Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 045Explain the three lines of defence.Operational riskCorephone / first roundOperational riskGlobal capability centres

   Say this

   First line is the business, which owns and manages the risk it takes. Second line is risk and compliance, which sets the framework, sets limits and independently challenges. Third line is internal audit, which gives the board assurance that the first two are working.

   Then walk it

   1. The first line's ownership is the part that's usually wrong in practice. The trader owns the market risk, the lending officer owns the credit decision, the operations head owns the process risk. If the business thinks risk management owns risk, the model has already failed.
   2. Second line has two jobs that sit in tension: it advises the business and it challenges the business. That's why independence matters, and why the CRO reports to the board risk committee and not just to the CEO.
   3. Third line is independent of both and reports to the audit committee. It does not run controls, it tests whether they exist and work. Audit sitting in management meetings designing controls destroys its own assurance value.
   4. The interesting judgement calls: where does a desk-embedded risk analyst sit? Where does model validation sit relative to model development? Where does finance sit? Getting those boundaries wrong is how conflicts creep in.
   5. The standard criticisms, worth volunteering. It creates a compliance mindset where the first line assumes the second line will catch things. Responsibilities blur in the middle. And it can become three layers of reporting rather than three layers of control.
   6. That's why the IIA updated it in 2020 into a 'three lines model' with less rigid boundaries and more emphasis on governance and alignment. Knowing the model has been revised, and why, is usually more than the interviewer expects.

   Where candidates lose it

   Reciting the three lines without saying the first line owns the risk. That single point is what the question is testing. And if you can name a real ambiguity, like where model validation sits, you show you've seen the model collide with an actual org chart.

   Expect next

   • Where does model validation sit?
   • What's the main criticism of the model?
   • Who does the CRO report to, and why does it matter?
2. 053Give me Basel III in one minute.Regulatory capitalCorephone / first roundRegulatory reportingIndian bank risk and treasury

   Say this

   Basel III was the post-2008 response, and it did three things the earlier accords didn't: it raised the quality and quantity of capital, it added a leverage ratio as a non-risk-based backstop, and it introduced liquidity standards for the first time.

   Then walk it

   1. Capital quality: the focus moved to common equity Tier 1, real loss-absorbing equity. Minimum CET1 of 4.5 percent of RWAs, Tier 1 of 6, total capital of 8, plus a 2.5 percent capital conservation buffer, so a functioning bank runs at 7 percent CET1 minimum before any add-ons.
   2. Buffers on top: a countercyclical buffer of zero to 2.5 percent that supervisors raise in a boom, and a surcharge for global and domestic systemically important banks. Breaching the buffers doesn't close the bank, it restricts dividends and bonuses, which is the point.
   3. Leverage ratio: Tier 1 over total unweighted exposure, minimum 3 percent. It exists because risk weights were gamed before 2008 and banks ran 50-to-1 leverage with beautiful risk-based ratios.
   4. Liquidity, entirely new in Basel III. LCR requires 30 days of high quality liquid assets against stressed outflows. NSFR requires stable funding against illiquid assets over a year. Northern Rock was solvent, so capital rules alone were never going to be enough.
   5. Plus counterparty reforms: a CVA capital charge, higher standards for exposure modelling, and incentives to clear centrally.
   6. The Indian version: RBI applies CET1 of 5.5 percent rather than 4.5, plus a 2.5 percent conservation buffer, so minimum CRAR is 11.5 percent against Basel's 10.5. India has been consistently more conservative on the capital ratio and slower on some of the market risk pieces.
   7. The fair criticism to volunteer: complexity. The framework is thousands of pages, RWA calculations are barely comparable across banks, and that opacity is exactly what the leverage ratio and the Basel IV output floor were added to contain.

   Where candidates lose it

   Listing ratios without the three themes. What an interviewer wants is capital quality, a non-risk-based backstop, and liquidity standards. And know the Indian numbers if you're interviewing in India, because CRAR of 11.5 percent versus 10.5 is a detail that immediately places you.

   Expect next

   • Why add a leverage ratio if you already have risk weights?
   • What happens if a bank dips into its conservation buffer?
   • How does RBI's implementation differ?
3. 054What is CET1, and what qualifies as CET1 capital?Regulatory capitalCoretechnicalRegulatory reportingIndian bank risk and treasury

   Say this

   Common equity Tier 1 is the purest loss-absorbing capital: ordinary shares, share premium, retained earnings and disclosed reserves, minus a set of regulatory deductions. It's the numerator regulators actually care about, because it absorbs losses while the bank is still trading.

