**Q: How do you calculate CFaR?**

A real CFaR is simulated: map the exposures, generate scenarios for the rates that drive them, revalue the cash flows under each scenario, then rank the results and read off the percentile matching your confidence level — at 95% confidence over 1,000 trials, the 50th-worst result. There is a parametric shortcut for a first estimate: multiply the net exposure by the annualised volatility of the risk factor, by the square root of the horizon in years, and by the z-value for the confidence level. On an assumed USD 40,000,000 net exposure over 12 months with 8% annualised volatility, at 95% confidence (z = 1.645), that is 40,000,000 × 0.08 × 1.645 = 5,264,000 — a CFaR of about USD 5.26m, or 13.2% of the exposure. Those inputs are illustrative, not benchmarks. The shortcut assumes returns are normally distributed, which real currency and rate moves are not, so it understates the tail.

**Q: Why do corporates use CFaR?**

Because a corporate doesn't live or die by the daily revaluation of a trading book — it lives by whether the cash it forecast actually turns up. CFaR frames risk in the terms a treasurer and CFO already think in: budget rates, forecasts, and the plan the business is funded against. That makes it directly useful for setting hedge ratios, deciding how much FX or interest-rate risk to carry, protecting a budget rate, and reporting risk to a board in language it understands — cash versus plan, not portfolio value.