Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 002Describe what Value at Risk is.Market risk and VaRCoretechnicalUBSRisk Management · Zurich · 2021BLBlackRockRisk and Quantitative Analysis · New York · 2026

   Say this

   VaR is a loss threshold with a probability attached. A one-day 99% VaR of $10m means that on 99 days out of 100 you expect to lose less than $10m, so roughly two or three days a year you should lose more.

   Then walk it

   1. Three inputs, and you have to state all three: the horizon, the confidence level, and the portfolio. A VaR number without a horizon and a confidence level is meaningless.
   2. Mechanically it's a quantile of the profit and loss distribution. You build a distribution of possible one-day P&L and read off the first percentile.
   3. It's popular because it aggregates. One number covers equities, rates and FX on the same scale, which is what lets a board set a firmwide limit.
   4. The breach count is the test. At 99% over 250 trading days you expect about 2.5 exceptions. Zero exceptions is not a good model, it's a conservative one, and regulators treat both directions as a problem.
   5. The limitation I'd say without being asked: VaR tells you where the tail starts and nothing about how deep it goes. A $10m VaR is consistent with a $15m bad day and with a $500m one.

   Where candidates lose it

   Saying 'the maximum you can lose'. It is precisely not the maximum, and that phrase is the single fastest way to fail a market risk screen. Say 'the loss you exceed one percent of the time' and give the expected breach count.

   Expect next

   • So what is the maximum you can lose?
   • What does a 99% one-day VaR of $10m imply about breaches per year?
   • Would you rather a board saw VaR or expected shortfall?

   Reported by candidates at UBS (Risk Management, Zurich, 2021); BlackRock (Risk and Quantitative Analysis, New York, 2026). Source: Wall Street Oasis.

2. 022Which equities have duration?Greeks and sensitivitiesHardtechnicalBLBlackRockRisk and Quantitative Analysis · New York · 2026

   Say this

   Equity duration is how sensitive a stock's price is to the discount rate, and it's driven by how far out the cash flows sit. Long-duration equities are the ones whose value is mostly terminal value: high-growth tech, biotech with no earnings, and long-dated infrastructure and utilities.

   Then walk it

   1. Mechanically it's the same idea as bond duration. Discount cash flows, compute the weighted average time to those cash flows, and that's your rate sensitivity. A company earning nothing today with all the value in year fifteen has enormous duration.
   2. So the long-duration buckets: unprofitable growth software, early-stage biotech, anything valued on a distant terminal value, plus regulated utilities and infrastructure where the cash flows are bond-like and stretch for decades.
   3. The short-duration buckets: value names, banks, energy, cyclicals with high near-term free cash flow and low reinvestment. Their value is front-loaded, so the discount rate matters less.
   4. The empirical check: 2022 is the cleanest natural experiment. As real yields rose, the Nasdaq underperformed value by a huge margin even though earnings held up. That is duration doing the work, not fundamentals.
   5. There's a twist that matters for a risk seat: for financials the rate effect goes the other way through earnings. Banks' net interest margins improve with rates, so their effective duration can be negative. You can't apply a single sign to the whole market.
   6. And utilities are the interesting case, because they have long-duration cash flows and leverage, so they trade as rate proxies. Many managers hold them as bond substitutes and then get surprised when they behave like bonds.

   Where candidates lose it

   Treating this as a trick question or saying equities don't have duration. The interviewer is testing whether you can move a fixed income concept into equities and name the cohorts. And the answer that stands out mentions financials as the exception where the sign flips.

   Expect next

   • Why did long-duration equities sell off so hard in 2022?
   • Do banks have positive or negative equity duration?
   • How would you hedge the rate sensitivity of a growth equity portfolio?

   Reported by candidates at BlackRock (Risk and Quantitative Analysis, New York, 2026). Source: Wall Street Oasis.

3. 093Tell me about your Python experience and what you have actually built with it.Fit and careerIntermediatetechnicalBLBlackRockRisk and Quantitative Analysis · New York · 2026

   Say this

   Be specific and be honest about the level. Name the libraries, describe one thing you built end to end, say what broke and what you'd do differently. A concrete small project beats a claimed proficiency every time.

   Then walk it

   1. Set the level honestly with a self-assessment they can verify: comfortable with pandas and numpy, have used statsmodels and scikit-learn, can write a class and a test, not a software engineer. Overclaiming is fatal because the next question is usually technical.
   2. Then one project in detail. For a risk role the ideal one is risk-adjacent: pulled daily prices for a twenty-stock portfolio, computed historical and parametric VaR, backtested the exceptions over three years, and showed the parametric version under-reporting breaches in the volatile period. That's a real answer and it's a week of work.
   3. Say what the data did to you, because that's the honest part of any data project. Corporate actions, missing days, tickers that changed, timezone alignment. Anyone who's done real work has a data-cleaning story, and its absence is a tell.
   4. Name the specific libraries per task: pandas for the data, numpy and scipy for the maths, statsmodels for regression and time series, matplotlib for output, and pytest if you've written tests. Vague 'I know Python' invites a hard follow-up.
   5. Have a view on tooling practices, briefly: version control, a requirements file, functions rather than one long notebook, a couple of assertions on the data. Risk teams care about reproducibility because a number that can't be reproduced can't be signed off.
   6. If your experience is thin, say so and say what you've done about it. 'I've done the CS50 problem sets and built this one project, I'm not fast yet' is respected. Claiming pandas and then failing to describe a groupby is not.
   7. Close with the risk-relevant framing: the reason a risk function wants Python is to check the vendor system's number independently. Being able to build a rough independent calculation is a control, not a convenience, and saying that shows you understand why they asked.

