Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 005Calculate the one-day 99% VaR of a $100 million portfolio with 2 percent daily volatility.Market risk and VaRIntermediatetechnicalUBSRisk Management · Remote · 2020UBSRisk Management · Zurich · 2021

   Say this

   Parametric, assuming zero mean and normality: 2.33 times 2 percent times $100m, so about $4.66 million. Round it to $4.7m and say the assumptions out loud as you go.

   Then walk it

   1. The z-score at 99% one-tailed is 2.326. I'd use 2.33. At 95% it's 1.645, worth knowing cold because interviewers switch between them mid-question.
   2. Daily volatility in money terms is 2 percent of $100m, so $2m. Multiply by 2.33 and you get $4.66m.
   3. I'm assuming a zero expected return over one day, which is standard for a short horizon, and that returns are normal, which is the assumption doing all the work.
   4. To scale to ten days, multiply by the square root of ten, about 3.16, so roughly $14.7m. That scaling needs independent and identically distributed returns, so it understates the number if volatility clusters or the market trends.
   5. And the caveat I'd volunteer: because the real distribution has fatter tails than normal, this figure is probably too low at 99%. Empirically the 99th percentile of equity returns sits closer to 2.6 or 2.7 sigma than 2.33.

   Where candidates lose it

   Using 1.645 for 99% or 2.33 for 95%, or reaching for a calculator. Know both z-scores by heart, state your two assumptions before you multiply, and flag that fat tails make the answer conservative in the wrong direction.

   Expect next

   • Now give me the ten-day number.
   • What if the portfolio had a 10 percent annual expected return, does that change it?
   • How would the answer change if the returns were t-distributed with five degrees of freedom?

   Reported by candidates at UBS (Risk Management, Remote, 2020); UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

2. 018How would you run an ICAAP, and how does it relate to the supervisory stress tests?Tail risk and stress testingIntermediatetechnicalRegulatory reportingBank credit risk

   Say this

   ICAAP is the bank's own answer to 'how much capital do you actually need', as opposed to the minimum the rules prescribe. You identify all material risks, quantify them including the ones Pillar 1 ignores, stress the plan, and conclude with a capital number and a plan to hold it.

   Then walk it

   1. Start with a risk identification and materiality assessment across everything, not just credit, market and operational. Concentration, interest rate risk in the banking book, pension, reputational, strategic and model risk are the Pillar 2 gaps, and IRRBB and concentration are usually the two biggest.
   2. Quantify each, then stress the three-year business plan under a baseline and at least one severe but plausible adverse scenario. The adverse case has to be internally consistent: if GDP falls, credit costs rise, fee income falls and RWAs inflate through downgrades, all at once.
   3. Project the capital path, not just the end point. The trough quarter is what matters, and it usually sits in year two because provisions lag the macro.
   4. Set the internal capital requirement above the regulatory minimum, with a management buffer sized so that you don't breach the buffer requirement in the adverse case and get dividend restrictions.
   5. Then the management actions, with triggers. Which of those are credible under stress is the question a supervisor will push on hardest, because cutting dividends works and issuing equity in a crisis usually doesn't.
   6. The relationship with supervisory tests: the regulator's exercise, CCAR in the US, the EBA's in Europe, and the RBI's stress-testing guidance in India, uses common prescribed scenarios so banks can be compared. ICAAP is idiosyncratic and covers risks the common scenario ignores. Under the SREP the supervisor uses your ICAAP to set a Pillar 2 requirement on top of Pillar 1.
   7. Governance is half the assessment. An ICAAP the board has clearly never read fails regardless of the modelling quality. The board's sign-off on the risk appetite and the capital plan is the artefact supervisors look for first.

   Where candidates lose it

   Describing ICAAP as a document rather than a process, and forgetting Pillar 2 risks. If you can't name interest rate risk in the banking book and concentration as the two big risks outside Pillar 1, you have not understood why ICAAP exists at all.

   Expect next

   • Which Pillar 2 risk is usually the largest?
   • How would you size a management buffer?
   • What management actions would a supervisor refuse to credit?
3. 033Your loan book has 22 percent of exposure in commercial real estate. How do you think about that?Credit riskIntermediatetechnicalBank credit riskIndian bank risk and treasury

   Say this

   Concentration is the risk that diversification math ignores, and 22 percent in one cyclical sector is a real number. I'd measure it, work out how much of a tail loss it drives, then decide between limits, hedging and pricing rather than just flagging it.

