After one year of working closely with a large var system and the underlying portfolio, I conclude that it is a rather good risk management tool.

That is, when it is properly implemented (full MC) and with a sensible model. We only got a few backtesting exceptions above the norm (when major US banks had dozens since the beginning of the crisis).

VaR (and CVaR ideally) does tell you that you are at risk, and how much risk, it does not tell you how to cut that risk without materializing the loss if your market isn't deep enough - VaR analyzes market risk, not credit risk or liquidity risk. Confusions on the aim of the indicator are due to over-hyping and marketing by gurus and software vendors.

And lastly, VaR applies to trading portfolios, not to investment portfolios. And all the significant losses in this crisis happened in banking portfolios, except for the Kerviel case. VaR isn't even computed on banking portfolios (buy and hold, whether direct or indirect through SIV, of crappy assets like CDO's and RMBS, which are meant to take direct exposure and are not hedged because they are not supposed to default, hedge not being available on the required notionals anyway, or if "available", it's bogus, see monolines).

Pierre