   Then walk it

   1. What's in it: paid-up ordinary share capital, share premium, retained earnings, accumulated other comprehensive income, and statutory reserves. Minority interests only in limited circumstances.
   2. The deductions are where the real work is: goodwill and other intangibles, deferred tax assets arising from losses, defined benefit pension surpluses, own shares held, significant investments in other financial institutions above thresholds, and the IRB shortfall of provisions against Basel expected loss.
   3. Why deductions matter so much: goodwill has no value in a liquidation, and a DTA from past losses is only worth something if you're profitable, which you aren't in the scenario the capital is for. So both get removed.
   4. The tiers above it: Additional Tier 1, which is perpetual and loss-absorbing through conversion or write-down, typically AT1 contingent convertibles that trigger when CET1 falls below 5.125 or 7 percent. Then Tier 2, mostly dated subordinated debt, which only absorbs loss in a gone-concern.
   5. That distinction between going-concern and gone-concern capital is the whole logic of the tiering, and it's the sentence that shows you understand it rather than having memorised a list.
   6. The 2023 reality check: Credit Suisse's AT1 was written down in full while shareholders received value in the UBS transaction. That inverted the expected hierarchy and repriced the whole AT1 market, and it's a live example of how gone-concern capital behaves under political pressure.
   7. Indian specifics: RBI requires CET1 of 5.5 percent, and Indian public sector banks have historically carried large DTAs and government recapitalisation bonds, so the deduction rules have a bigger effect on reported CET1 there than the headline ratio suggests.

   Where candidates lose it

   Listing what's included and skipping the deductions. The deductions are where CET1 differs from book equity, and goodwill plus DTA are the two that matter most. The answer that stands out explains going-concern versus gone-concern capital as the reason for the tiering.

   Expect next

   • Why is goodwill deducted?
   • What is an AT1 CoCo and when does it convert?
   • What did the Credit Suisse AT1 write-down change?
4. 055What are risk-weighted assets, and how are they computed?Regulatory capitalCoretechnicalRegulatory reportingBank credit risk

   Say this

   RWAs are the denominator of the capital ratio: exposures scaled by how risky they are. You compute them separately for credit, market and operational risk and add them up. A sovereign bond might carry a zero weight and an unsecured corporate loan 100 percent, so the same balance sheet size can imply very different capital.

   Then walk it

   1. Credit risk RWA, standardised approach: exposure times a prescribed weight by counterparty type and rating. Cash and most domestic sovereign zero, banks 20 to 100 depending on rating, residential mortgages 35 or lower under the revised rules, unrated corporates 100, and some specialised lending at 150.
   2. Credit risk RWA, internal ratings based: you feed your own PD, LGD and EAD into the Basel formula, which computes a 99.9 percent one-year unexpected loss and multiplies by 12.5. Same idea, but the weight is derived from your models rather than a table.
   3. Market risk RWA covers the trading book, now under FRTB with a sensitivities-based standardised approach or an internal models approach built on expected shortfall.
   4. Operational risk RWA under the standardised measurement approach: a Business Indicator Component from income and balance sheet size, scaled by an internal loss multiplier from your own ten-year loss history.
   5. Then the capital ratio is CET1 divided by total RWA. So there are two ways to improve it: raise capital or shrink RWA. RWA optimisation, shifting to lower-weighted assets, buying protection, improving collateral documentation, is a whole industry and a legitimate one within limits.
   6. The criticism: RWA density varies enormously across banks with similar books, largely because of IRB model differences. A European bank might run RWAs at 30 percent of total assets and a US bank at 60 for comparable risk. That comparability failure is why Basel IV added an output floor.
   7. Rough feel for scale: for a typical commercial bank, total RWA runs 50 to 70 percent of total assets, with credit risk 80 to 90 percent of the RWA total. Market risk is usually small unless there's a real trading book.

   Where candidates lose it

   Explaining the weights and never mentioning that banks can and do manage RWA down. An interviewer wants to hear both that RWA optimisation is a real activity and that its abuse is why the output floor exists. Also know the rough RWA-to-assets ratio, because it makes the number concrete.

