Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 027How would you approach building a delinquency model?Credit riskHardtechnicalNeuberger BermanRisk · Chicago · 2024

   Say this

   Define the target first, then build backwards. Delinquency is not default, so I'd fix the bad definition, say 90 days past due within twelve months, set an observation and performance window, and only then worry about features and model form.

   Then walk it

   1. Target definition is the decision that determines everything else. 30, 60 or 90 days past due, and over what horizon. Roll-rate analysis tells you where delinquency becomes effectively irreversible, and that's where you draw the line.
   2. Sampling: pick an observation point, take the borrower's state as at that date, then observe outcomes over the following twelve months. Strict separation, or you leak future information into features and get a model that looks brilliant in development and fails in production.
   3. Features in three families. Behavioural: utilisation trend, minimum-payment behaviour, recent missed payments, bounced mandates. Bureau: enquiry velocity, existing delinquency elsewhere, thin-file flags. Loan and demographic: loan-to-value, instalment-to-income, vintage, product, channel of origination.
   4. Model form: start with logistic regression on coarse-classified, weight-of-evidence binned variables. It's monotonic, explainable and passes validation. Then run a gradient boosting challenger to see how much signal the simple model leaves on the table. If the gap is small, ship the simple one.
   5. Validation: out-of-time as well as out-of-sample, because credit models degrade through the cycle not through the sample. Report Gini or AUC for ranking, and a calibration curve for whether the predicted rates match observed. A model can rank perfectly and be badly calibrated.
   6. Two traps specific to credit. Survivorship and selection bias: you only observe outcomes for people you approved, so the model is blind to the rejected population, and you need reject inference. And macro sensitivity: a model built on 2021 data has never seen a rate cycle, so the absolute PD level will be wrong even if the ranking holds.
   7. Then monitoring. Population stability index on the score distribution, drift on each feature, and a monthly actual-versus-expected. Most delinquency models fail from population shift rather than bad maths.

   Where candidates lose it

   Going straight to algorithms. In credit, the target definition, the observation window and the reject-inference problem are worth more than model choice, and interviewers who build these for a living are listening for exactly those. Also say the word calibration; ranking power alone doesn't let you price or provision.

   Expect next

   • How would you handle reject inference?
   • How would you know the model had degraded?
   • Would you use gradient boosting in production for this?

   Reported by candidates at Neuberger Berman (Risk, Chicago, 2024). Source: Wall Street Oasis.

2. 028How do you build a credit scorecard, and how do you prove it works?Credit riskHardtechnicalBank credit riskGlobal capability centres

   Say this

   Bin every variable, convert to weight of evidence, fit a logistic regression, then scale the log odds into points. You prove it works on three axes: discrimination, calibration and stability, tested out of time, not just out of sample.

   Then walk it

   1. Coarse classification first. Bin each variable so the bad rate is monotonic across bins and each bin has enough volume, usually at least 5 percent of the population. Then replace the bin with its weight of evidence, the log of the good-to-bad odds ratio.
   2. Information value tells you which variables to keep. Below about 0.02 is useless, 0.1 to 0.3 is useful, above 0.5 and I'd check for leakage rather than celebrate.
   3. Fit logistic regression on the WOE variables, then scale: points equal offset plus factor times log odds, calibrated so a chosen score doubles the odds every 20 points. That scaling is cosmetic but it's how credit officers read the output.
   4. Discrimination: Gini, or equivalently AUC, where Gini equals two times AUC minus one. A retail behavioural scorecard should hit 0.55 to 0.70 Gini; an application scorecard on a thin-file population might only get 0.35, and that can still be commercially valuable. Kolmogorov-Smirnov is the other standard, the maximum gap between the cumulative good and bad distributions.
   5. Calibration: plot predicted against observed bad rate by score band, and run a Hosmer-Lemeshow style test. Discrimination decides who you approve; calibration decides what you charge and what you provision. You need both.
   6. Stability: population stability index between development and current, per variable and on the score. Above 0.25 and the population has shifted enough that the model needs rebuilding, not just recalibration.
   7. And the governance point: build on a development sample, validate on a holdout, then validate again on a later time period the model never saw. An out-of-sample test on a random split proves almost nothing for a credit model, because the whole failure mode is time.

