Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 049What's the difference between backtesting and benchmarking a model?Model risk and validationIntermediatetechnicalModel validationBank market risk

   Say this

   Backtesting compares the model to reality. Benchmarking compares it to another model. One tells you whether you're right, the other tells you whether you're different, and you need benchmarking precisely when reality doesn't give you enough observations to backtest.

   Then walk it

   1. Backtesting is the gold standard because the comparator is truth: forecast versus realised outcome. VaR exceptions against actual P&L, predicted default rates against observed defaults, predicted prepayment against actual.
   2. Its constraint is data. At 99% confidence you get about 2.5 exceptions a year, so a year of data can't distinguish a good model from a mediocre one. For a low-default portfolio, sovereigns or large corporates, you might have zero defaults in a decade, so backtesting is simply unavailable.
   3. Benchmarking fills that gap. Run a challenger model, a vendor model, or a simple closed-form approximation on the same portfolio and compare. Large unexplained divergence is a finding even if you can't say which one is right.
   4. It's also how you test parts of a model you can't observe. You can't observe a 20-year lifetime PD, but you can compare your curve to an agency cumulative default table or to CDS-implied hazard rates.
   5. The important limitation: benchmarking two models that share an assumption tells you nothing. If both assume a normal distribution, they'll agree and both be wrong. The benchmark has to be structurally different to be informative, and that's the part people get wrong.
   6. So they answer different questions. Backtesting: is the model calibrated? Benchmarking: is the model an outlier, and can I explain why? A full validation uses both plus sensitivity analysis, and leans on benchmarking exactly where data is thin.
   7. Practical example: for a low-default corporate portfolio, you'd benchmark the PD model against external ratings and market-implied PDs, use a binomial or Vasicek test for the little default data you have, and lean on the qualitative review. That combination is what a supervisor expects to see.

   Where candidates lose it

   Using the words interchangeably. And missing the key insight that benchmarking is only informative if the benchmark makes different assumptions. Two models with the same flawed assumption will agree beautifully, and a candidate who says that has thought about validation rather than memorised a checklist.

   Expect next

   • How would you validate a PD model for a portfolio with no defaults?
   • What makes a good benchmark model?
   • Your model and the benchmark differ by 40 percent. Now what?
2. 052How do you detect overfitting in a risk model?Model risk and validationIntermediatetechnicalModel validationBuy-side risk

   Say this

   The signature is a large gap between in-sample and out-of-sample performance, and for financial models specifically between in-sample and out-of-time. If accuracy collapses on data from a later period, you've fitted the era, not the relationship.

   Then walk it

   1. Standard test: hold out data, or cross-validate. But for time series you need forward-chaining rather than random k-fold, because random folds leak the future into the training set and make everything look good.
   2. The financial-specific test is out of time. Fit on 2015 to 2019, test on 2021 to 2023. Random splits from the same period share the same regime, so they flatter the model badly.
   3. Structural warning signs: parameter count relative to observations, coefficients with implausible signs or magnitudes, a variable that only works in one sub-period, and results that change materially when you drop a single year.
   4. For strategy or signal work, the killer is multiple-testing bias. If you tried 500 specifications, the best one will look great by construction. The deflated Sharpe ratio and the idea of testing on a truly held-out period exist precisely for that.
   5. Stability diagnostics: rolling-window coefficient estimates. A genuine relationship has coefficients that wobble; an overfitted one has coefficients that flip sign. And bootstrap the performance metric to see how wide the confidence interval actually is.
   6. The cultural control, which matters more than any statistic: limit how many times you look at the holdout. Every peek at the test set converts it into training data, and in practice that's how overfitting enters a model that passed every formal test.
   7. And the counterweight to state: underfitting is also a failure, and a heavily constrained model that misses real non-linearity costs money too. The judgement is whether added complexity buys performance that survives out of time.

   Where candidates lose it

   Naming cross-validation and stopping. For financial models, random cross-validation is itself a source of false confidence because of regime and look-ahead leakage. Out-of-time testing and multiple-testing bias are the two points that show you've done this on real data.