   Where candidates lose it

   Claiming a level you can't demonstrate. Buy-side risk interviews frequently follow this with a screen-share or a whiteboard question, so calibrate honestly. And the answer that wins is one small finished project described in detail, not a list of libraries.

   Expect next

   • Walk me through how you'd compute historical VaR in pandas.
   • What went wrong in that project?
   • Have you used SQL, and for what?

   Reported by candidates at BlackRock (Risk and Quantitative Analysis, New York, 2026). Source: Wall Street Oasis.

4. 094What do you know about our firm?Fit and careerCorephone / first roundBLBlackRockRisk Management · Atlanta · 2025

   Say this

   Three layers: what the firm does and how it makes money, something specific and recent, and something specific about the team you're interviewing for. Then connect the third one to why you're here. Sixty to ninety seconds, not a recital.

   Then walk it

   1. Layer one, the business model in one or two sentences, and get the revenue engine right. For an asset manager: assets under management, the fee rate, the active-passive mix, and the technology or analytics business if there is one. Getting this wrong is disqualifying, and a surprising number of candidates do.
   2. Layer two, something recent and specific. A result, an acquisition, a product launch, a published piece of research, a regulatory development affecting them. One item, with a fact attached, from the last few months.
   3. Layer three, and this is the one that separates candidates: the team. What does this risk function actually do here? Is it a second-line control function, an investment risk team sitting with portfolio managers, or a client-facing analytics business? Those are three different jobs and the answer should show you know which one you applied for.
   4. Then close the loop: one sentence connecting layer three to your own interest. 'The reason I want this seat specifically is that investment risk here sits next to the portfolio managers rather than reporting on them after the fact, and that's the kind of risk work I want to do.'
   5. Where to get it: the annual report and the latest quarterly results, the firm's own research or thought-leadership output, and one conversation with someone who works there if you can get it. A detail from an actual conversation beats anything on the website.
   6. What to avoid: reciting the About Us page, quoting a founding date, praising 'culture' or 'innovation' with nothing attached, or mixing them up with a competitor. Generic flattery reads as no preparation.
   7. And have one question ready that shows the same preparation, because this question and your questions at the end are graded together.

   Where candidates lose it

   Generic praise and a wrong revenue model. The specific thing that separates a prepared candidate is knowing what this particular risk team does and how it's positioned, because that's checkable and almost nobody does it. One recent specific fact plus that is the whole answer.

   Expect next

   • Why us rather than a bank?
   • What do you think the biggest risk to our business is?
   • What questions do you have for me?

   Reported by candidates at BlackRock (Risk Management, Atlanta, 2025). Source: Wall Street Oasis.

5. 095Describe a time you worked with data.Fit and careerCorephone / first roundBLBlackRockRisk Management · Atlanta · 2025

   Say this

   Pick one project, say what the question was, what you did, what you found, and what you got wrong. The finding and the mistake are what make it credible. Keep it to ninety seconds and be ready for three levels of follow-up on the detail.

   Then walk it

   1. Lead with the question, not the tools. 'I wanted to know whether the volatility of the Nifty had actually risen or whether it just felt that way after 2020' is a much better opening than 'I used pandas to analyse a dataset'.
   2. Then the data: source, size, period, and what was wrong with it. Missing days, survivorship in the constituent list, corporate actions, duplicate rows. Every real dataset is dirty and describing the cleaning is what proves you touched it.
   3. Then the method, briefly and honestly. What you computed, why that rather than something else, and what you checked. If you ran a regression, say what you did about the standard errors, because that's where an interviewer will probe.
   4. Then the finding, with a number. 'Realised volatility was higher but the increase was concentrated in twenty trading days; the median day was unchanged' is a finding. 'Volatility increased' is not.
   5. Then what you got wrong, and this is the part that earns trust. 'My first pass double-counted the 2020 period because I'd merged on date without aligning timezones, and the result looked much stronger than it was.' Nobody believes a project with no mistakes.
   6. Then the consequence: what decision it changed, what you'd do differently, or what it made you want to learn. A project with no consequence sounds like homework.
   7. And pick something you can defend at three levels of depth. The story, the method, and the code. If you can't say how you'd reproduce it, choose a different story.

   Where candidates lose it

   Describing tools instead of a question and a finding. And a suspiciously clean narrative. Interviewers who work with data every day know that the interesting part is what was wrong with the data, so a story with no friction reads as invented or as coursework.

   Expect next

   • What would you do differently?
   • How did you validate the result?
   • What was the hardest part of cleaning it?

   Reported by candidates at BlackRock (Risk Management, Atlanta, 2025). Source: Wall Street Oasis.

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.