How would you explain Value at Risk (VaR) to a non-technical stakeholder, and what are its primary limitations?