The previous chapter built the general machinery of a random variable: the PMF and CDF, expectation, the moments, and quantiles. This chapter puts that machinery to work on the specific distributions that appear again and again in risk management. There are more than two hundred named distributions in the wild, but a risk manager needs fluency in a dozen. Each one is a compact story about how a particular kind of uncertainty behaves.
The aim here is recognition and application, not derivation. For each distribution the same four questions matter: what does it model, what are its parameters, what are its mean and variance, and what one feature makes it the right tool. Learn to answer those four for each distribution and the exam questions become pattern matching. A count of defaults in a fixed set of loans is a binomial; a count of loss events over a quarter is a Poisson; a price that cannot go negative is a lognormal; a waiting time is an exponential. The skill is reading the setup and naming the distribution.
The distributions split cleanly into two camps. Discrete distributions count things and are described by a PMF. Continuous distributions measure things and are described by a PDF. A third idea, the mixture, sits on top: it combines simple distributions into richer ones, and it is how the fat tails and skew of real returns are built from well-behaved parts.
Key Takeaways
- The discrete workhorses are the Bernoulli (one yes/no trial), the binomial (a count of successes over n trials), and the Poisson (a count of events over an interval).
- The normal is the central continuous distribution: two parameters, symmetric, closed under linear operations, and the limit that the binomial and Poisson approach when their counts grow large.
- The lognormal is the exponential of a normal, so it is never negative and is right-skewed, which is why it models asset prices.
- The chi-squared, Student’s t, and F are all built from normals and appear in hypothesis testing; the t is the normal with fatter tails, governed by its degrees of freedom.
- The exponential models waiting time and is memoryless; the Beta lives on the interval from 0 to 1 and models probabilities and recovery rates.
- A mixture draws from several component distributions at random, and it can show fat tails and skew even when every component is a symmetric normal.
A Map of the Common Distributions
Before the details, a map helps. Figure 1 organizes the whole chapter. The first split is discrete versus continuous. Within the continuous side, one family deserves special attention: the normal and the distributions built directly from it, the lognormal, the chi-squared, the Student’s t, and the F. Keeping that family tree in mind explains why these distributions keep appearing together and why they share so much structure.
The Discrete Family: Bernoulli, Binomial, Poisson
Three discrete distributions cover most counting problems in risk. They build on one another: a Bernoulli is a single trial, a binomial is a fixed number of Bernoulli trials added up, and a Poisson is the count of events when there is no fixed number of trials, only a rate over an interval.
Bernoulli: the Single Yes/No
A Bernoulli random variable is the simplest of all. It takes the value 1 with probability p and 0 with probability 1 minus p, and nothing else. It is the natural model for any single binary event: a loan either defaults or it does not, a trade either breaches a limit or it does not. By long convention the outcome coded 1 is the event of interest, which in risk is usually the unwelcome one, such as a default.
where p is the probability of the outcome coded 1. The variance is largest at p = 0.5, where the outcome is most uncertain, and shrinks toward 0 as p approaches either 0 or 1, where the result is nearly certain.
Binomial: Counting Independent Successes
A binomial random variable counts how many successes occur across n independent Bernoulli trials that share the same probability p. It has two parameters, the number of trials n and the success probability p. The count of defaults among a fixed pool of identical, independent loans is the textbook case.
where n is the number of independent trials and p the success probability of each. The mean and variance are simply the Bernoulli mean and variance multiplied by n, because a binomial is the sum of n independent Bernoulli variables.
The probability of exactly y successes multiplies the probability of one such arrangement by the number of arrangements, written with the binomial coefficient “n choose y”.
where the fraction is the binomial coefficient, the number of distinct ways y successes can occur among n trials, and the “!” is the factorial.
A bank holds 20 independent loans, each with a 5 percent chance of defaulting this year. What is the expected number of defaults, and the probability that exactly 2 default?
Step 1. Expected number of defaults, from the mean of a binomial.
Step 2. Probability of exactly 2, from the binomial PMF with n = 20, p = 0.05.
Answer: the book averages 1.0 default a year, and the chance of exactly 2 is about 18.9 percent. The mean sits at one default, but two in a year is far from rare, which is the point of carrying the full distribution rather than the average alone.
