Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 001What is risk?Market risk and VaRCorephone / first roundUBSRisk Management · Zurich · 2021

   Say this

   Risk is exposure to an uncertain outcome that you care about. Two ingredients: you don't know what will happen, and some of the outcomes hurt. If you don't know but every outcome is fine, that's just noise, not risk.

   Then walk it

   1. Separate risk from uncertainty. Risk is where you can put a distribution on outcomes, even a rough one. Knightian uncertainty is where you can't, and that's the harder problem for a risk function.
   2. Risk is two-sided in finance theory and one-sided in a risk seat. A portfolio manager cares about variance; my job is the left tail and whether the firm survives it.
   3. It's always relative to an objective. The same position is risky for a bank funding overnight and safe for a pension fund matching 20-year liabilities. No objective, no risk measure.
   4. In practice a bank decomposes it: market, credit, liquidity, operational, and then the ones that don't fit a formula, like conduct, model and strategic risk.
   5. And the honest limitation: every number I produce is a model of risk, not risk itself. The risks that actually kill firms are usually the ones nobody had a distribution for.

   Where candidates lose it

   Answering 'volatility' or 'standard deviation'. That's a measure of one kind of risk, not a definition, and a risk interviewer will read it as textbook recall. Lead with uncertainty plus harm, then say that the measure depends on whose objective you are protecting.

   Expect next

   • Is volatility risk?
   • What's the difference between risk and uncertainty?
   • Which risk would you say is the hardest to quantify?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

2. 002Describe what Value at Risk is.Market risk and VaRCoretechnicalUBSRisk Management · Zurich · 2021BLBlackRockRisk and Quantitative Analysis · New York · 2026

   Say this

   VaR is a loss threshold with a probability attached. A one-day 99% VaR of $10m means that on 99 days out of 100 you expect to lose less than $10m, so roughly two or three days a year you should lose more.

   Then walk it

   1. Three inputs, and you have to state all three: the horizon, the confidence level, and the portfolio. A VaR number without a horizon and a confidence level is meaningless.
   2. Mechanically it's a quantile of the profit and loss distribution. You build a distribution of possible one-day P&L and read off the first percentile.
   3. It's popular because it aggregates. One number covers equities, rates and FX on the same scale, which is what lets a board set a firmwide limit.
   4. The breach count is the test. At 99% over 250 trading days you expect about 2.5 exceptions. Zero exceptions is not a good model, it's a conservative one, and regulators treat both directions as a problem.
   5. The limitation I'd say without being asked: VaR tells you where the tail starts and nothing about how deep it goes. A $10m VaR is consistent with a $15m bad day and with a $500m one.

   Where candidates lose it

   Saying 'the maximum you can lose'. It is precisely not the maximum, and that phrase is the single fastest way to fail a market risk screen. Say 'the loss you exceed one percent of the time' and give the expected breach count.

   Expect next

   • So what is the maximum you can lose?
   • What does a 99% one-day VaR of $10m imply about breaches per year?
   • Would you rather a board saw VaR or expected shortfall?

   Reported by candidates at UBS (Risk Management, Zurich, 2021); BlackRock (Risk and Quantitative Analysis, New York, 2026). Source: Wall Street Oasis.

3. 003What are the methodologies to compute VaR?Market risk and VaRCoretechnicalUBSRisk Management · Zurich · 2021

   Say this

   Three: historical simulation, parametric or variance-covariance, and Monte Carlo. They differ in one thing only, where the distribution of returns comes from. Historical takes it from the past, parametric assumes it, Monte Carlo generates it.

   Then walk it

   1. Historical simulation: take the last 250 or 500 days of factor moves, apply each one to today's portfolio, sort the P&L, read the percentile. No distributional assumption, and it keeps whatever fat tails and correlations actually happened.
   2. Parametric: assume returns are normal, estimate the covariance matrix, and VaR is just portfolio volatility times a z-score. At 99% that multiplier is 2.33, at 95% it's 1.645.
   3. Monte Carlo: specify a process for each risk factor, simulate tens of thousands of paths, revalue the portfolio on each one, read the percentile. The only one that handles path dependency and big non-linearity properly.
   4. The trade-off is the same triangle every time: parametric is fast and wrong in the tails, historical is honest but limited to one history, Monte Carlo is flexible but expensive and only as good as the process you assumed.
   5. In practice most banks run historical as the official number and parametric as a same-day sanity check, with Monte Carlo reserved for the exotic book. Running two and explaining the gap is itself a control.

