Excepting VAR

Even S&P think VAR alone is inadequate as a market risk measure. From "Trading Losses At Financial Institutions Underscore Need For Greater Market Risk Capital":

The securities markets changed dramatically in 2007, shaking the trading businesses of banks and showing up in their risk measurements. The main metric, the aptly named value at risk (VAR), was rising in conjunction with soaring market volatility. VAR estimates maximum loss for a certain time period--for instance, one-day--to a given confidence interval--such as 99%. However, many banks posted losses much higher than VAR and even greater than their regulatory requirements for the capital they need to hold against market risks.

This situation illustrates the shortcomings of VAR models. Most notably, they are designed to predict losses under normal trading conditions. In addition, they ignore or underestimate certain risks, notably the increasing amounts of idiosyncratic risk arising from new and complex financial instruments that are a feature of today's trading desks.

[...] To better reflect the magnitude of trading portfolios' underlying risks, we envisage making a series of upward adjustments to capital requirements under Basel II as part of the calculation of our proposed risk-adjusted capital ratio...

Furthermore the increased number of backtest exceptions this year has not passed unnoticed by supervisors. S&P give a useful graphic showing some large firms had more than ten exceptions in 2007: a lot of this information is available in individual firms 10Qs, so it is hardly secret. Rather than applying the 1996 Market Risk Amendment approach and putting these failing VAR models in the 'yellow' or 'red' zone with concomitant small increases in regulatory capital, surely the time has come to revisit market risk capital completely and add in some measure of stress capital.