Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 012Your 99 percent one-day VaR model produced nine exceptions in the last 250 days. Walk me through what you do.Market risk and VaRHardsuperdayBank market riskModel validation

   Say this

   Nine is amber, one short of red, so two things happen in parallel: the capital multiplier steps up and I open a model investigation. But before either, I check that the exceptions are real and not a data or P&L-attribution problem.

   Then walk it

   1. Step one, validate the exceptions. Bad marks, a stale curve, a missing trade feed, or backtesting against actual instead of hypothetical P&L can all manufacture breaches. I've seen a whole amber month turn out to be one mispriced illiquid bond.
   2. Step two, look at clustering. Nine breaches spread evenly across the year says the model is calibrated too low. Nine in a three-week window in March says the model is fine in normal times and slow to react to a volatility regime shift. Completely different fixes.
   3. Step three, attribute. Which desk, which risk factor, which side. If eight of the nine come from one credit desk, it's not a firmwide VaR problem, it's a missing risk factor or a proxy that stopped working.
   4. Step four, size them. Breaches at 1.1 times VaR are a calibration issue. Breaches at three times VaR mean the tail shape is wrong, which points at normality or at unmodelled optionality.
   5. Step five, the regulatory and capital consequence. Under the Basel backtesting framework nine exceptions sits in the amber zone with a multiplier around 3.65 rather than 3.0, and it's a disclosable model performance issue. I'd tell the CRO and the supervisor rather than wait to be asked.
   6. Step six, the fix, and it should be the smallest defensible one: reweighting the window or moving to volatility-scaled historical simulation for clustering, adding a missing factor for a desk problem, moving to full revaluation for an optionality problem. Then re-run the backtest on the corrected model over the same period.
   7. And the interim control while the fix is validated: a VaR add-on or a tightened desk limit. You don't get to run unlimited with a broken model while the remediation is in flight.

   Where candidates lose it

   Jumping straight to 'recalibrate the model'. The first move is always to check whether the exceptions are real, and the second is to look at their pattern. A candidate who recalibrates without diagnosing has just fitted the model to a data error, and that is the exact failure the interviewer is probing for.

   Expect next

   • What if all nine were in the same fortnight?
   • What's the capital consequence of amber versus red?
   • Would you tell the regulator before or after you had a fix?
2. 016Design a stress scenario for a book that is long Indian corporate bonds and short interest rate futures.Tail risk and stress testingHardcase studyIndian bank risk and treasuryBank market risk

   Say this

   The scenario has to break the hedge, not just move the market. The position is long credit and short duration, so the pain case is spreads widening while the risk-free curve rallies, which is precisely what a flight to quality does.

   Then walk it

   1. Start by naming the real exposures. Net duration is small by design, so a parallel shift is not the risk. The live risks are credit spread, the government-bond-to-swap basis, the futures-to-cash basis, and liquidity in the corporate leg.
   2. So the core shock: AAA and AA corporate spreads widen 150 to 250 basis points, while the ten-year G-sec yield falls 75 basis points. You lose on both legs at once. That is the textbook flight-to-quality asymmetry and it happened in March 2020.
   3. Layer in the basis. The bond futures may not track the cash bond you hold, and the cheapest-to-deliver can switch. Add 25 to 50 basis points of adverse basis independent of the spread move.
   4. Layer in liquidity. Indian corporate bond secondary volumes are thin outside the top names, so add a bid-offer widening of two to four times normal and assume you can only exit 20 percent of the position in a week. Then mark the rest at the stressed exit price, not the matrix price.
   5. Layer in funding. Repo haircuts on corporate paper rise, margin on the futures short goes up as volatility spikes, and both hit the same day. That is the mechanism that turns a mark-to-market loss into a forced sale.
   6. Add a name-specific tail: one issuer in the book is downgraded below investment grade, which triggers forced selling by mandate-constrained funds and moves the whole rating bucket. The IL&FS episode in 2018 is the live Indian precedent, and the credit-fund redemption spiral that followed is the second-round effect.
   7. Then report it properly: P&L by leg, the funding call in rupees, days to unwind, and which limits break. A scenario that produces one aggregate number is not decision-useful.