Poisson: Counting Events Over Time
A Poisson random variable counts how many events occur in a fixed interval when events arrive at a steady average rate and do not depend on one another. It has a single parameter, the average count per interval, written as the Greek letter lambda and often called the hazard rate. Loss events per quarter, system failures per year, or claims per month all fit this shape. Its defining quirk is that the mean and the variance are equal.
where λ (lambda) is the average number of events per interval. A useful property is that independent Poisson counts add to a Poisson, so a rate per month can be scaled to a rate per quarter simply by adding.
A trading desk logs, on average, 3 operational loss events per quarter, and the events are independent. What is the probability of exactly 5 in a quarter?
Step 1. Apply the Poisson PMF with λ = 3 and y = 5.
Step 2. Compute the pieces and combine.
Answer: about 10.1 percent. Even though the desk averages 3 events a quarter, a quarter with 5 shows up roughly one time in ten, which is the kind of tail the operational-risk team plans for.
| Distribution | Parameters | Mean | Variance | Models |
|---|---|---|---|---|
| Bernoulli | p | p | p(1 − p) | A single yes/no event |
| Binomial | n, p | np | np(1 − p) | Successes in n independent trials |
| Poisson | λ | λ | λ | Events in a fixed interval |
The Uniform Distribution
The uniform distribution is the simplest continuous distribution: every value between a lower bound a and an upper bound b is equally likely, and nothing outside that range can occur. Its density is a flat rectangle. It rarely models real risks directly, but it is the raw material for simulation, because a computer’s random number generator produces standard uniform values on the interval from 0 to 1, from which any other distribution can be built.
where a and b are the lower and upper bounds. The mean is the midpoint of the range, and the variance depends only on the width of the range, not on where it sits.
The Normal Distribution
The normal distribution, also called the Gaussian or the bell curve, is the most used distribution in all of risk management. It has two parameters, the mean and the variance, and its density is the familiar symmetric bell centered on the mean. It has zero skewness because it is symmetric, and a kurtosis of exactly 3, which is the benchmark against which every other distribution’s tails are judged.
where μ (mu) is the mean and σ² (sigma squared) is the variance. Increasing the mean slides the whole curve sideways; increasing the variance spreads it wider and flatter.
The normal earns its central place for several reasons. Sums and averages of many independent random variables drift toward a normal shape, a result called the central limit theorem, which is why the normal approximates so many other distributions. It is closed under linear operations, meaning any weighted sum of normal variables is itself normal, which keeps portfolio mathematics tractable. And its quantiles are tabulated once and reused everywhere. The one caution is its tails: real financial returns produce extreme moves more often than a normal predicts, so a plain normal tends to understate tail risk.
Working With the Normal
Two skills turn the normal from a shape into a tool: standardizing, and reading probabilities off the standard normal.
Standardizing and the z-Score
A normal with any mean and variance can be converted to the standard normal, which has mean 0 and variance 1, by subtracting the mean and dividing by the standard deviation. The result is the z-score, the number of standard deviations an outcome sits from the mean. Standardizing matters because probabilities are tabulated only for the standard normal, so every normal question is first reduced to a z-score.
where X is a normal variable with mean μ and standard deviation σ. Once X is turned into Z, the standard normal table or a spreadsheet function returns the probability.
A fund’s annual return is normal with a mean of 8 percent and a standard deviation of 20 percent. In one year it returns −15 percent. How unusual is that?
Step 1. Standardize the outcome.
Step 2. Read the left-tail probability for Z = −1.15 from the standard normal.
Answer: the year sits about 1.15 standard deviations below the mean, and a year that bad or worse happens roughly 12.5 percent of the time. Standardizing let a return in percent be judged against a table that knows nothing about funds.