   Where candidates lose it

   Quoting a Gini target as if it were universal. A good Gini depends entirely on the population and the product, and someone who has built these knows that. The other failure is testing only discrimination. A model with 0.7 Gini and broken calibration will approve the right people and price them all wrong.

   Expect next

   • What Gini would you expect on a prime mortgage book?
   • The Gini is stable but the bad rate has doubled. What happened?
   • When do you recalibrate versus rebuild?
3. 031How does IFRS 9 expected credit loss differ from Basel regulatory expected loss?Credit riskHardsuperdayBank credit riskRegulatory reporting

   Say this

   Different purposes, so different parameters. IFRS 9 is accounting: point-in-time, forward-looking, neutral, and lifetime for Stage 2 and 3. Basel is prudential: through-the-cycle PD, downturn LGD, twelve-month horizon, and deliberately conservative.

   Then walk it

   1. Horizon. Basel EL is always twelve months. IFRS 9 is twelve months in Stage 1 and lifetime in Stages 2 and 3.
   2. PD. Basel wants a long-run average, through-the-cycle PD. IFRS 9 wants a point-in-time PD conditioned on a macro forecast.
   3. LGD. Basel requires downturn LGD, a stressed recovery assumption. IFRS 9 wants a neutral, expected LGD with no prudential margin.
   4. Discounting. IFRS 9 discounts cash shortfalls at the effective interest rate. Basel EL is undiscounted.
   5. Then the reconciliation, which is where real work happens. For IRB banks, if accounting provisions exceed Basel EL, the excess counts in Tier 2 up to a cap of 0.6 percent of credit RWA. If provisions fall short, the shortfall is deducted straight from CET1. So the two frameworks meet in the capital ratio.
   6. For standardised-approach banks it's different again: general provisions can count in Tier 2 up to 1.25 percent of credit RWA, and specific provisions reduce the exposure value.
   7. And the transitional arrangements matter historically. When IFRS 9 came in, supervisors allowed a phase-in of the day-one CET1 hit precisely because the provision increase was large enough to be destabilising.

   Where candidates lose it

   Treating them as the same number with different labels. Naming the four parameter differences is table stakes; the answer that lands explains the CET1 shortfall deduction and the Tier 2 excess cap, because that's the bit that actually affects a bank's capital ratio.

   Expect next

   • What happens to CET1 if provisions are below Basel EL?
   • Why is Basel LGD downturn and IFRS 9 LGD neutral?
   • Which framework produced a bigger provision in 2020?
4. 032What is structured finance, how would you evaluate it, and what are the credit risks?Credit riskHardtechnicalMoody'sCredit Risk · New York · 2024

   Say this

   Structured finance is taking a pool of cash-flow-generating assets, putting it in a bankruptcy-remote vehicle, and slicing the cash flows into tranches of different seniority. You evaluate it in three layers: the collateral, the structure, and the parties.

