Risk management using VaR & CVaR