The 68-95-99.7 Rule and Critical Values
Two facts about the normal are worth memorizing outright, because they appear constantly in confidence intervals and value at risk. The first is the coverage rule: about 68 percent of the probability lies within one standard deviation of the mean, about 95 percent within two, and about 99.7 percent within three. The second is the set of critical values that cut off the standard normal’s tails, which underpin 90, 95, and 99 percent confidence intervals. Figure 3 shows both, and Exhibit 2 tabulates the critical values.
| Interval | Central coverage | Tail probability | Critical value |
|---|---|---|---|
| ±1σ | 68% | 32% | 1.00 |
| ±1.645σ | 90% | 10% | 1.645 |
| ±1.96σ | 95% | 5% | 1.96 |
| ±2σ | 95.4% | 4.6% | 2.00 |
| ±2.57σ | 99% | 1% | 2.57 |
| ±3σ | 99.7% | 0.3% | 3.00 |
Keep the one-tail and two-tail values straight. A 95 percent confidence interval is two-tailed, so it uses 1.96, leaving 2.5 percent in each tail. A 95 percent value at risk is one-tailed, so it uses 1.645, leaving 5 percent in the single loss tail. Mixing up 1.645 and 1.96 is one of the most common careless errors on the exam.
The Log-Normal Distribution
A lognormal variable is the exponential of a normal variable. Put the other way, a variable is lognormal if its natural logarithm is normal. Because the exponential of any number is positive, a lognormal variable can never be negative, and that single feature makes it the standard model for asset prices. A price modeled as normal could in principle go below zero, which is impossible; a price modeled as lognormal cannot.
where X is the normal variable whose exponential is the lognormal Y. The mean carries an extra σ²/2 term in the exponent, so it exceeds e raised to the mean of X alone.
The lognormal is right-skewed, which matches how returns actually behave: a price can fall by at most 100 percent but can rise without any ceiling, so the upside tail is longer than the downside. The extra half-variance term in the mean is a direct consequence of that asymmetry.
The continuously compounded annual return on an index is normal with a mean of 10 percent and a standard deviation of 30 percent. The gross return over the year is the lognormal quantity e raised to that return. What is its expected value?
Step 1. Apply the lognormal mean, with μ = 0.10 and σ = 0.30.
Answer: the expected gross return is about 1.156, an expected gain near 15.6 percent, noticeably above the 10 percent drift of the log return. The gap is the half-variance term, and it grows with volatility, which is why a volatile asset’s expected price rises faster than its typical log return suggests.
The Testing Family: Chi-Squared, t, and F
Three continuous distributions are built directly from normal variables and turn up whenever hypotheses about parameters are tested. They are grouped here because they share a common origin and a common piece of vocabulary, the degrees of freedom, which counts how much independent information is available and sets the shape of each.
Chi-Squared: Sums of Squared Normals
A chi-squared variable is the sum of squared independent standard normal variables, and the number of them is its degrees of freedom. Because it is a sum of squares, it is always positive, which suits it to modeling quantities that cannot be negative, and it is right-skewed. As the degrees of freedom rise, it shifts right, spreads out, and grows more symmetric.
where ν (nu) is the degrees of freedom. The mean equals the degrees of freedom and the variance is twice it, so both grow as the parameter grows.
Student’s t: the Normal With Fatter Tails
A Student’s t variable looks like a standard normal but with heavier tails, controlled by a single degrees-of-freedom parameter. It arises when a standard normal is divided by the square root of a scaled chi-squared, and that division is what fattens the tails. Low degrees of freedom give very heavy tails; as the parameter grows the t converges to a normal. This makes the t a natural model for returns, which show more extreme moves than a normal allows, and the tool for testing hypotheses from small samples.
where ν is the degrees of freedom. The variance exceeds 1 and shrinks toward 1 as ν grows, reflecting tails that start heavy and thin out toward the normal. The kurtosis is above 3 whenever ν > 4.
F: a Ratio of Two Chi-Squareds
An F variable is the ratio of two independent chi-squared variables, each divided by its own degrees of freedom, so it carries two degrees-of-freedom parameters, one for the numerator and one for the denominator. It appears when two variances or two model fits are compared, which is the heart of many hypothesis tests. A neat link ties the family together: the square of a Student’s t variable follows an F distribution with 1 numerator degree of freedom.
where ν1 and ν2 are the numerator and denominator degrees of freedom. Like the chi-squared it is positive and right-skewed, because it is built from sums of squares.