   Then walk it

   1. Layer one, the collateral. Pool composition, weighted average life, seasoning, geographic and obligor concentration, historical default and prepayment behaviour, and how the underwriting was done. Everything downstream depends on this, and it's where the 2007 failure actually was.
   2. Layer two, the structure. Where does the cash go, and in what order. Credit enhancement comes from subordination, excess spread, overcollateralisation and reserve accounts. Then the triggers: performance triggers that turn a pro-rata waterfall sequential, and cash-trapping mechanics.
   3. Layer three, the parties. Originator, servicer, trustee, swap counterparty. Servicer quality drives recoveries, and servicer failure has broken deals whose collateral was fine. Then the legal question: is the true sale robust, and is the SPV actually bankruptcy remote?
   4. How I'd analyse it: model the pool, run default and prepayment scenarios, and see at what cumulative loss each tranche takes its first rupee of loss. That break-even loss compared with the expected loss is the real measure of a tranche's safety.
   5. The credit risks specific to tranching. Correlation risk: a senior tranche is a bet on correlation, not just on average defaults, because it only fails if losses cluster. Cliff risk: a mezzanine tranche goes from untouched to wiped out over a narrow loss range, so it's far more convex than its rating suggests.
   6. Then prepayment and extension risk on the timing, basis risk if the assets and liabilities reprice off different benchmarks, and originator alignment. Skin in the game is why post-crisis rules require the sponsor to retain a slice.
   7. The Indian version worth naming: pass-through certificates and direct assignments on NBFC loan pools, where the live risks are servicer concentration, priority-sector motivation on the buyer side, and the 2018 to 2019 NBFC liquidity episode showing how quickly refinancing assumptions fail.
   8. And the honest limitation: the rating of a structured tranche is far more model-dependent than a corporate rating. Small changes in a correlation assumption move a AAA to a BBB, and that is exactly what happened to CDOs.

   Where candidates lose it

   Explaining tranching and stopping. The two things a credit risk interviewer at a rating agency wants are the sensitivity of senior tranches to correlation rather than to average default rates, and the cliff-risk convexity of mezzanine. Naming the servicer and the true-sale question shows you've read a deal document, not a textbook.

   Expect next

   • Why is a senior tranche a bet on correlation?
   • What actually went wrong with CDO ratings in 2007?
   • How would you analyse an Indian NBFC pass-through certificate?

   Reported by candidates at Moody's (Credit Risk, New York, 2024). Source: Wall Street Oasis.

5. 035Explain the Merton model, and the difference between structural and reduced-form credit models.Credit riskHardtechnicalBank credit riskModel validation

   Say this

   Merton treats equity as a call option on the firm's assets with a strike equal to its debt. Default happens when asset value falls below debt at maturity, so you can back out a default probability from the equity price and its volatility. That's the structural family; reduced-form models skip the story and fit default intensity straight from market spreads.

   Then walk it

   1. The Merton set-up: firm assets follow a lognormal process, equity holders own a call with strike equal to the debt face value, and default probability is the chance the asset value ends below that strike. Distance to default is how many asset standard deviations you are above the barrier.
   2. The clever part is that it's forward-looking and uses market data. Equity prices update every second, so a structural PD reacts long before a rating agency does. That's what Moody's KMV commercialised as EDF.
   3. Its weaknesses are specific. It underpredicts short-term default because the asset process is continuous and can't jump. It needs asset value and asset volatility, neither of which is observable. It assumes one debt maturity. And it produces credit spreads well below observed ones, the credit spread puzzle.
   4. Reduced-form, or intensity models like Jarrow-Turnbull and Duffie-Singleton, take default as an exogenous Poisson-type event with a hazard rate calibrated from CDS or bond spreads. No story about why the firm defaults, just a fit to prices.
   5. So the trade-off: structural models explain and give you economic intuition and a link to the equity market. Reduced-form models fit market prices and are what you use to value and hedge credit derivatives.
   6. In practice a bank uses both and for different jobs. Structural or hybrid models for wholesale PD estimation and early warning; reduced-form for pricing and for CVA. And the risk-management caveat: a structural model's PD spikes whenever equity vol spikes, so it's cyclical and noisy, which is fine as an early warning signal and bad as a provisioning input.

   Where candidates lose it

   Describing equity as a call option and stopping. The interviewer will ask what's wrong with Merton, and 'it underpredicts short-horizon default because assets can't jump' plus 'asset value and asset volatility aren't observable' are the answers. Also be able to say which model you'd use for pricing versus for PD estimation.