   Where candidates lose it

   Listing the three names and stopping. The interviewer wants the axis they differ on and when you'd pick each. If you can't say which one you'd use for a portfolio of barrier options, you have named the methods without understanding them.

   Expect next

   • Which would you use for a book of barrier options, and why?
   • Which would you use if you had two years of data and 5,000 positions?
   • How would you reconcile two VaR numbers that differ by 30 percent?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

4. 013Take me through the basic concepts in market risk. What are the main types?Market risk and VaRCorephone / first roundScotiabankRisk · Toronto · 2025

   Say this

   Market risk is the risk of loss from moves in market prices, and it splits by the factor driving it: interest rate, equity, foreign exchange, credit spread and commodity. Then volatility risk sits across all of them once you hold options.

   Then walk it

   1. Interest rate risk is usually the biggest for a bank, and it has shape as well as level: parallel shifts, steepening and flattening, and basis between curves.
   2. Credit spread risk is separate from interest rate risk even though both show up in a bond price. One is the risk-free curve moving, the other is the spread over it, and they often move in opposite directions in a flight to quality.
   3. Equity, FX and commodity risk are more straightforward directionally, but FX carries a funding dimension too, because a cross-currency basis move hits you even with no net FX position.
   4. Volatility risk comes free with any option book: vega for the level of implied vol, and then the shape, skew and term structure.
   5. Then the two that candidates forget. Basis risk, where your hedge and your exposure are driven by different but correlated factors. And market liquidity risk, where the price you can actually transact at is worse than the mark.
   6. The way a desk measures all of it is sensitivities plus VaR plus stress. Sensitivities for daily trading decisions, VaR for aggregation and limits, stress for the scenarios VaR can't see.

   Where candidates lose it

   Giving four factor names and stopping. Two things lift the answer: separating credit spread risk from interest rate risk, and naming basis risk and market liquidity risk as market risks in their own right. Those are the ones that actually generate P&L surprises.

   Expect next

   • Which of those is largest for a commercial bank, and why?
   • Is credit spread risk market risk or credit risk?
   • Now tell me about counterparty credit risk.

   Reported by candidates at Scotiabank (Risk, Toronto, 2025). Source: Wall Street Oasis.

5. 020Explain the Greeks to me.Greeks and sensitivitiesCoretechnicalBank market riskDerivatives risk

   Say this

   They're the partial derivatives of an option's value with respect to each input. Delta is sensitivity to spot, gamma is how delta changes, vega is sensitivity to implied volatility, theta is time decay and rho is sensitivity to rates.

   Then walk it

   1. Delta, first derivative in spot. Roughly 0.5 for an at-the-money option, and it's also the hedge ratio, so it tells you how much stock to short.
   2. Gamma, second derivative in spot. It's the curvature, it's largest at the money and near expiry, and it's the reason a static delta hedge stops working when the market moves.
   3. Vega, sensitivity to implied vol. Largest for long-dated at-the-money options, because there's more time for volatility to matter. A one-point vol move on a big vega book is real money.
   4. Theta, the passage of time. A long option position bleeds theta and collects gamma; a short position collects theta and is short gamma. That trade-off is the whole economics of an option book.
   5. Rho for rates, and for anything with a dividend or a carry you also need the sensitivity to that. On FX options you have two rho-like terms, one per currency.
   6. From a risk seat the ones that cause incidents are gamma and vega, not delta. Delta is easy to see and easy to hedge. Gamma and vega are where a book that looks flat loses money.

   Where candidates lose it

   Reciting definitions without saying which ones matter to a risk manager. Delta is the one traders talk about and the one risk cares least about, because it's hedgeable intraday. Say that gamma and vega are where the losses come from and you sound like you've sat on a desk.

   Expect next

   • Which Greek is hardest to hedge, and why?
   • What is the relationship between gamma and theta?
   • How would you set a limit framework on an options book?
6. 023Explain duration and convexity.Greeks and sensitivitiesCoretechnicalBank market riskTreasury and ALM

   Say this

   Duration is the first-order sensitivity of a bond's price to yield, convexity is the second-order correction. Duration is the slope of the price-yield curve and convexity is its curvature, which is why a duration-only estimate always understates the price rise and overstates the fall.