These three are one family. Square and add standard normals to get a chi-squared; divide a normal by a scaled chi-squared to get a t; take the ratio of two scaled chi-squareds to get an F. The recurring word “degrees of freedom” is just the count of independent normal pieces that went into building each one, and it is the dial that sets the shape.
The Exponential Distribution
The exponential distribution models the waiting time until a single event occurs: the time until a machine fails, until a borrower defaults, until the next loss arrives. It has one parameter, written as the Greek letter beta, which is both its mean and, when squared, its variance. The exponential is the continuous partner of the Poisson: if events arrive as a Poisson count, the gaps between them are exponential.
where β (beta) is the mean waiting time. The survival probability, the chance the event has not yet happened by time y, is the complement of the CDF, e raised to minus y over beta.
The exponential has one defining and rather strong feature: it is memoryless. The distribution of the remaining wait does not depend on how long you have already waited. Given that a company has survived five years, its chance of surviving another two is the same as a brand-new company’s chance of surviving two. The elapsed time carries no information, which is a convenient assumption and, in practice, one to question.
The time until a critical model needs a full rebuild is exponential with a mean of 4 years. What is the probability it lasts more than 6 years without a rebuild?
Step 1. Use the survival probability, the complement of the CDF, with β = 4 and y = 6.
Answer: about 22.3 percent. By the memoryless property, a model that has already run cleanly for three years still faces this same 22.3 percent chance of reaching its ninth year, because the past clean run tells you nothing about the future under an exponential.
The integral behind a continuous probability is never something to compute by hand. For the exponential, the whole job is the two closed forms: the CDF, one minus e to the minus y over beta, for the chance the event has happened by time y; and its complement for the chance it has not. Read a probability as an area, plug into the formula, and move on.
The Beta Distribution
The Beta distribution is the natural home for a continuous quantity trapped between 0 and 1. It has two shape parameters, written alpha and beta, that between them fix the mean and the variance. Because so many risk quantities are fractions, a probability of default, a recovery rate on a defaulted bond, the fraction of a limit used, the Beta is the go-to distribution for modeling uncertainty about a proportion.
where α (alpha) and β (beta) are the two shape parameters. When both equal 1 the Beta becomes a standard uniform; as they grow, the distribution concentrates around its mean.
An analyst models the recovery rate on a defaulted bond, a number between 0 and 1, with a Beta distribution using α = 2 and β = 3. What is the expected recovery rate and its variance?
Step 1. Expected recovery, from the Beta mean.
Step 2. Variance, from the Beta variance formula.
Answer: an expected recovery of 40 percent with a variance of 0.04, so a standard deviation of 0.2, or 20 percentage points. The Beta keeps every possible recovery inside the sensible 0 to 1 range, which a normal model of recovery would not.
| Distribution | Parameters | Support | Key use | Signature feature |
|---|---|---|---|---|
| Uniform | a, b | [a, b] | Simulation building block | Flat density; all values equally likely |
| Normal | μ, σ² | all reals | Returns, testing, confidence intervals | Symmetric; closed under linear operations |
| Lognormal | μ, σ² | positive | Asset prices | Exp of a normal; never negative, right-skewed |
| Chi-squared | ν | positive | Hypothesis testing | Sum of squared normals; right-skewed |
| Student’s t | ν | all reals | Heavy-tailed returns, small samples | Fat tails set by degrees of freedom |
| F | ν1, ν2 | positive | Comparing variances or fits | Ratio of two scaled chi-squareds |
| Exponential | β | positive | Waiting time to an event | Memoryless |
| Beta | α, β | [0, 1] | Probabilities, recovery rates | Flexible shape on a bounded range |
Mixtures of Distributions
Every distribution so far has a fixed, single shape. Real financial data is rarely so tidy: returns are fat-tailed and often skewed, and no single normal captures that. A mixture distribution builds a richer shape by combining two or more simple component distributions. The recipe is a two-step draw: first flip a weighted coin to pick a component, then draw from that component.
where X1 and X2 are the component distributions and W is a Bernoulli switch that picks the first component with probability p and the second with probability 1 minus p.