   Then walk it

   1. Measure it properly first. Sector share is the headline, but the useful metrics are a Herfindahl index on single names, the top-20 exposure as a share of CET1, and the correlated cluster, because CRE developers, construction firms and building materials all fail together.
   2. Then quantify the capital impact. The IRB formula assumes an infinitely granular, single-factor portfolio, so it systematically understates concentrated books. A granularity adjustment or a multi-factor economic capital model is how you show the board the real number, and this is a classic Pillar 2 add-on.
   3. Stress it specifically. Property values down 30 percent, vacancy up, refinancing unavailable at maturity. CRE defaults are refinancing events far more than they are cash-flow events, so the maturity profile matters more than current interest coverage.
   4. Look at what's inside the 22 percent. Office in one city is a different animal from warehousing and retail across ten. Loan-to-value distribution, debt-service coverage, single-tenant concentration, and how much matures in the next 18 months.
   5. Then the actions, in order of cost. Tighten new-origination limits by sub-sector, price the concentration into new deals, syndicate or sell down the largest names, and buy protection or securitise if a market exists. In India that last option is thin, so limits do most of the work.
   6. And the governance line: 22 percent may be entirely within appetite if the board decided that deliberately and is paid for it. Concentration isn't automatically a fault. What is a fault is concentration that accumulated without anyone setting a limit.

   Where candidates lose it

   Saying 'that's too high' without a benchmark or a measurement. And forgetting that the IRB capital formula assumes a granular portfolio, so regulatory capital alone will not show the concentration. That granularity point is what a credit risk interviewer is waiting for.

   Expect next

   • How would you measure concentration in a single number?
   • Why doesn't the IRB formula capture it?
   • What limit would you set, and on what basis?
4. 043What is an RCSA, and how would you actually run one?Operational riskIntermediatetechnicalOperational riskGlobal capability centres

   Say this

   A risk and control self-assessment is the business identifying its own risks, rating them before and after controls, and owning the gap. Run badly it's a spreadsheet nobody reads. Run well it's the only forward-looking view of operational risk you have.

   Then walk it

   1. Start from processes, not from a risk list. Map the end-to-end process, find the failure points, and derive risks from those. Starting from a generic taxonomy produces generic risks that nobody recognises as theirs.
   2. For each risk, rate inherent likelihood and impact, then identify the controls, test whether they actually work, and rate residual risk. The distinction between design effectiveness and operating effectiveness matters: a beautifully designed control that is performed late every month is not effective.
   3. Then compare residual risk to appetite. Anything above appetite needs an action with an owner and a date, or a formal risk acceptance signed at the right level. That is the actual output; the ratings are just how you get there.
   4. Who does it: the first line owns it, the second line facilitates and challenges. If risk management fills in the RCSA, the business hasn't assessed anything and you've built a document rather than a control.
   5. Where it fails, and I'd say this without prompting. Everything gets rated amber, because nobody wants to own a red. Ratings never change year to year. The workshop runs after a fine rather than before. And it never reconciles against actual loss events, so a process with twelve losses last year is rated low risk.
   6. So the tests I'd apply to an RCSA: does it reconcile to the loss database, does it reconcile to audit findings, has anything moved since last year, and can a process owner explain their own top risk without reading the sheet.
   7. Practical numbers: for a mid-sized operation, expect 15 to 40 risks per process area. Hundreds means it's a control inventory dressed up as a risk assessment, and nobody will use it.

   Where candidates lose it

   Describing the template instead of the process. Two things separate a real answer: saying the first line must own it with the second line challenging, and naming the amber-everywhere failure mode. And reconciling the RCSA against actual loss data is the check almost no candidate mentions.

   Expect next

   • Who should own the RCSA?
   • How do you stop everything being rated amber?
   • How does the RCSA connect to your loss data?
5. 044Design three key risk indicators for a payments operation, and tell me what makes a KRI good.Operational riskIntermediatetechnicalOperational riskGlobal capability centres

   Say this

   A good KRI is leading, measurable without manual effort, and has a threshold that triggers a specific action. For payments I'd use the unreconciled item count and ageing, the manual intervention rate on straight-through processing, and the failed or returned payment rate by corridor.

