Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 011How do you backtest a VaR model?Market risk and VaRIntermediatetechnicalBank market riskModel validation

   Say this

   Compare the daily VaR forecast to the actual next-day P&L and count the days the loss exceeded it. Then test whether that count and its timing are consistent with your confidence level. At 99% over 250 days, you expect about two or three exceptions.

   Then walk it

   1. First fix the P&L definition. You backtest against hypothetical P&L, which holds the portfolio static, not actual P&L, which includes intraday trading and fees. Otherwise you're testing the traders, not the model.
   2. Unconditional coverage: the Kupiec proportion-of-failures test. Is the exception count statistically consistent with one percent? With 250 days, you can't reject much below five exceptions, so the test has weak power. Say that.
   3. Conditional coverage: are exceptions independent, or do they cluster? Christoffersen's test looks at that. Clustering means the model is slow to react to volatility regimes, which is the classic symptom of a long unweighted historical window.
   4. Basel's traffic light is the version supervisors actually use: green up to four exceptions in 250 days, amber five to nine with a rising capital multiplier, red at ten or more, which triggers a multiplier of four and a model review.
   5. Then diagnostics beyond the count. Which desks and which risk factors produced the breaches, and how big were the breaches relative to VaR. Ten small breaches and two enormous ones are different failures needing different fixes.
   6. The limitation I'd raise: a single year at 99% simply doesn't contain enough tail events to prove a model right. Backtesting can reject a bad model and cannot confirm a good one. That's why it sits alongside benchmarking and stress testing.

   Where candidates lose it

   Counting breaches and stopping. Two things get missed almost every time: using hypothetical rather than actual P&L, and saying that the test has low statistical power over 250 days. Both show you understand what backtesting can and cannot prove.

   Expect next

   • What is the Basel traffic light approach?
   • Why hypothetical P&L and not actual?
   • Zero exceptions in a year. Is the model good?
2. 012Your 99 percent one-day VaR model produced nine exceptions in the last 250 days. Walk me through what you do.Market risk and VaRHardsuperdayBank market riskModel validation

   Say this

   Nine is amber, one short of red, so two things happen in parallel: the capital multiplier steps up and I open a model investigation. But before either, I check that the exceptions are real and not a data or P&L-attribution problem.

   Then walk it

   1. Step one, validate the exceptions. Bad marks, a stale curve, a missing trade feed, or backtesting against actual instead of hypothetical P&L can all manufacture breaches. I've seen a whole amber month turn out to be one mispriced illiquid bond.
   2. Step two, look at clustering. Nine breaches spread evenly across the year says the model is calibrated too low. Nine in a three-week window in March says the model is fine in normal times and slow to react to a volatility regime shift. Completely different fixes.
   3. Step three, attribute. Which desk, which risk factor, which side. If eight of the nine come from one credit desk, it's not a firmwide VaR problem, it's a missing risk factor or a proxy that stopped working.
   4. Step four, size them. Breaches at 1.1 times VaR are a calibration issue. Breaches at three times VaR mean the tail shape is wrong, which points at normality or at unmodelled optionality.
   5. Step five, the regulatory and capital consequence. Under the Basel backtesting framework nine exceptions sits in the amber zone with a multiplier around 3.65 rather than 3.0, and it's a disclosable model performance issue. I'd tell the CRO and the supervisor rather than wait to be asked.
   6. Step six, the fix, and it should be the smallest defensible one: reweighting the window or moving to volatility-scaled historical simulation for clustering, adding a missing factor for a desk problem, moving to full revaluation for an optionality problem. Then re-run the backtest on the corrected model over the same period.
   7. And the interim control while the fix is validated: a VaR add-on or a tightened desk limit. You don't get to run unlimited with a broken model while the remediation is in flight.

   Where candidates lose it

   Jumping straight to 'recalibrate the model'. The first move is always to check whether the exceptions are real, and the second is to look at their pattern. A candidate who recalibrates without diagnosing has just fitted the model to a data error, and that is the exact failure the interviewer is probing for.