Both the PDF and the CDF of the mixture are simply the probability-weighted averages of the components’ PDFs and CDFs, and the mean is the weighted average of the component means. The reason mixtures matter is what they can do that a single component cannot: even when every component is a symmetric normal, a mixture can be skewed and fat-tailed.
where p is the weight on the first component. Higher moments of the mixture are weighted averages of the components’ non-central moments, which is how skewness and kurtosis can emerge even from symmetric parts.
Two mixtures matter in practice. A contaminated normal mixes a common low-variance normal with a small dose of a high-variance normal; the rare draws from the high-variance component appear as outliers, producing fat tails while keeping a bell-like center. A mixture of two normals with different means produces skew, and if the means are far enough apart, two separate peaks. Figure 4 shows a contaminated normal against a plain normal: same center, heavier tails.
A mixture can show a feature none of its parts has. Two symmetric normals, mixed, can be skewed; two thin-tailed normals, mixed, can be fat-tailed. This is why mixtures are such a practical tool: they build the empirically important behavior of returns, the crashes and the asymmetry, out of simple, well-understood normal components.
A monthly return is modeled as a mixture: 90 percent of the time it is drawn from a calm regime with mean 1 percent, and 10 percent of the time from a stressed regime with mean −4 percent. What is the overall expected return?
Step 1. The mixture mean is the weighted average of the component means.
Answer: an expected monthly return of 0.5 percent. The rare stressed regime pulls the average down by 0.4 percentage points, and if the stressed regime is also more volatile, the mixture inherits fat tails that neither regime shows on its own.
A risk team must model the number of defaults in a fixed pool of 50 rated bonds over one year, and separately the number of cyber incidents the firm suffers per year, which has no natural upper limit. Which distribution fits each?
Show answer
The bond defaults fit a binomial: there is a fixed number of trials (50 bonds), each with a default probability, and the count runs from 0 to 50. The cyber incidents fit a Poisson: there is no fixed number of trials, only a rate of events over an interval, and the count is open-ended. The clue is whether there is a fixed n (binomial) or only a rate over an interval (Poisson).
Why is a lognormal a better model than a normal for the price of a stock one year from now?
Show answer
A price cannot be negative, but a normal distribution puts positive probability on values below zero, so it can generate an impossible negative price. A lognormal is the exponential of a normal, and an exponential is always positive, so a lognormal price stays above zero. It also captures the asymmetry of prices, which can rise without bound but fall by at most 100 percent, giving the right-skew that the normal lacks.
Two return series have the same mean and variance, but one is modeled as a normal and the other as a Student’s t with 5 degrees of freedom. Which produces more frequent extreme losses, and what happens as the t’s degrees of freedom rise?
Show answer
The Student’s t produces more frequent extreme losses, because at the same variance it has fatter tails and a higher kurtosis than the normal, which means more probability far from the mean. As the degrees of freedom rise, the t’s tails thin out and it converges to the normal, so a t with, say, 100 degrees of freedom is nearly indistinguishable from a normal. Low degrees of freedom mean heavy tails; high degrees of freedom mean near-normal.
A colleague argues that because each of two return regimes is a symmetric normal, any mixture of them must also be symmetric and thin-tailed. Where is the error?
Show answer
The claim is false. A mixture can show features that none of its components has. Mixing two normals with different means produces skew, and mixing a low-variance normal with a small dose of a high-variance normal produces fat tails, or excess kurtosis, even though both components are symmetric and each is thin-tailed on its own. The mixing itself, not the components, creates the asymmetry and the heavy tails.
Chapter Summary
- The discrete family: the Bernoulli models one yes/no event (mean p, variance p(1−p)); the binomial counts successes over n independent trials (mean np, variance np(1−p)); the Poisson counts events over an interval (mean and variance both λ).
- The uniform is a flat density on [a, b], the raw material for simulation, with mean (a+b)/2 and variance (b−a)²/12.
- The normal has two parameters, is symmetric with kurtosis 3, is closed under linear operations, and is the limit the binomial and Poisson approach as their counts grow.
- Working with the normal means standardizing to a z-score and using the 68-95-99.7 coverage rule and the critical values 1.645 (90%), 1.96 (95%), and 2.57 (99%).
- The lognormal is the exponential of a normal, so it is positive and right-skewed, with mean e raised to (μ + σ²/2); it models asset prices.