   Then walk it

   1. Unreconciled items over two days old, by value and count. It's leading, because loss events start as breaks nobody chased, and it's cheap to produce from the reconciliation system.
   2. Manual touch rate on payments that should be straight-through. Every manual touch is a keystroke error waiting to happen, so this is a direct proxy for the frequency of process losses. A rise from 2 to 6 percent is a red flag before any loss appears.
   3. Failed and returned payment rate, split by corridor and by cause. It picks up upstream data quality problems, sanctions-screening false positives and correspondent bank issues, each of which needs a different fix.
   4. What makes a KRI good: leading not lagging, objectively measurable from a system rather than from a survey, sensitive enough that it actually moves, owned by someone with the authority to act, and attached to an amber and red threshold with a pre-agreed response.
   5. What makes a bad one: loss count, which is lagging and tells you the failure already happened. Headcount, which is context rather than risk. Anything requiring a manual monthly collection, because it degrades into a copy-paste exercise.
   6. Thresholds should be calibrated off the historical distribution, not picked round. Amber at roughly the 90th percentile of the last two years, red at the 99th, then reviewed annually. And each threshold needs a named action, or breaching it changes nothing.
   7. The failure mode to name: KRI inflation. A dashboard with 120 indicators gets ignored. Eight to twelve real ones per business, reviewed monthly by someone who can act, beats a hundred reported to nobody.

   Where candidates lose it

   Proposing lagging indicators. Loss count, number of incidents and audit findings are all after the fact, and they are what most candidates offer. A KRI is supposed to give you time to act, so lead with something that moves before the loss, and attach a threshold and an action to each.

   Expect next

   • How would you calibrate the thresholds?
   • What do you do when a KRI turns red?
   • Give me a KRI for cyber risk.
6. 048How would you validate a model?Model risk and validationIntermediatetechnicalModel validationGlobal capability centres

   Say this

   Three pillars: conceptual soundness, outcomes analysis and ongoing monitoring. So does the theory make sense for this use, does it perform against reality, and will you know when it stops working. And it has to be done by someone independent of whoever built it.

   Then walk it

   1. Conceptual soundness first, and it's the part that gets skipped. Read the documentation, check the theory is appropriate for the intended use, check the assumptions are stated and reasonable, and review the data: source, quality, representativeness, and whether the development sample looks like today's population.
   2. Then replicate. Independently rebuild at least the core of it from the documentation. If you can't reproduce the results from the document, the documentation fails, and that's a finding in itself.
   3. Outcomes analysis: backtesting against realised outcomes, benchmarking against an alternative model or a simpler challenger, and sensitivity analysis to see which inputs the output actually depends on. Stress the inputs to the edge of plausibility and see if it breaks gracefully or catastrophically.
   4. Then the boundary work: what is this model not valid for. A validated model with no stated limitations is a hazard, because the next user will apply it to something new and assume it's approved.
   5. Ongoing monitoring: performance thresholds, population stability, and a revalidation cycle tiered by materiality. Tier 1 models annually, lower tiers less often, and any material change triggers a revalidation regardless of the cycle.
   6. Governance: findings rated by severity, owners and deadlines, and a model approval that can be conditional or refused. A validation function that has never refused an approval isn't independent, and that's the question I'd ask about any validation team I joined.
   7. Sizing it honestly: full validation of a Tier 1 pricing model is weeks of work for two people. Proportionality is the whole design problem, because validating everything to the same depth means validating nothing well.

   Where candidates lose it

   Going straight to backtesting. Backtesting is one third of it and it's the third that needs data you often don't have. Conceptual soundness and the explicit statement of limitations are what prevent the misuse that causes most model losses. And say the word independent, because organisational independence is the first thing a supervisor checks.

   Expect next

   • What would you do if you couldn't backtest because there was no data?
   • How do you validate a vendor model you can't see inside?
   • How would you tier models for validation intensity?
7. 063How would you build a survival horizon for a bank treasury?Liquidity risk and ALMIntermediatetechnicalTreasury and ALMIndian bank risk and treasury

   Say this

   Build a daily cash flow ladder under stress and find the first day the counterbalancing capacity runs out. That day count is the survival horizon, and the useful output isn't the number itself but which assumption drives it.