   Expect next

   • Why is random k-fold cross-validation dangerous for time series?
   • How would you account for having tried 200 specifications?
   • How would you tell overfitting apart from a regime change?
3. 056Standardised versus internal ratings based approach. Which would you rather run?Regulatory capitalIntermediatetechnicalRegulatory reportingBank credit risk

   Say this

   IRB usually gives lower capital and better risk sensitivity, so a large bank wants it. But it costs a great deal to build, maintain and defend, and after the Basel IV output floor the capital saving is capped, so for many portfolios the honest answer is now standardised.

   Then walk it

   1. Standardised: prescribed risk weights by exposure class and external rating. Cheap, comparable across banks, transparent, and completely insensitive to whether your borrowers are good or bad within a bucket. Every unrated corporate gets 100 percent whether it's excellent or nearly insolvent.
   2. Foundation IRB: you estimate PD, the supervisor sets LGD and EAD. Advanced IRB: you estimate all three. Both need supervisory approval, years of clean data, validated models and demonstrated use in actual credit decisions, the use test.
   3. The capital saving is real, often 20 to 40 percent lower RWA on a good-quality retail or mortgage book, because the prescribed weights are calibrated conservatively for the average bank.
   4. The costs: model development and validation teams, data infrastructure with long histories, annual supervisory review, and the risk that a supervisor imposes a multiplier or pulls approval, which produces a sudden capital hit. Several European banks have taken exactly that.
   5. Then Basel IV changes the calculus. The output floor requires total RWA to be at least 72.5 percent of what the standardised approach would give, phased in. Advanced IRB has been removed for exposures to large corporates and banks, and equity IRB is gone. So the saving is bounded and the cheapest portfolios to model no longer qualify.
   6. My answer: IRB where the portfolio is large, homogeneous, data-rich and where internal models genuinely discriminate, so retail mortgages and retail lending. Standardised for low-default wholesale portfolios where you were never going to estimate PD credibly anyway. Running IRB for its own sake is a large cost for capped benefit.
   7. The point worth making that goes beyond capital: the real value of IRB was never the capital saving, it was that building the models forces a bank to understand its own credit risk. Banks that adopted IRB seriously ended up with better credit decisions, and that survives the output floor.

   Where candidates lose it

   Answering 'IRB because it's lower capital'. Post-Basel IV that's only partly true, and a candidate who hasn't registered the output floor and the withdrawal of advanced IRB for large corporates is working from pre-2017 knowledge. Mention the use test too; supervisors care more about it than about the maths.

   Expect next

   • What is the use test?
   • Which portfolios can no longer use advanced IRB?
   • What happens if a supervisor withdraws IRB permission?
4. 058Why does a leverage ratio exist alongside risk-weighted capital?Regulatory capitalIntermediatetechnicalRegulatory reportingBank market risk

   Say this

   Because risk weights are model outputs and models can be wrong or gamed. The leverage ratio is a non-risk-based backstop: Tier 1 over total exposure, minimum 3 percent, and it doesn't care what you think the risk is.

   Then walk it

   1. The pre-crisis evidence is the whole argument. Banks entered 2008 with comfortable risk-based ratios and leverage of 30 or 50 to one, because sovereign debt, AAA tranches and repo books all carried tiny weights and turned out not to be riskless.
   2. So the design intent is a floor that survives being wrong about risk. It binds when a bank holds a lot of assets it has judged safe, which is exactly the situation that has historically preceded trouble.
   3. The exposure measure is deliberately broad: on-balance-sheet assets, derivative exposures including a potential future exposure add-on, securities financing transactions, and off-balance-sheet commitments converted at credit conversion factors. You can't shrink it by netting the way you can for RWA.
   4. Who it binds: banks with large low-risk-weight books. Custodians, repo intermediaries, and banks holding large government bond portfolios. For those, leverage rather than RWA is the constraint that drives the business decision.
   5. Its own weakness, and you should say it: it's risk-insensitive by construction, so it treats a treasury bill and an unsecured emerging market loan identically. That creates an incentive to shift toward higher-yielding, higher-risk assets once the ratio binds, which is the opposite of what you want.
   6. So the two measures are deliberate complements. Risk weights give you sensitivity and can be gamed; leverage gives you robustness and rewards risk-taking at the margin. Neither alone is adequate, which is the point of having both.
   7. Live example: in 2020 several jurisdictions temporarily excluded central bank reserves from the exposure measure, because deposit inflows and QE were inflating the denominator and constraining lending. That's a good illustration of the ratio binding for reasons unrelated to risk.