   Where candidates lose it

   Designing a parallel rate shock. The book is deliberately hedged against that, so the scenario shows nothing and you have proved you didn't look at the position. A good stress scenario attacks the assumption the hedge relies on, which here is spread-to-rate correlation, and it must include liquidity and funding, not just price.

   Expect next

   • How would you calibrate the size of the spread move?
   • What second-round effects would you add?
   • How would you present this to a treasurer who says the book is hedged?
3. 021A trader tells you his book is delta neutral. It lost $4 million yesterday on a 3 percent market move. What happened?Greeks and sensitivitiesHardsuperdayBank market riskDerivatives risk

   Say this

   Almost certainly short gamma. Delta neutral only holds for an infinitesimal move; if he's short options, delta turns against him as the market runs, so he's rehedging at worse and worse prices all the way. The move being 3 percent is the clue.

   Then walk it

   1. The mechanism: short gamma means delta moves against you. Market rallies, your delta goes short, you buy to rehedge, market falls back, your delta goes long, you sell. You buy high and sell low mechanically all day.
   2. Rough size check: for a book with gamma of minus $2m per percent, a 3 percent move costs about half times gamma times move squared, so around $9m of gamma P&L. A $4m loss is entirely consistent with a modest short gamma position.
   3. Second candidate, vega. A 3 percent move usually comes with implied vol up several points. If he's short vol, that's a separate loss on top, and on a big book vega loss can dwarf gamma loss.
   4. Third, delta neutral in what. Neutral to the index but long a basket of single names is a beta hedge, not a delta hedge. Dispersion or a basis between the hedge instrument and the underlying gives you exactly this.
   5. Fourth, the hedge was neutral at the close and not during the day. Intraday delta drift with no rehedging looks flat on both snapshots and loses money in between.
   6. So the questions I'd ask him, in order: what's your gamma and vega, what did implied vol do, what instrument are you hedged in, and when was the last rehedge. And the control conclusion: a delta limit alone was never going to catch this, which is why you need gamma and vega limits.

   Where candidates lose it

   Saying 'he must have been wrong about being delta neutral'. He probably wasn't. The whole point is that delta neutrality is a local property and says nothing about second-order risk. Name gamma first, vega second, and then draw the control conclusion about limits.

   Expect next

   • How would you size a gamma limit?
   • How do you explain to a trader that delta neutral isn't neutral?
   • What if implied vol had fallen instead?
4. 027How would you approach building a delinquency model?Credit riskHardtechnicalNeuberger BermanRisk · Chicago · 2024

   Say this

   Define the target first, then build backwards. Delinquency is not default, so I'd fix the bad definition, say 90 days past due within twelve months, set an observation and performance window, and only then worry about features and model form.

   Then walk it

   1. Target definition is the decision that determines everything else. 30, 60 or 90 days past due, and over what horizon. Roll-rate analysis tells you where delinquency becomes effectively irreversible, and that's where you draw the line.
   2. Sampling: pick an observation point, take the borrower's state as at that date, then observe outcomes over the following twelve months. Strict separation, or you leak future information into features and get a model that looks brilliant in development and fails in production.
   3. Features in three families. Behavioural: utilisation trend, minimum-payment behaviour, recent missed payments, bounced mandates. Bureau: enquiry velocity, existing delinquency elsewhere, thin-file flags. Loan and demographic: loan-to-value, instalment-to-income, vintage, product, channel of origination.
   4. Model form: start with logistic regression on coarse-classified, weight-of-evidence binned variables. It's monotonic, explainable and passes validation. Then run a gradient boosting challenger to see how much signal the simple model leaves on the table. If the gap is small, ship the simple one.
   5. Validation: out-of-time as well as out-of-sample, because credit models degrade through the cycle not through the sample. Report Gini or AUC for ranking, and a calibration curve for whether the predicted rates match observed. A model can rank perfectly and be badly calibrated.
   6. Two traps specific to credit. Survivorship and selection bias: you only observe outcomes for people you approved, so the model is blind to the rejected population, and you need reject inference. And macro sensitivity: a model built on 2021 data has never seen a rate cycle, so the absolute PD level will be wrong even if the ranking holds.
   7. Then monitoring. Population stability index on the score distribution, drift on each feature, and a monthly actual-versus-expected. Most delinquency models fail from population shift rather than bad maths.