   Expect next

   • How would a bank legitimately reduce its RWAs?
   • Why do RWA densities differ so much between banks?
   • What proportion of RWAs is credit risk for a typical bank?
5. 060Distinguish funding liquidity risk from market liquidity risk.Liquidity risk and ALMCoretechnicalTreasury and ALMBank market risk

   Say this

   Funding liquidity risk is not being able to meet your obligations as they fall due. Market liquidity risk is not being able to sell an asset at anything near its marked price. They're different risks, and the danger is that each one triggers the other.

   Then walk it

   1. Funding liquidity is a balance sheet and cash flow problem: deposits leave, a wholesale line isn't rolled, a margin call lands, and you need cash today. It's binary and it's fatal. You are either able to pay or you are not.
   2. Market liquidity is a price problem: bid-offer, depth, and how far the price moves against you when you try to sell size. It's continuous, and it shows up as a haircut on what your book is really worth.
   3. The spiral is the real answer. You need funding, so you sell assets. Selling into a thin market depresses the price. The lower mark reduces your collateral value and your capital, which makes funding harder, so you sell more. That's the liquidity spiral, and it's what turned 2008 from a credit event into a systemic one.
   4. Measurement differs completely. Funding liquidity: contractual and behavioural cash flow ladders, survival horizon, LCR and NSFR, and a stress test on deposit outflow. Market liquidity: bid-offer spreads, days of average daily volume to exit, and a liquidity-adjusted VaR or an exit-cost haircut.
   5. Worked example: a bond book marked at 100 crore, where the position is ten days of average volume. In a stress you might realise 92, so the honest liquidity-adjusted value is 92, not 100. The mark is not the exit price, and that 8 crore is the market liquidity risk in money.
   6. FRTB codified this by making liquidity horizons vary from 10 to 120 days by risk factor, so illiquid risk now costs more capital. That's the regulatory acknowledgement that a mark is not a price you can get.
   7. The thing to say without prompting: almost every bank failure is ultimately a funding liquidity failure. Solvency problems kill banks slowly and liquidity kills them in a week.

   Where candidates lose it

   Conflating the two, or giving definitions without the interaction. The answer that earns respect explains the spiral in both directions and says that a marked price is not an exit price. And naming that banks fail from liquidity, not capital, frames everything else you say.

   Expect next

   • How would you measure market liquidity risk in a bond book?
   • Which one killed more institutions in 2008?
   • How does FRTB handle illiquidity?
6. 088What is an ETF, and how does it differ from a mutual fund?Markets and macroCorephone / first roundFTFranklin TempletonRisk Management · San Mateo · 2017PIMCOCompliance · Los Angeles · 2024

   Say this

   Both are pooled funds. The difference is the plumbing: an ETF trades on an exchange all day at a market price, and a mutual fund transacts once a day directly with the fund at net asset value. That one structural difference drives everything else.

   Then walk it

   1. The mechanism that keeps an ETF near fair value is creation and redemption. Authorised participants can exchange a basket of the underlying securities for ETF shares and back again, so if the ETF trades above NAV they create and sell, which arbitrages the premium away.
   2. Consequences of that: ETFs are usually cheaper, they're typically more tax-efficient because in-kind redemption avoids realising gains in the fund, they offer intraday liquidity, and they're transparent on holdings daily.
   3. Mutual funds in exchange get no intraday pricing, but they can take flows in cash, which suits regular investing, and in India the SIP model is built on exactly that.
   4. The risk-management points that matter, and this is where a risk interview goes. The arbitrage mechanism depends on the underlying being tradeable. For a bond ETF in a stressed market the ETF price becomes the price discovery mechanism and the NAV is the stale number, so an ETF trading at a discount is often telling you the truth about the underlying.
   5. Then liquidity mismatch risk: an ETF offering intraday liquidity on illiquid underlyings, high yield, emerging market debt, small caps, shifts the liquidity cost from the fund to the seller through the discount. That's arguably better than a mutual fund where redeeming investors impose costs on those who stay.
   6. Also securities lending revenue, counterparty risk in synthetic and swap-based ETFs, tracking difference against tracking error, and concentration risk in the authorised participant network, which is a small number of firms.
   7. Indian specifics: ETFs are a smaller share of the market than in the US, EPFO allocations have driven a lot of Nifty ETF assets, and liquidity in many Indian ETFs is thin enough that the bid-offer matters more than the expense ratio. That's a real point for an Indian investor and a real risk point too.