   Where candidates lose it

   Stating the definition without the pre-crisis motivation, and without the downside. A complete answer says the leverage ratio pushes banks toward riskier assets at the margin, because the interviewer wants to see you can criticise a rule you also support.

   Expect next

   • Which kinds of bank does the leverage ratio bind?
   • What perverse incentive does it create?
   • Why did supervisors exclude central bank reserves in 2020?
5. 061Explain LCR and NSFR.Liquidity risk and ALMIntermediatetechnicalTreasury and ALMRegulatory reporting

   Say this

   Both are Basel III liquidity ratios with a minimum of 100 percent. LCR is a 30-day survival test: high quality liquid assets over stressed net outflows. NSFR is a one-year structural test: available stable funding over required stable funding. Short-term shock versus long-term funding mismatch.

   Then walk it

   1. LCR numerator, HQLA: Level 1 is cash, central bank reserves and most sovereign debt at no haircut. Level 2A is high-grade covered and corporate bonds at a 15 percent haircut, Level 2B is lower-rated corporates and some equities at 25 to 50 percent, and Level 2 is capped at 40 percent of the total.
   2. LCR denominator: outflows minus capped inflows, with prescribed run-off rates. Stable retail deposits 3 to 5 percent, less stable retail 10, operational wholesale deposits 25, non-operational corporate deposits 40, and financial institution deposits 100. Inflows are capped at 75 percent of outflows, so you can't rely on collecting to pay.
   3. That run-off table is the heart of it, and it encodes a real judgement: insured retail deposits are sticky, and money from other banks disappears entirely. SVB's deposits were overwhelmingly uninsured corporate money, which the table would treat as the fastest-running kind.
   4. NSFR pairs funding stability against asset liquidity over a year. Equity and long-term debt count fully as stable funding, retail deposits at 90 to 95 percent, short wholesale funding at little or nothing. On the asset side, long-dated loans need high stable funding and cash needs none.
   5. So NSFR is a structural constraint on maturity transformation, which is the business banks are in. It limits how much of a long loan book you can fund with three-month wholesale paper.
   6. Indian specifics: RBI implemented LCR from 2015 and NSFR from 2021, both at 100 percent, and has periodically adjusted the treatment of SLR securities within HQLA. The 2024 draft revisions raised run-off assumptions on retail deposits with internet and mobile banking access, which is a direct response to how fast deposits can now move.
   7. The critique to volunteer: both are point-in-time ratios with prescribed assumptions, and they can be window-dressed at reporting dates. And in a real run, the run-off rates have been far higher than the table assumes. SVB lost a quarter of its deposits in a day.

   Where candidates lose it

   Mixing up the horizons or quoting the ratios without any run-off rates. Knowing that financial institution deposits run off at 100 percent and stable retail at 3 to 5 is what shows you've seen the schedule. And the point that real runs are faster than the assumed rates is the part with judgement in it.

   Expect next

   • What counts as HQLA, and what haircuts apply?
   • Why did banks with a 100 percent LCR still fail in 2023?
   • How does NSFR constrain the lending business?
6. 062What is interest rate risk in the banking book, and how do you measure it?Liquidity risk and ALMIntermediatetechnicalTreasury and ALMIndian bank risk and treasury

   Say this

   IRRBB is the risk that rate moves hurt the banking book, and you measure it two ways that often disagree. Economic value of equity is the present value view over the full life of the balance sheet. Net interest income is the earnings view over one to three years.