   Where candidates lose it

   Going straight to algorithms. In credit, the target definition, the observation window and the reject-inference problem are worth more than model choice, and interviewers who build these for a living are listening for exactly those. Also say the word calibration; ranking power alone doesn't let you price or provision.

   Expect next

   • How would you handle reject inference?
   • How would you know the model had degraded?
   • Would you use gradient boosting in production for this?

   Reported by candidates at Neuberger Berman (Risk, Chicago, 2024). Source: Wall Street Oasis.

5. 028How do you build a credit scorecard, and how do you prove it works?Credit riskHardtechnicalBank credit riskGlobal capability centres

   Say this

   Bin every variable, convert to weight of evidence, fit a logistic regression, then scale the log odds into points. You prove it works on three axes: discrimination, calibration and stability, tested out of time, not just out of sample.

   Then walk it

   1. Coarse classification first. Bin each variable so the bad rate is monotonic across bins and each bin has enough volume, usually at least 5 percent of the population. Then replace the bin with its weight of evidence, the log of the good-to-bad odds ratio.
   2. Information value tells you which variables to keep. Below about 0.02 is useless, 0.1 to 0.3 is useful, above 0.5 and I'd check for leakage rather than celebrate.
   3. Fit logistic regression on the WOE variables, then scale: points equal offset plus factor times log odds, calibrated so a chosen score doubles the odds every 20 points. That scaling is cosmetic but it's how credit officers read the output.
   4. Discrimination: Gini, or equivalently AUC, where Gini equals two times AUC minus one. A retail behavioural scorecard should hit 0.55 to 0.70 Gini; an application scorecard on a thin-file population might only get 0.35, and that can still be commercially valuable. Kolmogorov-Smirnov is the other standard, the maximum gap between the cumulative good and bad distributions.
   5. Calibration: plot predicted against observed bad rate by score band, and run a Hosmer-Lemeshow style test. Discrimination decides who you approve; calibration decides what you charge and what you provision. You need both.
   6. Stability: population stability index between development and current, per variable and on the score. Above 0.25 and the population has shifted enough that the model needs rebuilding, not just recalibration.
   7. And the governance point: build on a development sample, validate on a holdout, then validate again on a later time period the model never saw. An out-of-sample test on a random split proves almost nothing for a credit model, because the whole failure mode is time.

   Where candidates lose it

   Quoting a Gini target as if it were universal. A good Gini depends entirely on the population and the product, and someone who has built these knows that. The other failure is testing only discrimination. A model with 0.7 Gini and broken calibration will approve the right people and price them all wrong.

   Expect next

   • What Gini would you expect on a prime mortgage book?
   • The Gini is stable but the bad rate has doubled. What happened?
   • When do you recalibrate versus rebuild?
6. 032What is structured finance, how would you evaluate it, and what are the credit risks?Credit riskHardtechnicalMoody'sCredit Risk · New York · 2024

   Say this

   Structured finance is taking a pool of cash-flow-generating assets, putting it in a bankruptcy-remote vehicle, and slicing the cash flows into tranches of different seniority. You evaluate it in three layers: the collateral, the structure, and the parties.