   Then walk it

   1. Macaulay duration is the weighted average time to cash flow, in years. Modified duration is that divided by one plus the yield, and it's the one you use: price change is roughly minus modified duration times the yield change.
   2. Worked number: a bond with modified duration of 7 and a 100 basis point yield rise loses about 7 percent. With convexity of 60, you add half times 60 times 0.01 squared, which is 0.3 percent, so the real loss is closer to 6.7 percent.
   3. Convexity is positive for a plain vanilla bond, which is good for the holder. Your gains from a rally exceed your losses from an equal sell-off.
   4. Negative convexity is the thing to watch. A callable bond or a mortgage-backed security has it, because when rates fall the issuer or homeowner prepays and you don't get the upside. That's the whole story of mortgage hedging, and it's why MBS books need dynamic hedging.
   5. Duration also assumes a parallel shift. A steepening curve can hurt you badly on a barbell that looks duration-matched, which is why you look at key rate durations by bucket, not one number.
   6. And the term to have ready: DV01, or price value of a basis point, is the same idea in money rather than percent, and it's what a rates desk actually manages to.

   Where candidates lose it

   Defining duration as 'time to maturity'. It isn't, except for a zero-coupon bond, and the interviewer is listening for that error. The second differentiator is negative convexity on callables and mortgages, because that's where the real risk management problem sits.

   Expect next

   • What is DV01?
   • Why does a mortgage-backed security have negative convexity?
   • Two portfolios have the same duration. How can their risk differ?
7. 025Explain PD, LGD and EAD.Credit riskCorephone / first roundBank credit riskRating agencies

   Say this

   They're the three inputs to expected loss. Probability of default is how likely the borrower stops paying, loss given default is the fraction you don't recover, and exposure at default is how much is outstanding when it happens. Multiply the three and you have expected loss.

   Then walk it

   1. PD is a probability over a horizon, usually one year, and it comes from a rating or a scorecard. Say the horizon, because a one-year PD and a lifetime PD are very different numbers.
   2. LGD is one minus the recovery rate, expressed on the exposure. It's driven by collateral, seniority and how good the legal enforcement regime is. Senior secured on a warehouse in a good jurisdiction might be 25 percent; unsecured sub debt is 70 to 90.
   3. EAD is what's actually outstanding at default. For a term loan it's roughly the drawn balance. For a revolver or a credit card it's the drawn amount plus a credit conversion factor on the undrawn part, because stressed borrowers draw their lines down before they default.
   4. Worked number: a 100 crore facility, PD of 2 percent, LGD of 40 percent gives expected loss of 0.8 crore, so 80 basis points. That's a provisioning and pricing number, not a capital number.
   5. The three are not independent, and that's the bit people miss. In a recession PD rises and recoveries fall at the same time, because collateral values are down and everyone is selling. That's downturn LGD, and Basel requires you to use it rather than a long-run average.
   6. For a derivative there's no drawn balance, so EAD has to be modelled from potential future exposure. That's a different exercise entirely, and it's why counterparty credit risk has its own framework.

   Where candidates lose it

   Getting the definitions right and missing that PD and LGD are correlated. Using an average recovery rate through a downturn understates loss badly, and downturn LGD is a specific Basel requirement. Also state the PD horizon; a PD without a horizon is not a number.

   Expect next

   • Why does Basel require downturn LGD?
   • How do you estimate EAD on a revolver?
   • How would you estimate PD for a borrower with no rating?
8. 026What's the difference between expected and unexpected loss, and which one does capital cover?Credit riskCoretechnicalBank credit riskRegulatory reporting

   Say this

   Expected loss is the average you lose in a normal year, and it's covered by provisions and priced into the loan spread. Unexpected loss is the deviation above that in a bad year, and that's what capital is for. Provisions cover the mean, capital covers the tail.

   Then walk it

   1. Expected loss is PD times LGD times EAD. It's a cost of doing business, so it belongs in the price. If your spread doesn't cover EL plus funding plus operating cost plus a return on capital, you're lending at a loss.
   2. Unexpected loss is the distance from the mean to a high quantile of the loss distribution, usually 99.9 percent over one year in Basel's IRB framework. That's the one-in-a-thousand-year bad year the bank is supposed to survive.
   3. The distribution is heavily right-skewed, not normal, because defaults are correlated. Most years you lose a little, occasionally you lose a lot, and the asymmetry is driven entirely by that correlation.
   4. The mechanism is the asset correlation assumption. If defaults were independent, a large portfolio would have almost no unexpected loss and you'd need almost no capital. Basel's IRB formula bakes in correlations of roughly 12 to 24 percent for corporates, and it's that number, not PD, that creates the capital requirement.
   5. Numerical feel: a portfolio with 80 basis points of expected loss might carry a 99.9 percent loss of 5 or 6 percent. So capital is several times provisions, and that ratio widens for a concentrated book.
   6. The gap that matters in practice: IFRS 9 provisions and Basel expected loss are computed differently, so the two rarely agree, and the shortfall or excess adjusts CET1. That reconciliation is a real job in a bank's finance and risk function.