   Then walk it

   1. EVE: revalue all assets, liabilities and off-balance-sheet items under a rate shock and look at the change in net present value. It's the long-horizon, economic answer, and it's where a big fixed-rate asset book shows up immediately.
   2. NII: project interest income and expense over one to three years under the shock. It's the accounting and earnings answer, and it's the one management actually cares about because it hits reported profit.
   3. They can point in opposite directions, and that's the interesting part. A bank funding long fixed-rate mortgages with short deposits looks fine on NII when rates rise slowly, because deposit rates lag, while EVE is deeply negative from day one. That gap is exactly the SVB configuration.
   4. The Basel standardised framework prescribes six shock scenarios: parallel up and down, steepener, flattener, short rate up and short rate down. Non-parallel scenarios matter because most banks are not exposed to the level so much as to the shape.
   5. Then the behavioural assumptions, which are where all the model risk lives. Non-maturity deposits have no contractual maturity so you assume one. Prepayment on fixed loans. Early withdrawal on term deposits. Pipeline commitments. Move the deposit assumption from a two-year to a five-year effective duration and the answer changes sign.
   6. The supervisory outlier test: if EVE sensitivity exceeds 15 percent of Tier 1 capital under any of the six scenarios, you attract supervisory attention under Pillar 2. That's the number to know.
   7. In India, RBI requires both the traditional gap approach and duration-based EVE reporting, and IRRBB is a core Pillar 2 item in ICAAP. Indian banks carry large SLR portfolios of government bonds, so rate risk in the banking book is structurally significant and the AFS versus HTM classification decision drives how much of it hits reported capital.
   8. How you manage it: reprice the book, use interest rate swaps to shorten effective asset duration, adjust deposit pricing, and set limits on both EVE and NII sensitivity so neither view can be ignored.

   Where candidates lose it

   Giving only one of the two measures. If you say EVE and not NII, or the reverse, you've described half the framework and missed the tension that makes IRRBB interesting. And the behavioural deposit assumption is the single biggest driver of the answer, so name it as the main model risk.

   Expect next

   • EVE and NII disagree. Which do you act on?
   • What is the supervisory outlier test?
   • How would you hedge a negative EVE position?
7. 063How would you build a survival horizon for a bank treasury?Liquidity risk and ALMIntermediatetechnicalTreasury and ALMIndian bank risk and treasury

   Say this

   Build a daily cash flow ladder under stress and find the first day the counterbalancing capacity runs out. That day count is the survival horizon, and the useful output isn't the number itself but which assumption drives it.

   Then walk it

   1. Start with contractual cash flows by day: maturing loans in, maturing deposits and wholesale funding out, coupon and interest flows, and known commitments. That's the easy part and the least informative.
   2. Then layer behavioural assumptions, which is where the answer is actually made. Deposit run-off rates by segment, drawdown on committed undrawn facilities, no rollover of wholesale funding, and rating-trigger-driven collateral calls.
   3. Then the counterbalancing capacity: unencumbered HQLA at stressed haircuts, central bank facilities and what collateral qualifies, committed lines you can genuinely draw, and asset sales with a realistic time-to-cash. Repo is the fast one, whole-loan sales are not.
   4. Then run at least three severities: an idiosyncratic name-specific stress where markets function but nobody will lend to you, a market-wide stress where everyone is short cash, and a combined scenario. The combined one is what regulators require and it's the one that binds.
   5. Read off the first day of negative cumulative net cash. A typical internal appetite is 30 days for a combined stress and 90 days for an idiosyncratic one, plus the regulatory 30-day LCR as a floor.
   6. Then the genuinely valuable step: sensitivity. If the horizon goes from 45 days to 12 when retail run-off moves from 10 to 20 percent, the number is an assumption, not a fact. I'd present the horizon as a range with the binding driver named.
   7. Two things people forget. Intraday and currency granularity: being liquid in rupees and short dollars on day three is a failure even if the aggregate is fine. And encumbrance, because assets already pledged in repo are not available however liquid they look.
   8. And the escalation link: each horizon threshold should map to a contingency funding plan trigger with named actions, or the measurement is an academic exercise.