   Then walk it

   1. Layer one, the collateral. Pool composition, weighted average life, seasoning, geographic and obligor concentration, historical default and prepayment behaviour, and how the underwriting was done. Everything downstream depends on this, and it's where the 2007 failure actually was.
   2. Layer two, the structure. Where does the cash go, and in what order. Credit enhancement comes from subordination, excess spread, overcollateralisation and reserve accounts. Then the triggers: performance triggers that turn a pro-rata waterfall sequential, and cash-trapping mechanics.
   3. Layer three, the parties. Originator, servicer, trustee, swap counterparty. Servicer quality drives recoveries, and servicer failure has broken deals whose collateral was fine. Then the legal question: is the true sale robust, and is the SPV actually bankruptcy remote?
   4. How I'd analyse it: model the pool, run default and prepayment scenarios, and see at what cumulative loss each tranche takes its first rupee of loss. That break-even loss compared with the expected loss is the real measure of a tranche's safety.
   5. The credit risks specific to tranching. Correlation risk: a senior tranche is a bet on correlation, not just on average defaults, because it only fails if losses cluster. Cliff risk: a mezzanine tranche goes from untouched to wiped out over a narrow loss range, so it's far more convex than its rating suggests.
   6. Then prepayment and extension risk on the timing, basis risk if the assets and liabilities reprice off different benchmarks, and originator alignment. Skin in the game is why post-crisis rules require the sponsor to retain a slice.
   7. The Indian version worth naming: pass-through certificates and direct assignments on NBFC loan pools, where the live risks are servicer concentration, priority-sector motivation on the buyer side, and the 2018 to 2019 NBFC liquidity episode showing how quickly refinancing assumptions fail.
   8. And the honest limitation: the rating of a structured tranche is far more model-dependent than a corporate rating. Small changes in a correlation assumption move a AAA to a BBB, and that is exactly what happened to CDOs.

   Where candidates lose it

   Explaining tranching and stopping. The two things a credit risk interviewer at a rating agency wants are the sensitivity of senior tranches to correlation rather than to average default rates, and the cliff-risk convexity of mezzanine. Naming the servicer and the true-sale question shows you've read a deal document, not a textbook.

   Expect next

   • Why is a senior tranche a bet on correlation?
   • What actually went wrong with CDO ratings in 2007?
   • How would you analyse an Indian NBFC pass-through certificate?

   Reported by candidates at Moody's (Credit Risk, New York, 2024). Source: Wall Street Oasis.

7. 046A trader has breached his VaR limit three times this month, and each time got approval after the fact. What do you do?Operational riskHardsuperdayOperational riskBank market risk

   Say this

   Three retrospective approvals isn't a limit breach problem, it's a control failure. The limit has effectively been replaced by a negotiation. I'd document the pattern, escalate it as a governance issue rather than three separate incidents, and force a decision: either the limit is wrong or the behaviour is.

   Then walk it

   1. First establish the facts precisely: what the limit is, the size and duration of each breach, who approved each one, whether the approver had authority, and whether the approvals were documented at the time or reconstructed afterwards. That last detail changes the nature of the issue completely.
   2. Then separate the two possible root causes. Either the limit is miscalibrated for a legitimate business, in which case the fix is a properly approved limit increase through the right committee. Or the trader is running more risk than the firm sanctioned, in which case it's a discipline matter.
   3. The crucial reframing: three ad hoc approvals in a month means the limit is no longer a control. A pre-approved excess is a limit; a post-approved excess is an apology. Say that sentence in the interview, because it's the point of the question.
   4. Escalation route: my head of risk and the market risk committee, not a quiet conversation with the desk head who has been signing the approvals. The approver is part of what needs reviewing, so escalating to them alone is the mistake.
   5. Then the pattern question. Look for other symptoms: end-of-day position reductions that reverse the next morning, P&L volatility inconsistent with reported risk, stale or hard-to-verify marks on illiquid positions. Limit breaches with cooperative approvals are a classic precursor, and every large rogue trading loss has this shape in hindsight.
   6. Consequences and record. In a bank this is reportable to the risk committee, it should appear in the operational risk event log, and it belongs in the trader's performance file. If nothing happens, the next breach is certain.
   7. And the systemic fix: hard-coded pre-trade blocks rather than post-trade reporting, a rule that excesses need pre-approval at a level above the desk, and an automatic escalation after a second breach in a rolling period.