   Where candidates lose it

   Saying capital covers expected loss. It doesn't, provisions do, and mixing those up is a hard fail in a credit risk interview. The answer that stands out names asset correlation as the thing generating unexpected loss, because a candidate who says that understands why a diversified book still needs capital.

   Expect next

   • Why is the loss distribution skewed?
   • What drives the size of unexpected loss more, PD or correlation?
   • How does the IFRS 9 provision interact with regulatory capital?
9. 036What is counterparty credit risk?Counterparty risk and CVACorephone / first roundScotiabankRisk · Toronto · 2025

   Say this

   It's the risk that the other side of a derivative or a securities financing trade defaults while the trade is in your favour. What makes it different from loan credit risk is that the exposure isn't a fixed amount: it's market-driven, two-sided, and it changes every day.

   Then walk it

   1. With a loan you know the exposure, it's the balance outstanding. With a swap, the exposure is the replacement cost, which can be zero today, in your favour tomorrow, and against you next week.
   2. That's why exposure has to be modelled rather than read off a ledger: current exposure is today's mark-to-market if positive, and potential future exposure is a high quantile of what it could become over the life of the trade.
   3. It's a hybrid of credit and market risk, which is why it sits awkwardly in bank org charts. You need a credit view on the counterparty and a market view on the exposure profile, and the interaction of the two is where the hard part lives.
   4. Mitigants in order of power: netting agreements under an ISMA or ISDA master, collateral and margin under a CSA, then central clearing, then break clauses and downgrade triggers.
   5. The specific flavour that catches people out is wrong-way risk, where the exposure grows precisely as the counterparty's credit deteriorates. That's not a diversifiable add-on, it's a fundamental change in the shape of the loss distribution.
   6. And the capital and pricing angle: CVA is the market price of this risk and it sits in the P&L. After 2008, Basel added a CVA capital charge because two-thirds of crisis counterparty losses were mark-to-market CVA losses rather than actual defaults.

   Where candidates lose it

   Describing it as 'credit risk on a derivative' and stopping. The distinguishing feature is that the exposure is stochastic and two-sided, and if you can't say that you can't explain why the discipline needs its own modelling. Name netting, collateral and wrong-way risk without being prompted.

   Expect next

   • How do you measure the exposure if it changes daily?
   • What is wrong-way risk?
   • Why does central clearing help, and what does it cost?

   Reported by candidates at Scotiabank (Risk, Toronto, 2025). Source: Wall Street Oasis.

10. 042What is operational risk, and what are the Basel event categories?Operational riskCorephone / first roundOperational riskGlobal capability centres

    Say this

    Basel defines it as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It explicitly includes legal risk and excludes strategic and reputational risk. Seven event categories, and the money is concentrated in two of them.

    Then walk it

    1. The seven Level 1 categories: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management.
    2. The distribution is extremely skewed. Clients, products and business practices is where the enormous losses sit, because that's mis-selling, market manipulation and conduct fines. Execution and process management is where the high-frequency, low-severity losses sit.
    3. That skew shapes the whole discipline. You need two lenses: a frequency lens for process errors, which you fix with controls and automation, and a severity lens for tail conduct events, which you manage through governance and culture rather than through controls.
    4. The measurement toolkit: internal loss data, external loss data for events you haven't had, scenario analysis for the tail, RCSAs for the forward-looking control view, and KRIs for early warning. Those five are the standard op risk framework and you should be able to name all five.
    5. Capital: Basel III's Standardised Measurement Approach replaced the old internal models. It's a Business Indicator Component scaled by a marginal coefficient, then multiplied by an Internal Loss Multiplier based on your ten-year average loss history. So your own losses now drive your capital, which is the incentive it was designed to create.
    6. The honest difficulty: operational risk loss data is sparse and non-stationary. Ten years of history contains very few tail events, and the risks that matter now, cyber and third-party concentration, barely appear in it. So scenario analysis carries weight that the maths can't support, and that's a judgement-heavy exercise.

    Where candidates lose it

    Reducing operational risk to fraud and system failure. The largest losses in banking history in this category are conduct and mis-selling, not rogue traders or outages. Naming 'clients, products and business practices' as the big-money bucket immediately shows you've looked at the loss data.

    Expect next

    • Which category holds the biggest losses historically?
    • How is operational risk capital calculated now?
    • Where does cyber risk fit in that taxonomy?

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.