   Expect next

   • What is distance to default?
   • Why does Merton understate short-term default risk?
   • Which would you use to price a CDS?
6. 037You just traded a five-year interest rate swap at par. What is your counterparty exposure today and over the life of the trade?Counterparty risk and CVAHardtechnicalBank credit riskDerivatives risk

   Say this

   Today it's zero, because at par the swap has no value to either side. Over its life the expected exposure rises, peaks somewhere around a third of the way in, and then falls to zero at maturity. That humped shape is the thing to be able to draw.

   Then walk it

   1. Two forces set the shape. Diffusion: the longer you wait, the further rates can have wandered, so potential exposure grows with roughly the square root of time. Amortisation: as the swap ages, fewer cash flows remain, so a given rate move is worth less.
   2. Diffusion dominates early and amortisation dominates late, so the profile humps. For a vanilla five-year swap the peak sits around year one and a half to two.
   3. Rough magnitude: the exposure is roughly the DV01 of the remaining swap times a stressed rate move. At year two, three years remain, DV01 on a 100 crore notional is about 2.8 lakh per basis point, and a 95th percentile two-year rate move of maybe 150 basis points gives potential future exposure of roughly 4 crore, so about 4 percent of notional.
   4. Contrast it with a cross-currency swap, where notional is exchanged at maturity, so exposure keeps growing to the end and peaks at maturity. Same product family, completely different profile, and that's the follow-up they'll ask.
   5. The measures to name: current exposure is today's positive mark-to-market. Expected positive exposure is the average of positive exposures over time. Potential future exposure is a high quantile, typically 95 or 99 percent, and effective EPE is the regulatory input to the capital calculation.
   6. What changes the shape in practice: a CSA with daily margin collapses the profile to a few days of margin period of risk, so you're left with gap risk rather than five-year diffusion. Netting against offsetting trades with the same counterparty cuts it further.
   7. And the caveat: all of this is a model output. The distribution of rates you assume, and the margin period of risk you assume in a stressed close-out, move the number by multiples.

   Where candidates lose it

   Saying the exposure is zero because the swap is at par. That's only true today. The question is testing whether you understand exposure as a profile through time, and whether you can name why a cross-currency swap humps differently. Draw the shape if there's a whiteboard.

   Expect next

   • Now draw it for a cross-currency swap.
   • How does a daily-margined CSA change the profile?
   • What is the margin period of risk and what would you assume for it?
7. 046A trader has breached his VaR limit three times this month, and each time got approval after the fact. What do you do?Operational riskHardsuperdayOperational riskBank market risk

   Say this

   Three retrospective approvals isn't a limit breach problem, it's a control failure. The limit has effectively been replaced by a negotiation. I'd document the pattern, escalate it as a governance issue rather than three separate incidents, and force a decision: either the limit is wrong or the behaviour is.

   Then walk it

   1. First establish the facts precisely: what the limit is, the size and duration of each breach, who approved each one, whether the approver had authority, and whether the approvals were documented at the time or reconstructed afterwards. That last detail changes the nature of the issue completely.
   2. Then separate the two possible root causes. Either the limit is miscalibrated for a legitimate business, in which case the fix is a properly approved limit increase through the right committee. Or the trader is running more risk than the firm sanctioned, in which case it's a discipline matter.
   3. The crucial reframing: three ad hoc approvals in a month means the limit is no longer a control. A pre-approved excess is a limit; a post-approved excess is an apology. Say that sentence in the interview, because it's the point of the question.
   4. Escalation route: my head of risk and the market risk committee, not a quiet conversation with the desk head who has been signing the approvals. The approver is part of what needs reviewing, so escalating to them alone is the mistake.
   5. Then the pattern question. Look for other symptoms: end-of-day position reductions that reverse the next morning, P&L volatility inconsistent with reported risk, stale or hard-to-verify marks on illiquid positions. Limit breaches with cooperative approvals are a classic precursor, and every large rogue trading loss has this shape in hindsight.
   6. Consequences and record. In a bank this is reportable to the risk committee, it should appear in the operational risk event log, and it belongs in the trader's performance file. If nothing happens, the next breach is certain.
   7. And the systemic fix: hard-coded pre-trade blocks rather than post-trade reporting, a rule that excesses need pre-approval at a level above the desk, and an automatic escalation after a second breach in a rolling period.