   Where candidates lose it

   Treating it as three separate breaches to be logged. It's one control failure, and the interviewer is testing whether you'll escalate past the person who authorised it. The other failure is going straight to a disciplinary framing without checking whether the limit is simply miscalibrated for a legitimate business.

   Expect next

   • What if the approver is the head of the desk and outranks your boss?
   • What other red flags would you look for?
   • How would you redesign the limit framework so this can't happen?
8. 051You are validating a gradient boosting credit model that beats the existing logistic scorecard by eight Gini points. Do you approve it?Model risk and validationHardsuperdayModel validationBank credit risk

   Say this

   Not on the Gini alone. Eight points of discrimination is worth having, but I'd need calibration, stability, explainability and fair-lending testing before approving it, and I'd want to know whether the gain survives out of time rather than just out of sample.

   Then walk it

   1. First question: is the eight points real? Check for leakage, which is the most common cause of a suspiciously strong challenger. Any feature that encodes the outcome, a post-application field, a collections flag, a date artefact, and the gain evaporates.
   2. Second: out of time, not just out of sample. Boosted models overfit to the period as well as to the sample. If the gain is eight points on a random split and two points on a later year, the story changes completely.
   3. Third: calibration. Gradient boosting ranks well and is often badly calibrated in the extremes, which is where pricing and provisioning live. Check the predicted-versus-observed curve by decile and consider isotonic or Platt scaling.
   4. Fourth: monotonicity and explainability. A credit model has to survive being explained to a customer who was declined and to a regulator. Unconstrained boosting can learn that higher income increases risk in some segment, which is a spurious interaction you can't defend. Monotonic constraints usually cost very little Gini and buy a lot of defensibility.
   5. Fifth: fairness. Test outcomes across protected characteristics and proxies for them. Complex models find proxies more efficiently than simple ones, so this risk genuinely rises with model power.
   6. Sixth: operational reality. Feature pipeline stability, retraining cadence, latency, reproducibility, version control, and whether anyone can support it in three years when the builder has left. Model risk includes the risk that nobody understands the production model.
   7. So my recommendation would be conditional approval with constraints: monotonic constraints on the key variables, calibration layer on top, capped score-level overrides, tightened monitoring thresholds, and the logistic model retained as a live benchmark. That is a real validation outcome rather than a yes or a no.
   8. And the commercial framing to say out loud: eight Gini points on a large retail book is worth real money, so the answer isn't to refuse complexity. It's to price the governance cost and decide deliberately.

   Where candidates lose it

   Picking a side. Reflexively rejecting machine learning makes you look like an obstacle; approving it on Gini alone makes you look like you've never validated anything. The answer is conditional approval with named conditions, and leakage plus out-of-time degradation are the two checks that must come first.

   Expect next

   • How would you test for leakage?
   • What would you tell a declined customer?
   • How much Gini would you give up for monotonicity?
9. 059A bank reports CET1 of 11 percent against a 9 percent requirement. Is it safe?Regulatory capitalHardsuperdayRegulatory reportingBank credit risk

   Say this

   Not from that number alone. A capital ratio tells you about solvency under the RWA model, and banks fail from liquidity and from concentration, not from a ratio. I'd want to know the composition of the denominator, the funding profile and the trajectory before answering.