   Then walk it

   1. Start with contractual cash flows by day: maturing loans in, maturing deposits and wholesale funding out, coupon and interest flows, and known commitments. That's the easy part and the least informative.
   2. Then layer behavioural assumptions, which is where the answer is actually made. Deposit run-off rates by segment, drawdown on committed undrawn facilities, no rollover of wholesale funding, and rating-trigger-driven collateral calls.
   3. Then the counterbalancing capacity: unencumbered HQLA at stressed haircuts, central bank facilities and what collateral qualifies, committed lines you can genuinely draw, and asset sales with a realistic time-to-cash. Repo is the fast one, whole-loan sales are not.
   4. Then run at least three severities: an idiosyncratic name-specific stress where markets function but nobody will lend to you, a market-wide stress where everyone is short cash, and a combined scenario. The combined one is what regulators require and it's the one that binds.
   5. Read off the first day of negative cumulative net cash. A typical internal appetite is 30 days for a combined stress and 90 days for an idiosyncratic one, plus the regulatory 30-day LCR as a floor.
   6. Then the genuinely valuable step: sensitivity. If the horizon goes from 45 days to 12 when retail run-off moves from 10 to 20 percent, the number is an assumption, not a fact. I'd present the horizon as a range with the binding driver named.
   7. Two things people forget. Intraday and currency granularity: being liquid in rupees and short dollars on day three is a failure even if the aggregate is fine. And encumbrance, because assets already pledged in repo are not available however liquid they look.
   8. And the escalation link: each horizon threshold should map to a contingency funding plan trigger with named actions, or the measurement is an academic exercise.

   Where candidates lose it

   Building a contractual maturity ladder and calling it done. Contractual flows tell you almost nothing, because the risk lives in behaviour. And failing to split by currency is the classic error: an aggregate survival horizon can hide a dollar funding gap that kills you first.

   Expect next

   • What run-off rate would you assume on uninsured corporate deposits?
   • How do you treat central bank facilities in the counterbalancing capacity?
   • How would this differ for a non-bank finance company?
8. 064How would you model a bank's savings deposits, which have no contractual maturity?Liquidity risk and ALMIntermediatesuperdayTreasury and ALMIndian bank risk and treasury

   Say this

   Split the balance into a stable core and a volatile portion, assign a behavioural maturity to the core, and estimate a deposit beta for how much of a policy rate move you pass through. Those two parameters, core share and beta, drive the entire banking book rate risk answer.

   Then walk it

   1. Volume modelling first. Look at the historical balance series per segment, strip out trend and seasonality, and take a low percentile of the remaining distribution as the stable core. Many banks use something like the balance exceeded 95 percent of the time over five years.
   2. Assign a repricing or behavioural maturity to the core. If it has been sticky for a decade, you might treat it as five to seven years of effective duration, capped by supervisory limits. Basel caps the average repricing maturity of core retail non-maturity deposits at five years in its standardised framework, and that cap exists because banks were assuming longer and flattering their rate risk.
   3. Deposit beta: regress the rate you actually paid against the policy rate. Indian savings rates have historically been very sticky, so betas on savings accounts are low, maybe 0.2 to 0.4, while term deposits and bulk deposits run much higher, 0.6 to 0.9. Segment or the average is meaningless.
   4. Betas are asymmetric and non-linear, and that's the point most candidates miss. They're low on the way up until competition bites and then they jump, and they're low on the way down because you can't pay less than zero. Modelling a single symmetric beta understates the squeeze in a rising cycle.
   5. Segmentation matters more than technique: retail versus corporate, insured versus uninsured, digitally active versus branch-only, relationship versus rate-shopping. A digitally active uninsured corporate depositor behaves nothing like a pensioner with a branch passbook.
   6. Then validate the assumptions against a real episode rather than trusting the regression. What actually happened to your balances and your pass-through in the 2022 to 2023 hiking cycle? That's the out-of-time test.
   7. The limitation to volunteer, and it's the important one: these models are all calibrated on a world where moving money was slow. Mobile banking and instant transfers have shortened behavioural maturities in a way the history doesn't contain. SVB lost a quarter of its deposits in a day, which no core-stability model would have produced. So I'd stress the assumption hard rather than trust it.
   8. RBI's 2024 draft LCR revisions add a run-off add-on for internet and mobile banking enabled deposits for exactly this reason, which is a good example of supervisors updating faster than the models.

   Where candidates lose it

   Treating it as purely a statistical problem. The regression is the easy part; the judgement is in segmentation, in the asymmetry of beta, and in recognising that the historical data predates instant digital withdrawal. A candidate who says 'the history no longer applies' and then says what they'd do about it stands out.

   Expect next

   • What deposit beta would you assume for Indian savings accounts?
   • How would you stress the core assumption?
   • Why does Basel cap the assumed maturity at five years?
9. 090Pitch me a stock.Markets and macroIntermediatetechnicalFTFranklin TempletonRisk Management · San Mateo · 2017

   Say this

   Lead with the recommendation, the target and the timeframe in one sentence, then give two or three reasons the market is wrong, then the risks and what would kill the thesis. For a risk role, the risk section is the part you're actually being marked on.

