What is risk attribution?
Risk attribution decomposes portfolio risk into contributions from individual positions, segments, or risk factors. Unlike return attribution, which explains past returns, risk attribution explains the current risk structure of the portfolio -- what is driving its expected variance, and where a shock would have the largest impact.
Total portfolio variance is not the weighted average of individual position variances because positions are correlated. A position in company A may add little to total risk if it is highly correlated with other large positions already in the portfolio. Risk attribution captures this interaction through covariance: the contribution of each position includes both its own variance and its covariance with every other position.
The marginal contribution to risk (MCTR) of a position is the first derivative of total portfolio standard deviation with respect to that position's weight. It measures how much total risk changes if the position weight increases by a small amount. Positions with high MCTR are adding disproportionately to total portfolio risk given their weight.
The sum of all positions' marginal risk contributions, weighted by their portfolio weights, equals the total portfolio risk. This Euler decomposition property makes risk attribution additive: position-level risk contributions sum to the portfolio total, just as segment-level allocation effects sum to total allocation effect in return attribution.
Factor risk attribution
Factor risk attribution decomposes portfolio risk into contributions from systematic factors -- market, size, value, momentum, quality, sector, country -- and the residual specific risk. A multi-factor risk model estimates the sensitivity of each security to each factor, then computes how much of the portfolio's variance is explained by factor exposures versus specific to individual securities.
Factor risk is the component of portfolio variance explained by the risk model's factors. It arises from the portfolio's net exposure to each factor multiplied by that factor's volatility and its correlations with other factors. A portfolio heavily tilted toward the value factor will have high value factor risk during periods when the value factor itself is volatile.
Specific risk (also called idiosyncratic risk or residual risk) is the component of portfolio variance not explained by the factor model. It arises from company-specific events: earnings surprises, management changes, product recalls, regulatory actions. As a portfolio becomes more concentrated, specific risk grows faster than factor risk, because diversification reduces specific risk more than it reduces factor risk.
Active factor risk is the factor risk of the portfolio relative to its benchmark. It measures how differently the portfolio is positioned relative to the benchmark on each factor dimension. A portfolio that exactly replicates the benchmark has zero active factor risk. A portfolio that tilts heavily toward quality relative to the benchmark has high active quality factor risk.
Using risk attribution in practice
Risk attribution helps portfolio managers understand where their risk budget is going. If the risk attribution shows that 80% of active risk comes from a single sector overweight, that is a signal about concentration that may not be apparent from looking at return attribution, where many sectors contribute smaller positive effects.
Comparing risk attribution to intended bets is a useful consistency check. A bottom-up stock picker should have most of their active risk concentrated in specific risk, with relatively small factor risk contributions. If factor risk is dominant, the manager may be running systematic factor bets they are not aware of.
Tracking error decomposition is a specific application of risk attribution for benchmarked mandates. Tracking error -- the standard deviation of active returns relative to the benchmark -- is decomposed into contributions from each active bet. A manager with a 250 basis point tracking error target can see how much of that budget is used by each sector overweight, each factor tilt, and each concentrated individual position.
Risk attribution requires a covariance matrix -- estimated from historical returns or a risk model -- and is sensitive to the lookback period and estimation method. Short lookback periods are more responsive to recent volatility but noisier; long lookback periods are more stable but can miss structural breaks in correlations. Risk model vendors (Barra, Axioma, Northfield) provide factor risk models with proprietary covariance estimates.
Frequently asked questions
What is risk attribution in portfolio management?
Risk attribution decomposes total portfolio risk into contributions from individual positions, sectors, and systematic risk factors. It answers the question: where is the portfolio's variance coming from? Unlike standalone position volatility, risk attribution accounts for correlations between positions. A position's contribution to total risk depends on how it co-moves with the rest of the portfolio, not just how volatile it is in isolation.
What is factor risk attribution in investment management?
Factor risk attribution uses a multi-factor risk model to separate portfolio variance into the component explained by systematic factors (market, size, value, momentum, quality, sector, country) and the component specific to individual securities. Factor risk is driven by the portfolio's net exposure to each factor multiplied by that factor's volatility. Specific risk is the remaining variance not explained by the model -- company-specific events and news.
What is idiosyncratic risk in a portfolio context?
Idiosyncratic risk (also called specific risk or residual risk) is the component of portfolio variance attributable to individual security-specific events rather than systematic market factors. It includes earnings surprises, management changes, product recalls, litigation outcomes, and other company-specific events. Idiosyncratic risk can be reduced through diversification: adding more positions reduces specific risk without proportionally reducing factor risk, which is why concentrated portfolios carry relatively more specific risk than diversified ones.
How is risk attribution used in practice?
Portfolio managers use risk attribution to verify that actual risk concentration matches intended bets, to check that active risk is not dominated by unintended factor exposures, and to understand tracking error decomposition against the benchmark. A manager targeting 200 basis points of tracking error can see what fraction comes from sector tilts, factor tilts, and individual security concentration. Unexpected risk concentrations -- 60% of active risk in one sector despite no intentional sector bet -- are actionable signals for rebalancing or reviewing position sizing.