- The chi-squared, Student’s t, and F are built from normals and used in testing; the t is a normal with fatter tails set by its degrees of freedom, and the square of a t is an F.
- The exponential models waiting time (mean β, variance β²) and is memoryless; the Beta lives on [0, 1] and models probabilities and recovery rates.
- A mixture draws from several components at random; it can be skewed and fat-tailed even when every component is a symmetric normal, which is how the behavior of real returns is built.
Frequently Asked Questions
What is the difference between the binomial and the Poisson distribution?
Both count events, but they answer different questions. The binomial counts how many successes occur in a fixed number of independent trials, each with the same success probability, so it needs two parameters, the number of trials and the success probability. The Poisson counts how many events occur in a fixed interval of time or space when events arrive at a steady average rate, so it needs a single parameter, the average count. Use the binomial when there is a clear number of trials, such as defaults among a fixed set of loans, and the Poisson when events simply accumulate over an interval, such as loss events per quarter.
Why is the normal distribution so central to risk management?
The normal is convenient and appears naturally. Sums and averages of many independent random variables tend toward a normal by the central limit theorem, so it approximates many other distributions, including the binomial and the Poisson when their counts are large. It is closed under linear operations, meaning a weighted sum of normals is still normal, which keeps portfolio math simple. It has just two parameters, the mean and the variance, and its quantiles are tabulated, so probabilities and confidence intervals are quick to compute. Its main weakness is thin tails, which understate the chance of extreme moves in real markets.
What do the degrees of freedom mean for the chi-squared, t, and F distributions?
Degrees of freedom count how much independent information is available to estimate a quantity, and they set the shape of these three distributions. A chi-squared is the sum of that many squared standard normals, so more degrees of freedom shift it right and make it more symmetric. A Student’s t has a single degrees-of-freedom parameter that controls its tail heaviness: low values give fat tails, and as the parameter grows the t converges to a normal. An F has two degrees-of-freedom parameters, one for its numerator and one for its denominator, because it is a ratio of two scaled chi-squared variables.
Why is the lognormal used for asset prices instead of the normal?
A price cannot fall below zero, but a normal distribution assigns positive probability to negative values, so a normal price model is unrealistic. A lognormal variable is the exponential of a normal, and the exponential of any number is positive, so a lognormal price can never be negative. This also captures the asymmetry of returns, since a price can fall by at most 100 percent but can rise without limit, which produces the right-skew that the lognormal has and the normal does not.
What does the memoryless property of the exponential distribution mean?
Memoryless means the distribution of the remaining waiting time does not depend on how long you have already waited. If the time until a company defaults is exponential, then given that it has survived five years, the probability it survives another two years is the same as the probability a fresh company survives two years. The past elapsed time carries no information about the future, which is a strong assumption and the defining feature of the exponential distribution.
How can a mixture of normal distributions have fat tails or skewness?
A mixture draws each outcome from one of several component distributions, chosen at random by a set of weights. Even when every component is a symmetric, normal distribution, combining a low-variance component with a small dose of a high-variance component produces occasional extreme draws, which shows up as fat tails, or excess kurtosis. Combining components with different means produces asymmetry, or skewness. So a mixture can display features that none of its normal components has on its own, which is exactly why mixtures are used to model the fat-tailed, skewed behavior of real financial returns.
What is standardizing, and why is it done?
Standardizing subtracts the mean and divides by the standard deviation, turning any normal variable into a standard normal with mean 0 and variance 1. It is done because probabilities and quantiles are tabulated only for the standard normal. Once a variable is standardized, the z-score tells you how many standard deviations an outcome sits from the mean, and the standard normal table or a spreadsheet function converts that z-score into a probability, which is the routine behind value at risk and confidence intervals.
When can a binomial or a Poisson be approximated by a normal distribution?
A binomial is well approximated by a normal when the number of trials times the success probability and the number of trials times the failure probability are both large, with a common rule of thumb being that each should be at least 10. A Poisson is well approximated by a normal when its average count is large. In both cases the discrete distribution becomes nearly symmetric and bell-shaped, so a normal with the same mean and variance fits it closely, which is a direct consequence of the central limit theorem.