   Where candidates lose it

   Treating it as three separate breaches to be logged. It's one control failure, and the interviewer is testing whether you'll escalate past the person who authorised it. The other failure is going straight to a disciplinary framing without checking whether the limit is simply miscalibrated for a legitimate business.

   Expect next

   • What if the approver is the head of the desk and outranks your boss?
   • What other red flags would you look for?
   • How would you redesign the limit framework so this can't happen?
8. 050Explain what a Kalman filter is.Model risk and validationHardtechnicalUBSRisk · London · 2022

   Say this

   It's a recursive estimator for a hidden state you can only observe with noise. Each period you predict the state forward with your model, then correct that prediction with the new observation, weighting the two by how much you trust each. Under linear-Gaussian assumptions it's the optimal estimator.

   Then walk it

   1. Two equations. A state equation for how the unobserved thing evolves, and a measurement equation linking the state to what you actually see, each with its own noise.
   2. Two steps per period. Predict: roll the state and its uncertainty forward. Update: compute the surprise, the difference between the observation and what you expected, and move your estimate toward it by the Kalman gain.
   3. The gain is the whole intuition. If measurement noise is large relative to state uncertainty, the gain is small and you mostly trust your model. If your state uncertainty is large, the gain is large and you mostly trust the new data. It's Bayesian updating with the arithmetic done for you.
   4. Where it's used in finance: extracting a time-varying beta or hedge ratio, estimating a stochastic volatility or unobserved factor, filtering a fair-value or pairs-trading spread, term structure models where the factors are latent, and nowcasting a macro variable from noisy high-frequency data.
   5. Why a risk function cares: it gives you an estimate that adapts without the jumpiness of a rolling window. A 60-day rolling beta lurches when an old observation drops out; a Kalman-filtered beta moves smoothly and quantifies its own uncertainty.
   6. The assumptions and their cost: linear dynamics and Gaussian noise. For non-linear problems you need the extended or unscented variants or a particle filter. And you have to specify the two noise covariances, which are rarely known, so in practice you estimate them by maximum likelihood and the result is sensitive to them.
   7. The limitation to volunteer: it's optimal given the model, and it has no way to tell you the state equation is wrong. Feed it a misspecified process and it will produce confident, smooth, wrong estimates, which is a particularly dangerous failure mode.

   Where candidates lose it

   Reciting matrix equations. Nobody wants the algebra; they want the predict-then-correct intuition, the gain as a trust weighting, and one concrete financial use. If you can't name a use case, the answer reads as memorised from a signal-processing course.

   Expect next

   • How would you use it to estimate a time-varying hedge ratio?
   • What happens if the noise covariances are misspecified?
   • How does it compare to a simple exponentially weighted estimate?

   Reported by candidates at UBS (Risk, London, 2022). Source: Wall Street Oasis.

9. 051You are validating a gradient boosting credit model that beats the existing logistic scorecard by eight Gini points. Do you approve it?Model risk and validationHardsuperdayModel validationBank credit risk

   Say this

   Not on the Gini alone. Eight points of discrimination is worth having, but I'd need calibration, stability, explainability and fair-lending testing before approving it, and I'd want to know whether the gain survives out of time rather than just out of sample.