   Then walk it

   1. Structure: recommendation and price target, the variant view, two or three supporting arguments, valuation, the risks with a falsifier, and position sizing. Ninety seconds spoken, then answer questions.
   2. The variant view is the whole pitch. Why is this mispriced, and what do you believe that consensus doesn't? 'Good company, growing fast' isn't a pitch, because the market knows that and has priced it. Name the specific disagreement: a margin assumption, a market size, a capital allocation change, a cyclical trough being read as structural.
   3. Valuation has to be explicit and cross-checked. A multiple against the company's own history and against peers, plus a rough cash flow view, plus what's implied at the current price. Say what has to be true for the target to be right.
   4. Now the risk section, which is where a risk interviewer stops listening to the bull case. What kills the thesis, what's the downside in that case, how correlated is it to the rest of a portfolio, how liquid is the position, and what's the position size given the downside. That's the part most candidates skip entirely.
   5. Give a real falsifier with a date: 'if gross margin doesn't recover above 38 percent by the second quarter, the thesis is wrong and I'd exit'. Not 'if the macro deteriorates', which is unfalsifiable.
   6. Pick something you genuinely know, with a liquid, followable name, and be ready for three levels of follow-up: the business model, the numbers, and the bear case. Being unable to state the bear case well is the most common way this question fails.
   7. Practical preparation: have two long ideas and one short, one of them Indian if you're interviewing in India, and know each one's last two reported quarters. And be honest about what you don't know, because they will find the edge of your knowledge and how you behave there is the actual test.

   Where candidates lose it

   Pitching a famous company with a consensus story and no variant view. And skipping the risk section, which for a risk role is the part being assessed. If you can't state the bear case as well as a bear would, you haven't done the work and it shows in the first follow-up.

   Expect next

   • What's the bear case, argued properly?
   • What would make you exit?
   • How large a position would you take, and why that size?

   Reported by candidates at Franklin Templeton (Risk Management, San Mateo, 2017). Source: Wall Street Oasis.

10. 091How would you allocate an investment mandate of $100 million across a portfolio of funds?Markets and macroIntermediatecase studyMSCIRisk Management · Remote · 2013

    Say this

    Start from the mandate, not the funds. Objective, horizon, liability profile, liquidity needs, constraints and risk tolerance first. Then set a strategic asset allocation, then select managers inside it, and size each one by its marginal contribution to total risk rather than by conviction alone.

    Then walk it

    1. Step one, define the objective precisely. A pension fund matching liabilities, an endowment spending 4 percent a year in perpetuity and a family office preserving capital get three completely different portfolios from the same $100m.
    2. Step two, strategic asset allocation. That decision drives most of the long-run outcome, so it deserves most of the time. Set it against the objective, with a clear view on how much illiquidity you can tolerate given the spending need.
    3. Step three, manager selection within each sleeve. Process before performance: what's the edge, is it repeatable, is the track record explained by the stated process or by a factor exposure you could buy cheaply. Then operational due diligence, which is where most fund failures actually come from, not from bad investing.
    4. Step four, sizing, and here's the part a risk interviewer wants. Size by contribution to portfolio risk, not by equal weight or by conviction. Two managers with the same stated strategy may be the same position, so look at the correlation of their active returns, not their labels. Risk-parity-style sizing or a marginal risk contribution framework is a defensible starting point.
    5. Step five, look through to underlying exposures. Three managers can each be diversified and all be long the same six crowded names. Aggregate factor and single-name exposure across the whole book, because that's the concentration that hurts you.
    6. Step six, liquidity budgeting. Match redemption terms to the mandate's need, model the worst case where the liquid sleeve funds all outflows while the illiquid sleeve is gated, and keep enough in daily-dealing assets to survive that.
    7. Step seven, governance and monitoring. Benchmarks per manager, tracking error and factor drift monitoring, a rebalancing policy with bands, and pre-agreed triggers for redemption: style drift, key person departure, asset growth beyond capacity, or a valuation or operational red flag.
    8. On concrete numbers: for a long-horizon institutional mandate I'd probably run 8 to 15 managers. Fewer than that and idiosyncratic manager risk dominates; many more and you've bought an expensive index and can't monitor any of them properly.

    Where candidates lose it

    Going straight to picking funds and percentages. The mandate and the asset allocation come first, and the risk-specific value you add is sizing by marginal risk contribution and looking through to overlapping underlying exposures. Naming operational due diligence as a top cause of fund failure is the detail that lands.

    Expect next

    • How many managers, and why that number?
    • How would you detect that two managers are really the same position?
    • How would you budget liquidity across the portfolio?

    Reported by candidates at MSCI (Risk Management, Remote, 2013). Source: Wall Street Oasis.

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.