   Where candidates lose it

   Stopping at 'ETFs trade on an exchange'. That's the fact; the creation-redemption mechanism is the explanation, and it's what the follow-up will target. For a risk role, add the liquidity mismatch point, because bond ETFs in March 2020 are the case study the interviewer has in mind.

   Expect next

   • What keeps an ETF's price close to NAV?
   • Why did bond ETFs trade at discounts in March 2020?
   • What are the risks in a synthetic ETF?

   Reported by candidates at Franklin Templeton (Risk Management, San Mateo, 2017); PIMCO (Compliance, Los Angeles, 2024). Source: Wall Street Oasis.

7. 094What do you know about our firm?Fit and careerCorephone / first roundBLBlackRockRisk Management · Atlanta · 2025

   Say this

   Three layers: what the firm does and how it makes money, something specific and recent, and something specific about the team you're interviewing for. Then connect the third one to why you're here. Sixty to ninety seconds, not a recital.

   Then walk it

   1. Layer one, the business model in one or two sentences, and get the revenue engine right. For an asset manager: assets under management, the fee rate, the active-passive mix, and the technology or analytics business if there is one. Getting this wrong is disqualifying, and a surprising number of candidates do.
   2. Layer two, something recent and specific. A result, an acquisition, a product launch, a published piece of research, a regulatory development affecting them. One item, with a fact attached, from the last few months.
   3. Layer three, and this is the one that separates candidates: the team. What does this risk function actually do here? Is it a second-line control function, an investment risk team sitting with portfolio managers, or a client-facing analytics business? Those are three different jobs and the answer should show you know which one you applied for.
   4. Then close the loop: one sentence connecting layer three to your own interest. 'The reason I want this seat specifically is that investment risk here sits next to the portfolio managers rather than reporting on them after the fact, and that's the kind of risk work I want to do.'
   5. Where to get it: the annual report and the latest quarterly results, the firm's own research or thought-leadership output, and one conversation with someone who works there if you can get it. A detail from an actual conversation beats anything on the website.
   6. What to avoid: reciting the About Us page, quoting a founding date, praising 'culture' or 'innovation' with nothing attached, or mixing them up with a competitor. Generic flattery reads as no preparation.
   7. And have one question ready that shows the same preparation, because this question and your questions at the end are graded together.

   Where candidates lose it

   Generic praise and a wrong revenue model. The specific thing that separates a prepared candidate is knowing what this particular risk team does and how it's positioned, because that's checkable and almost nobody does it. One recent specific fact plus that is the whole answer.

   Expect next

   • Why us rather than a bank?
   • What do you think the biggest risk to our business is?
   • What questions do you have for me?

   Reported by candidates at BlackRock (Risk Management, Atlanta, 2025). Source: Wall Street Oasis.

8. 095Describe a time you worked with data.Fit and careerCorephone / first roundBLBlackRockRisk Management · Atlanta · 2025

   Say this

   Pick one project, say what the question was, what you did, what you found, and what you got wrong. The finding and the mistake are what make it credible. Keep it to ninety seconds and be ready for three levels of follow-up on the detail.

   Then walk it

   1. Lead with the question, not the tools. 'I wanted to know whether the volatility of the Nifty had actually risen or whether it just felt that way after 2020' is a much better opening than 'I used pandas to analyse a dataset'.
   2. Then the data: source, size, period, and what was wrong with it. Missing days, survivorship in the constituent list, corporate actions, duplicate rows. Every real dataset is dirty and describing the cleaning is what proves you touched it.
   3. Then the method, briefly and honestly. What you computed, why that rather than something else, and what you checked. If you ran a regression, say what you did about the standard errors, because that's where an interviewer will probe.
   4. Then the finding, with a number. 'Realised volatility was higher but the increase was concentrated in twenty trading days; the median day was unchanged' is a finding. 'Volatility increased' is not.
   5. Then what you got wrong, and this is the part that earns trust. 'My first pass double-counted the 2020 period because I'd merged on date without aligning timezones, and the result looked much stronger than it was.' Nobody believes a project with no mistakes.
   6. Then the consequence: what decision it changed, what you'd do differently, or what it made you want to learn. A project with no consequence sounds like homework.
   7. And pick something you can defend at three levels of depth. The story, the method, and the code. If you can't say how you'd reproduce it, choose a different story.

   Where candidates lose it

   Describing tools instead of a question and a finding. And a suspiciously clean narrative. Interviewers who work with data every day know that the interesting part is what was wrong with the data, so a story with no friction reads as invented or as coursework.

