System working well: Send more money. Or so goes the “successful” roulette player’s apocryphal telegram home.

Today, you might be forgiven for assuming this was a message from an investment manager pleading for more money from its clients. The market meltdown that began three years ago certainly caught most investors and market professionals by surprise. The scale of the losses incurred and subsequent corporate collapses are truly shocking.

What on earth went so wrong?

The investment industry supposedly employs the smartest people using the most clever investment theories. Regulatory bodies abound to set rules and limits in order to protect everyone involved. And then there are the information systems, setting the benchmarks by which risks are judged and actions taken.

Lots of fingers have been pointed at risk measures, in the blowup of the mortgage-based securities business. One benchmark in particular has been heavily criticized: Value at Risk (VaR). Most risk measures are a complicated array of Greek letters and are almost entirely opaque to all but the most sophisticated mathematicians. In contrast, Value at Risk is wonderfully clear. Or is it?

Although the name Value at Risk only emerged in the past 15 years or so, the underlying mathematics can be traced back to the 1950’s work by Harry Markowitz on Modern Portfolio Theory (MPT). MPT is based on the concept that a combination of assets can have a lower investment risk than that of any individual asset. For example, when stock market prices fall, government bond prices normally rise. Therefore, a portfolio made up of a mix of stocks and bonds should have a lower level of risk than a separate portfolio made up entirely of stocks or a portfolio of bonds.

In normal parlance, the phrase “don’t put all your eggs in one basket” is a much simpler way of extolling the virtues of diversified investment. Assessing investment risk is made much harder by the complexity of some investment instruments and strategies. A very simple example would be a portfolio that is long Costco and short Wal-Mart. The investment risk of this strategy is much lower than the sum of the long risk of Costco added to the risk of being short Wal-Mart. The reason is that these two companies’ stock prices follow similar trajectories.

Imagine how intricate the web of interconnected risks is at a typical investment bank. At any one moment, hundreds of thousands of individual positions are scattered across all business units. In 1989, Sir Dennis Weatherstone, then Chairman of J.P. Morgan, famously demanded a consolidated report of all the risks at the firm. VaR’s ability to incorporate the impact of diversification, as well as its flexibility to cover all asset classes, made it the choice for J.P. Morgan, and later, the majority of the industry.

The VaR measure also became the choice of the regulators. In 1980, the Securities and Exchange Commission introduced a capital adequacy rule that was based on a rudimentary VaR measure. Subsequent to this, the Basel Accord has also used VaR as its basis for defining capital requirements. The SEC and Basel rules continue to be modified and developed, but still have VaR as one of their core measures. In summary, VaR helps investors, investment managers, investment banks and regulators all better understand investment risk.

Is it some kind of a panacea? Clearly not, given the events of the past three years.

So, what went wrong? Why have we seen losses far greater than those predicted by any risk measure? Why have we seen banks that use these risk tools collapse? The name itself might be part of the problem. The title Value at Risk is really just a shortened version of its real name: The Value at Risk with a certain degree of confidence over a set period of time.

For example, let’s consider a portfolio with a VaR of $1 million for a single day with 99 percent confidence. In other words, 99 percent of the time an investment manager can expect that this portfolio will not lose more than $1 million in a single day.

However, this statistic could be just as accurately phrased “Two or three days a year, the portfolio will lose more than $1million and we don’t know how much more than that it will lose.” Not quite as snappy a name -and certainly more scary – but a much more accurate assessment of the investment risk.

To understand the potential loss, extremes matter.

For those two or three days a year, the investment manger needs to know whether the loss might be $2 million $10 million or $100 million. To shed light, the normal tack is to run the portofolio through various economic and market scenarios to calculate what loss would be incurred. For example, the loss can be estimated if markets collapse again as they did in October 1987. Most systems that allow such stress testing will work through thousands of different scenarios to give a range of possible outcomes.

But one major fault of risk measures is that they require markets to behave rationally at all times. They also assume that there will always be market liquidity and that a buyer can be found for any given asset. However, liquidity is certainly not a constant and can’t be taken for granted. Look, for example, at the “Flash Crash” of May 6, where the U.S. stock market fell 7 percent in just a few minutes and then recovered just as quickly.

Lots of theories abound as to the cause, but, in essence, market liquidity disappeared. This resulted in some stocks trading down to pennies in the dollar for a few brief moments. The good news is that risk measures and providers of risk software and services evolve as our understanding increases.

Now, providers of risk models, such as my company or RiskMetrics Group, whose founders came up with VaR in the first place, have incorporated liquidity risk into their products. This allows the user to see the potential impact of a loss of trading liquidity on their portfolios and, together with stress testing, gives the user a more accurate measure of their true investment risk.

But it’s not risk measures that are the problem. It’s the manner in which models are used – or not – that matter. And the judgment that is used about how to deal with the results. Just because your car has a five-star crash safety rating and is fitted with seat belts and air bags, it doesn’t mean you should feel comfortable driving at 120 mph.

These things are there to protect motorists and passengers should the worst happen. But they’re not put there to encourage wreckless driving.