   Then walk it

   1. First, what's the 9 percent made of? Pillar 1 minimum, plus the conservation buffer, plus Pillar 2, plus any systemic surcharge. If the 9 percent is mostly buffer, breaching it restricts dividends rather than triggering resolution, which is a different kind of 2 percent of headroom.
   2. Second, interrogate the denominator. RWA density against total assets, how much is IRB-modelled, and single-name and sector concentration. An 11 percent ratio on a book with 25 percent in one sector is far weaker than the same ratio on a granular one, and the IRB formula won't show it.
   3. Third, the trajectory, which is what actually matters. Was it 13 percent two years ago? Is it falling through loan growth, buybacks or rising provisions? The direction and the stress path matter more than the level.
   4. Fourth, and this is the real answer, liquidity. SVB had a capital ratio comfortably above requirement the week it failed. Look at LCR, NSFR, deposit concentration, the uninsured deposit share, and unrealised losses in held-to-maturity securities that don't touch CET1 until they're sold.
   5. Fifth, asset quality and provision adequacy. Coverage ratio, NPL ratio, Stage 2 share, and whether provisioning looks light relative to peers. A thin provision stock means the capital ratio is borrowing from the future.
   6. Sixth, the stress result. What does CET1 do in the adverse ICAAP or supervisory scenario? If it drops to 8 percent, the 2 percent buffer is already spoken for and the bank is effectively at its constraint.
   7. So my answer would be: 11 against 9 is adequate headroom on a granular, well-funded, well-provisioned book with a stable trajectory, and thin on a concentrated book with a volatile funding base. And I'd say what I'd need to see rather than guess, because the interviewer is testing whether I'll commit to a number without the information.

   Where candidates lose it

   Answering yes or no. There isn't enough information, and the interviewer is testing whether you know that solvency ratios don't capture liquidity or concentration. SVB is the example that proves it, and naming unrealised held-to-maturity losses is the detail that lands.

   Expect next

   • What would you want to see to be comfortable?
   • SVB had a fine capital ratio. Why did it fail?
   • Does breaching the buffer requirement mean the bank fails?
10. 065A bank funds long-dated fixed-rate securities with uninsured corporate deposits. Walk me through everything that can go wrong.Liquidity risk and ALMHardcase studyTreasury and ALMBank market risk

    Say this

    That's the Silicon Valley Bank structure, and it fails in a specific sequence: rates rise, the asset side loses economic value without showing it in the accounts, depositors leave because they have better options, and selling the assets to pay them crystallises the loss and destroys the capital.

    Then walk it

    1. Step one, the duration mismatch. Long fixed-rate assets and overnight liabilities means economic value of equity falls hard when rates rise, even while net interest income looks fine for a while because deposit rates lag.
    2. Step two, the accounting shield that becomes a trap. Securities classified as held-to-maturity aren't marked through capital, so the loss is invisible in the reported ratios. SVB had roughly $15bn of unrealised HTM losses against about $16bn of equity at the end of 2022. The capital ratio said nothing was wrong.
    3. Step three, the depositor incentive. Uninsured corporate treasurers are rate-sensitive and professional. When T-bills yield 5 percent and your account pays 0.5, they leave for economic reasons before there's any fear. That's a slow outflow that forces asset sales.
    4. Step four, the crystallisation. Selling HTM securities to fund outflows moves the loss from a footnote into the income statement and the capital ratio. Worse, selling any of the portfolio can force reclassification of the whole HTM book under the accounting rules, which is why banks resist it until they can't.
    5. Step five, the run. Once the loss is public, uninsured depositors with a 100 percent loss-given-failure have every incentive to leave first, and they can now do it in an afternoon from a phone with a group chat coordinating them. SVB lost about $42bn in a single day.
    6. Step six, concentration as the accelerant. A depositor base drawn from one industry with shared advisers and shared venture investors is not a diversified funding book. It's one depositor with many accounts.
    7. What the risk function should have done: report EVE alongside NII and escalate the gap, treat unrealised HTM losses as economic capital regardless of accounting, model uninsured deposits with far faster run-off, set a concentration limit on depositor type, and hedge the duration with swaps. The last one is the cheapest and SVB had almost none on.
    8. And the governance point: SVB had no chief risk officer for part of 2022 and its interest rate stress scenarios had reportedly been changed to be less severe. The measurement failure was downstream of a governance failure, which is almost always the case.

    Where candidates lose it

    Describing it as a liquidity problem only, or a rate problem only. It's the interaction, plus an accounting classification that hid the loss, plus a concentrated and professional depositor base. Candidates who name the HTM accounting treatment and the depositor concentration show they've read the post-mortem rather than the headline.

    Expect next

    • Why didn't the capital ratio show the problem?
    • What single hedge would have changed the outcome?
    • How would you set a depositor concentration limit?

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.