   Expect next

   • What would you do differently?
   • How did you validate the result?
   • What was the hardest part of cleaning it?

   Reported by candidates at BlackRock (Risk Management, Atlanta, 2025). Source: Wall Street Oasis.

9. 096How would you react when a client gets impatient and emotional?Fit and careerCoretechnicalMSCIRisk Management · San Francisco · 2018

   Say this

   Slow down, acknowledge the frustration explicitly, then separate the emotion from the problem and solve the problem. Most escalations are about not being heard or not having a date, not about the technical issue itself.

   Then walk it

   1. First, don't match their energy and don't get defensive. Let them finish. Interrupting a frustrated client to correct a detail guarantees a second escalation.
   2. Acknowledge specifically rather than generically. 'You've been waiting nine days for this and you've asked twice, that's not acceptable' lands. 'I understand your frustration' does not, because it's what everyone says.
   3. Then separate the two threads out loud: what needs to happen right now, and what went wrong that let it get here. Deal with the first today and commit to the second with a date.
   4. Give a concrete next step with a time and a name. 'I'll have the corrected risk report to you by two o'clock tomorrow and I'll call you at four either way.' Then actually call at four even if you have nothing, because the follow-through is the whole repair.
   5. Don't over-promise to make the call end. A commitment you miss makes it worse, and clients remember the second miss far longer than the first.
   6. Escalate internally early, not as a last resort. If I can't fix it within the commitment, my manager needs to know before the client tells them. And if the client is asking for something we genuinely can't do, saying so clearly and offering the nearest thing we can is better than a vague maybe.
   7. If it's useful, one short real example: a month-end report that was late because of an upstream data feed. What worked was a same-day interim view with the caveats stated, rather than waiting two more days for the perfect version.

   Where candidates lose it

   Answering with 'I'd stay calm and empathise'. That's what everyone says and it's unverifiable. The answer that works has a specific acknowledgement, a concrete commitment with a time, and the follow-through call even when there's no news. And say you'd escalate early rather than absorb it quietly.

   Expect next

   • What if you can't fix it by the deadline you gave?
   • Tell me about a real time this happened to you.
   • What if the client is wrong about the facts?

   Reported by candidates at MSCI (Risk Management, San Francisco, 2018). Source: Wall Street Oasis.

10. 099Why risk management rather than the front office?Fit and careerCorephone / first roundBank market risk

    Say this

    Because the work suits how I think: I'd rather understand the whole book and where it breaks than own one position. And be straight about it, that you find the failure modes more interesting than the upside. Interviewers can tell instantly if risk is a fallback.

    Then walk it

    1. Give a positive reason, not a negative one. 'I want breadth across products and a view of the whole firm rather than one desk' is positive. 'I didn't get a trading offer' is what they're screening for and they will find it.
    2. Name what the job actually is, because that proves you know. Risk is analytical, adversarial in a constructive way, and it requires you to argue with people who are more senior and more confident than you. If you say that, you've shown you understand the seat.
    3. Point at evidence in your own history. A project where you stress-tested your own conclusion, a time you were the one asking what happens if this assumption is wrong, a dissertation or a competition where the interesting part was the tail rather than the central case.
    4. Say something about the career path honestly. Risk is one of the few functions with a genuine route to the top of a bank, the CRO seat, and it's increasingly a board-level conversation. That's a legitimate ambition to state.
    5. Then the one line that distinguishes candidates: risk management is not about saying no. It's about pricing the downside so the firm can take risk deliberately rather than accidentally. Somebody who frames the role as enabling informed risk-taking rather than blocking it sounds like they've spoken to practitioners.
    6. If you did also apply to front office roles and they ask, be honest about it and explain what changed. Denying it when your CV suggests otherwise is worse than admitting it.
    7. Close with the specific seat: market risk, credit risk, model validation or investment risk are genuinely different jobs, and naming which one and why is what makes the answer yours rather than generic.

    Where candidates lose it

    Sounding like risk is the consolation prize. The tells are talking mostly about what trading is like, having no view on which risk discipline you want, or describing the role as protecting the bank from traders. Frame it as enabling deliberate risk-taking and name the specific seat you want.

    Expect next

    • Did you apply for trading roles too?
    • Which risk discipline, and why that one?
    • Where do you want to be in five years?

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.