   Then walk it

   1. First question: is the eight points real? Check for leakage, which is the most common cause of a suspiciously strong challenger. Any feature that encodes the outcome, a post-application field, a collections flag, a date artefact, and the gain evaporates.
   2. Second: out of time, not just out of sample. Boosted models overfit to the period as well as to the sample. If the gain is eight points on a random split and two points on a later year, the story changes completely.
   3. Third: calibration. Gradient boosting ranks well and is often badly calibrated in the extremes, which is where pricing and provisioning live. Check the predicted-versus-observed curve by decile and consider isotonic or Platt scaling.
   4. Fourth: monotonicity and explainability. A credit model has to survive being explained to a customer who was declined and to a regulator. Unconstrained boosting can learn that higher income increases risk in some segment, which is a spurious interaction you can't defend. Monotonic constraints usually cost very little Gini and buy a lot of defensibility.
   5. Fifth: fairness. Test outcomes across protected characteristics and proxies for them. Complex models find proxies more efficiently than simple ones, so this risk genuinely rises with model power.
   6. Sixth: operational reality. Feature pipeline stability, retraining cadence, latency, reproducibility, version control, and whether anyone can support it in three years when the builder has left. Model risk includes the risk that nobody understands the production model.
   7. So my recommendation would be conditional approval with constraints: monotonic constraints on the key variables, calibration layer on top, capped score-level overrides, tightened monitoring thresholds, and the logistic model retained as a live benchmark. That is a real validation outcome rather than a yes or a no.
   8. And the commercial framing to say out loud: eight Gini points on a large retail book is worth real money, so the answer isn't to refuse complexity. It's to price the governance cost and decide deliberately.

   Where candidates lose it

   Picking a side. Reflexively rejecting machine learning makes you look like an obstacle; approving it on Gini alone makes you look like you've never validated anything. The answer is conditional approval with named conditions, and leakage plus out-of-time degradation are the two checks that must come first.

   Expect next

   • How would you test for leakage?
   • What would you tell a declined customer?
   • How much Gini would you give up for monotonicity?
10. 057What is Basel IV, and what changed for market risk?Regulatory capitalHardsuperdayRegulatory reportingBank market risk

    Say this

    Basel IV, formally the finalisation of Basel III, is about comparability rather than more capital. The headline is the 72.5 percent output floor on internally modelled RWA. For market risk it's FRTB, which replaced VaR with expected shortfall and drew a much harder line between trading and banking book.

    Then walk it

    1. The output floor: total RWA can't fall below 72.5 percent of the standardised calculation, phased in over several years. It caps the benefit of internal models and restores comparability between banks, which was the central complaint after 2008.
    2. Credit risk: advanced IRB removed for large corporates and financial institutions, IRB removed for equities, input floors on PD and LGD, and a more granular standardised approach with real loan-to-value sensitivity on mortgages.
    3. Operational risk: internal models abolished entirely, replaced by the standardised measurement approach driven by business indicators and your own loss history.
    4. FRTB for market risk, and the four things that changed. Expected shortfall at 97.5 percent replaces 99 percent VaR, so tail depth is captured. Liquidity horizons vary by risk factor from 10 to 120 days, so illiquid risk costs more capital.
    5. Third, non-modellable risk factors. If a factor lacks enough real price observations, you can't model it and it attracts a stress-based add-on. That was a large and unwelcome surprise for exotic and emerging market desks.
    6. Fourth, the trading and banking book boundary became prescriptive with restrictions on reclassification, ending the pre-crisis practice of moving positions to whichever book carried less capital. And the internal models approval is now at desk level with P&L attribution tests, so one desk can fail and lose modelled treatment while others keep it.
    7. Implementation dates have slipped repeatedly and differ by jurisdiction, with the US, UK and EU all on different timelines and different versions, especially for FRTB internal models. That fragmentation is itself a live commercial issue for global banks.
    8. The fair criticism: the aggregate capital impact is modest but very unevenly distributed, falling hardest on European banks with big IRB books and on trading desks in illiquid products. And the complexity it adds runs against the original goal of simplicity.

    Where candidates lose it

    Treating Basel IV as just higher capital requirements. The theme is comparability and constraining internal models, not level. And for market risk you need FRTB's specifics: expected shortfall, liquidity horizons, non-modellable risk factors and the desk-level P&L attribution test. Naming only the first shows shallow reading.

    Expect next

    • Why did FRTB move to expected shortfall?
    • What is a non-modellable risk factor and what does it cost?
    • What happens when a desk fails P&L attribution?

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.