   Expect next

   • What if all nine were in the same fortnight?
   • What's the capital consequence of amber versus red?
   • Would you tell the regulator before or after you had a fix?
3. 013Take me through the basic concepts in market risk. What are the main types?Market risk and VaRCorephone / first roundScotiabankRisk · Toronto · 2025

   Say this

   Market risk is the risk of loss from moves in market prices, and it splits by the factor driving it: interest rate, equity, foreign exchange, credit spread and commodity. Then volatility risk sits across all of them once you hold options.

   Then walk it

   1. Interest rate risk is usually the biggest for a bank, and it has shape as well as level: parallel shifts, steepening and flattening, and basis between curves.
   2. Credit spread risk is separate from interest rate risk even though both show up in a bond price. One is the risk-free curve moving, the other is the spread over it, and they often move in opposite directions in a flight to quality.
   3. Equity, FX and commodity risk are more straightforward directionally, but FX carries a funding dimension too, because a cross-currency basis move hits you even with no net FX position.
   4. Volatility risk comes free with any option book: vega for the level of implied vol, and then the shape, skew and term structure.
   5. Then the two that candidates forget. Basis risk, where your hedge and your exposure are driven by different but correlated factors. And market liquidity risk, where the price you can actually transact at is worse than the mark.
   6. The way a desk measures all of it is sensitivities plus VaR plus stress. Sensitivities for daily trading decisions, VaR for aggregation and limits, stress for the scenarios VaR can't see.

   Where candidates lose it

   Giving four factor names and stopping. Two things lift the answer: separating credit spread risk from interest rate risk, and naming basis risk and market liquidity risk as market risks in their own right. Those are the ones that actually generate P&L surprises.

   Expect next

   • Which of those is largest for a commercial bank, and why?
   • Is credit spread risk market risk or credit risk?
   • Now tell me about counterparty credit risk.

   Reported by candidates at Scotiabank (Risk, Toronto, 2025). Source: Wall Street Oasis.

4. 014Desk A has $10 million of VaR and Desk B has $10 million of VaR. What is the firm's VaR, and which desk is using more of the limit?Market risk and VaRHardtechnicalBank market riskBuy-side risk

   Say this

   Anywhere from zero to $20m, depending on correlation. If they're perfectly correlated it's $20m, if perfectly offsetting it's zero, and if independent it's about $14.1m. And neither desk is necessarily using half the limit, which is the real point of the question.

   Then walk it

   1. Under normality, combined VaR is the square root of the sum of squares plus twice the covariance term. Two $10m desks at zero correlation gives $10m times root two, so $14.1m. At 0.5 correlation it's about $17.3m.
   2. That gap between $20m and $14.1m is the diversification benefit, and allocating it is the political heart of a risk manager's job.
   3. Component VaR is how you split it. You compute each desk's contribution so the components sum exactly to firm VaR. It's marginal VaR times position size, and it's the number you use for limits and for risk-adjusted performance.
   4. Marginal VaR is the derivative: how much firm VaR changes for a small increase in that desk. Incremental VaR is the discrete version, firm VaR with the desk minus firm VaR without it.
   5. Here's the counterintuitive part that makes it a good interview question. A desk hedging the rest of the firm can have positive standalone VaR and negative component VaR. It genuinely reduces firm risk, and a naive standalone limit framework would penalise it.
   6. So the answer to 'which desk uses more limit' is: whichever has the higher component VaR, and you cannot tell from the standalone numbers. You need the covariance with everything else.

   Where candidates lose it

   Answering $20m, or answering $14.1m as though independence were given. The interviewer wants the range and the word correlation, then the distinction between standalone and component VaR. The hedging-desk case, where component VaR is negative, is the answer that gets remembered.

   Expect next

   • Can a desk have negative component VaR?
   • How would you allocate the diversification benefit between the two desks?
   • Does this decomposition still work for expected shortfall?

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.