   Where candidates lose it

   Building a contractual maturity ladder and calling it done. Contractual flows tell you almost nothing, because the risk lives in behaviour. And failing to split by currency is the classic error: an aggregate survival horizon can hide a dollar funding gap that kills you first.

   Expect next

   • What run-off rate would you assume on uninsured corporate deposits?
   • How do you treat central bank facilities in the counterbalancing capacity?
   • How would this differ for a non-bank finance company?
8. 064How would you model a bank's savings deposits, which have no contractual maturity?Liquidity risk and ALMIntermediatesuperdayTreasury and ALMIndian bank risk and treasury

   Say this

   Split the balance into a stable core and a volatile portion, assign a behavioural maturity to the core, and estimate a deposit beta for how much of a policy rate move you pass through. Those two parameters, core share and beta, drive the entire banking book rate risk answer.

   Then walk it

   1. Volume modelling first. Look at the historical balance series per segment, strip out trend and seasonality, and take a low percentile of the remaining distribution as the stable core. Many banks use something like the balance exceeded 95 percent of the time over five years.
   2. Assign a repricing or behavioural maturity to the core. If it has been sticky for a decade, you might treat it as five to seven years of effective duration, capped by supervisory limits. Basel caps the average repricing maturity of core retail non-maturity deposits at five years in its standardised framework, and that cap exists because banks were assuming longer and flattering their rate risk.
   3. Deposit beta: regress the rate you actually paid against the policy rate. Indian savings rates have historically been very sticky, so betas on savings accounts are low, maybe 0.2 to 0.4, while term deposits and bulk deposits run much higher, 0.6 to 0.9. Segment or the average is meaningless.
   4. Betas are asymmetric and non-linear, and that's the point most candidates miss. They're low on the way up until competition bites and then they jump, and they're low on the way down because you can't pay less than zero. Modelling a single symmetric beta understates the squeeze in a rising cycle.
   5. Segmentation matters more than technique: retail versus corporate, insured versus uninsured, digitally active versus branch-only, relationship versus rate-shopping. A digitally active uninsured corporate depositor behaves nothing like a pensioner with a branch passbook.
   6. Then validate the assumptions against a real episode rather than trusting the regression. What actually happened to your balances and your pass-through in the 2022 to 2023 hiking cycle? That's the out-of-time test.
   7. The limitation to volunteer, and it's the important one: these models are all calibrated on a world where moving money was slow. Mobile banking and instant transfers have shortened behavioural maturities in a way the history doesn't contain. SVB lost a quarter of its deposits in a day, which no core-stability model would have produced. So I'd stress the assumption hard rather than trust it.
   8. RBI's 2024 draft LCR revisions add a run-off add-on for internet and mobile banking enabled deposits for exactly this reason, which is a good example of supervisors updating faster than the models.

   Where candidates lose it

   Treating it as purely a statistical problem. The regression is the easy part; the judgement is in segmentation, in the asymmetry of beta, and in recognising that the historical data predates instant digital withdrawal. A candidate who says 'the history no longer applies' and then says what they'd do about it stands out.

   Expect next

   • What deposit beta would you assume for Indian savings accounts?
   • How would you stress the core assumption?
   • Why does Basel cap the assumed maturity at five years?
9. 067Would you model equity returns as normal or Student's t, and what difference does it make?Statistics and quant foundationsIntermediatetechnicalBank market riskBuy-side risk

   Say this

   Student's t, with something like four to six degrees of freedom for daily equity returns. Real returns are leptokurtic, so a normal assumption systematically understates the tail, and the understatement gets worse the further out you go.

