Risk Management interview preparation
Market, credit and operational risk, plus model validation, regulatory capital, liquidity and ALM, the statistical foundations and the Indian regulatory syllabus. Every question is either traced to a named firm from a public candidate report, or tagged at desk level when we could not trace it — and answers lead with the point, then the mechanism, then the limitation.
100 questions, mapped to the firms that asked them
- Questions
- 100
- Traced to a firm
- 37
- Firms
- 12
- Updated
- September 2026
001What is risk?UBSRisk Management · Zurich · 2021
Say this
Risk is exposure to an uncertain outcome that you care about. Two ingredients: you don't know what will happen, and some of the outcomes hurt. If you don't know but every outcome is fine, that's just noise, not risk.
Then walk it
- Separate risk from uncertainty. Risk is where you can put a distribution on outcomes, even a rough one. Knightian uncertainty is where you can't, and that's the harder problem for a risk function.
- Risk is two-sided in finance theory and one-sided in a risk seat. A portfolio manager cares about variance; my job is the left tail and whether the firm survives it.
- It's always relative to an objective. The same position is risky for a bank funding overnight and safe for a pension fund matching 20-year liabilities. No objective, no risk measure.
- In practice a bank decomposes it: market, credit, liquidity, operational, and then the ones that don't fit a formula, like conduct, model and strategic risk.
- And the honest limitation: every number I produce is a model of risk, not risk itself. The risks that actually kill firms are usually the ones nobody had a distribution for.
Where candidates lose it
Answering 'volatility' or 'standard deviation'. That's a measure of one kind of risk, not a definition, and a risk interviewer will read it as textbook recall. Lead with uncertainty plus harm, then say that the measure depends on whose objective you are protecting.
Expect next
- Is volatility risk?
- What's the difference between risk and uncertainty?
- Which risk would you say is the hardest to quantify?
Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.
002Describe what Value at Risk is.UBSRisk Management · Zurich · 2021BlackRockRisk and Quantitative Analysis · New York · 2026
Say this
VaR is a loss threshold with a probability attached. A one-day 99% VaR of $10m means that on 99 days out of 100 you expect to lose less than $10m, so roughly two or three days a year you should lose more.
Then walk it
- Three inputs, and you have to state all three: the horizon, the confidence level, and the portfolio. A VaR number without a horizon and a confidence level is meaningless.
- Mechanically it's a quantile of the profit and loss distribution. You build a distribution of possible one-day P&L and read off the first percentile.
- It's popular because it aggregates. One number covers equities, rates and FX on the same scale, which is what lets a board set a firmwide limit.
- The breach count is the test. At 99% over 250 trading days you expect about 2.5 exceptions. Zero exceptions is not a good model, it's a conservative one, and regulators treat both directions as a problem.
- The limitation I'd say without being asked: VaR tells you where the tail starts and nothing about how deep it goes. A $10m VaR is consistent with a $15m bad day and with a $500m one.
Where candidates lose it
Saying 'the maximum you can lose'. It is precisely not the maximum, and that phrase is the single fastest way to fail a market risk screen. Say 'the loss you exceed one percent of the time' and give the expected breach count.
Expect next
- So what is the maximum you can lose?
- What does a 99% one-day VaR of $10m imply about breaches per year?
- Would you rather a board saw VaR or expected shortfall?
Reported by candidates at UBS (Risk Management, Zurich, 2021); BlackRock (Risk and Quantitative Analysis, New York, 2026). Source: Wall Street Oasis.
003What are the methodologies to compute VaR?UBSRisk Management · Zurich · 2021
Say this
Three: historical simulation, parametric or variance-covariance, and Monte Carlo. They differ in one thing only, where the distribution of returns comes from. Historical takes it from the past, parametric assumes it, Monte Carlo generates it.
Then walk it
- Historical simulation: take the last 250 or 500 days of factor moves, apply each one to today's portfolio, sort the P&L, read the percentile. No distributional assumption, and it keeps whatever fat tails and correlations actually happened.
- Parametric: assume returns are normal, estimate the covariance matrix, and VaR is just portfolio volatility times a z-score. At 99% that multiplier is 2.33, at 95% it's 1.645.
- Monte Carlo: specify a process for each risk factor, simulate tens of thousands of paths, revalue the portfolio on each one, read the percentile. The only one that handles path dependency and big non-linearity properly.
- The trade-off is the same triangle every time: parametric is fast and wrong in the tails, historical is honest but limited to one history, Monte Carlo is flexible but expensive and only as good as the process you assumed.
- In practice most banks run historical as the official number and parametric as a same-day sanity check, with Monte Carlo reserved for the exotic book. Running two and explaining the gap is itself a control.
Where candidates lose it
Listing the three names and stopping. The interviewer wants the axis they differ on and when you'd pick each. If you can't say which one you'd use for a portfolio of barrier options, you have named the methods without understanding them.
Expect next
- Which would you use for a book of barrier options, and why?
- Which would you use if you had two years of data and 5,000 positions?
- How would you reconcile two VaR numbers that differ by 30 percent?
Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.
Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.