   Then walk it

   1. The evidence is simple and worth quoting: daily equity index returns have excess kurtosis well above zero, often 3 to 8, against zero for a normal. The 1987 crash was more than 20 standard deviations under a normal fitted to prior data, which that distribution says should never happen in the age of the universe.
   2. A t with low degrees of freedom has polynomial rather than exponential tail decay, which fits observed extremes far better. Around four to six degrees of freedom is the usual empirical range for daily equity data, and it converges to normal as the degrees of freedom rise.
   3. The practical consequence for VaR: at 95 percent the two distributions give similar answers, and at 99.9 percent the normal can understate by a large multiple. So the choice barely matters for routine reporting and matters enormously for capital and stress.
   4. The second issue is that the unconditional fat tail is partly a mixture effect. Returns are closer to normal conditional on the current volatility regime, and it's volatility clustering that produces fat unconditional tails. So a GARCH model with normal innovations gets you a long way, and GARCH with t innovations gets you further.
   5. For a multivariate problem it gets harder. A multivariate t gives you tail dependence, which a multivariate normal does not, and tail dependence is the property that matters in a crisis. That's the bridge to copulas.
   6. Where the t is not enough: extreme value theory, fitting a generalised Pareto distribution to the exceedances above a threshold, is the right tool if you genuinely only care about the far tail. It uses less data more efficiently for that specific job.
   7. The caveat I'd give: a t distribution has more parameters and the degrees of freedom estimate is unstable in small samples. And skew matters too, since equity downside tails are fatter than upside ones, so a skewed t or an empirical distribution is often the pragmatic choice.

   Where candidates lose it

   Saying 'returns aren't normal' without knowing what to use instead or how big the error is. Naming a plausible degrees-of-freedom range, and saying that the choice matters at 99.9 percent but hardly at 95, shows you've fitted these to real data rather than repeating a slogan.

   Expect next

   • How would you estimate the degrees of freedom?
   • Does GARCH with normal innovations solve the problem?
   • When would you use extreme value theory instead?
10. 070What's the tracking error formula?Statistics and quant foundationsIntermediatetechnicalMSCIFinancial Tools · Monterrey · 2013

    Say this

    Tracking error is the standard deviation of the difference between portfolio and benchmark returns. Compute active return each period, take its standard deviation, then annualise by multiplying by the square root of the number of periods in a year.

    Then walk it

    1. Formula in words: active return equals portfolio return minus benchmark return each period. Tracking error is the standard deviation of that series. On monthly data you annualise by root twelve, on daily by root 252.
    2. The ex-post version uses realised returns. The ex-ante version uses a risk model: active weights transposed times the covariance matrix times active weights, then square root. Those two numbers routinely disagree, and explaining the gap is a real part of a buy-side risk job.
    3. Be careful about mean adjustment. Some definitions use the standard deviation of active returns and others use the root mean square of active returns, which includes the average outperformance. They differ, and you should say which one you mean.
    4. Feel for the numbers: an index fund runs 5 to 50 basis points, an enhanced index strategy 0.5 to 2 percent, an active core equity fund 3 to 6 percent, and a concentrated high-conviction fund 8 percent or more. Quoting a range is what shows you've looked at real funds.
    5. What it's used for: mandate limits, since most institutional mandates cap tracking error. And the information ratio, active return divided by tracking error, which is the risk-adjusted measure of skill and the number that actually matters.
    6. Decomposition is the useful part. Break tracking error into factor and specific contributions: how much comes from a systematic style or sector tilt versus stock selection. A manager paid for stock picking who is running most of their tracking error on an unintended country bet has a problem, and that's exactly the conversation a risk analyst has with a PM.
    7. Limitations to volunteer: it's symmetric, so it penalises outperformance identically to underperformance. It assumes a stable covariance structure, so realised tracking error jumps in a crisis. And it's backward-looking, so a manager who has just changed their positioning has a stale number.

    Where candidates lose it

    Giving the formula and nothing else. This question is a screen: the formula takes five seconds, and the rest of your answer is what's being assessed. Knowing typical ranges by strategy, the ex-ante versus ex-post gap, and factor decomposition is what converts a definition into an answer.

    Expect next

    • What tracking error would you expect from an index fund?
    • Why do ex-ante and ex-post tracking error differ?
    • What is the information ratio?

    Reported by candidates at MSCI (Financial Tools, Monterrey, 2013). Source: Wall Street Oasis.

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.