Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 045Explain the three lines of defence.Operational riskCorephone / first roundOperational riskGlobal capability centres

   Say this

   First line is the business, which owns and manages the risk it takes. Second line is risk and compliance, which sets the framework, sets limits and independently challenges. Third line is internal audit, which gives the board assurance that the first two are working.

   Then walk it

   1. The first line's ownership is the part that's usually wrong in practice. The trader owns the market risk, the lending officer owns the credit decision, the operations head owns the process risk. If the business thinks risk management owns risk, the model has already failed.
   2. Second line has two jobs that sit in tension: it advises the business and it challenges the business. That's why independence matters, and why the CRO reports to the board risk committee and not just to the CEO.
   3. Third line is independent of both and reports to the audit committee. It does not run controls, it tests whether they exist and work. Audit sitting in management meetings designing controls destroys its own assurance value.
   4. The interesting judgement calls: where does a desk-embedded risk analyst sit? Where does model validation sit relative to model development? Where does finance sit? Getting those boundaries wrong is how conflicts creep in.
   5. The standard criticisms, worth volunteering. It creates a compliance mindset where the first line assumes the second line will catch things. Responsibilities blur in the middle. And it can become three layers of reporting rather than three layers of control.
   6. That's why the IIA updated it in 2020 into a 'three lines model' with less rigid boundaries and more emphasis on governance and alignment. Knowing the model has been revised, and why, is usually more than the interviewer expects.

   Where candidates lose it

   Reciting the three lines without saying the first line owns the risk. That single point is what the question is testing. And if you can name a real ambiguity, like where model validation sits, you show you've seen the model collide with an actual org chart.

   Expect next

   • Where does model validation sit?
   • What's the main criticism of the model?
   • Who does the CRO report to, and why does it matter?
2. 047What is model risk?Model risk and validationIntermediatetechnicalUBSRisk Management · Zurich · 2021

   Say this

   Model risk is the risk of loss from using a model that's wrong, or from using a right model in the wrong place. Two sources, and the second is the bigger one in practice: fundamental errors in the model itself, and correct models applied outside the conditions they were built for.

   Then walk it

   1. The US Federal Reserve's SR 11-7 definition is the one to quote, because it splits it exactly that way: errors in design, and incorrect or inappropriate use.
   2. The error side includes bad theory, bad data, coding bugs and bad calibration. It's the side people think of and it's the side validation catches most easily.
   3. The misuse side is the one that hurts. A model calibrated on investment grade credit applied to high yield. A pricing model used for risk. A VaR model built for a linear book applied once options were added. Nothing is wrong with the model; the use is wrong.
   4. It compounds through the chain. Models feed models: a PD model feeds ECL, which feeds capital planning, which feeds the dividend decision. An error at the bottom is unrecognisable four steps up, which is why model inventories and dependency maps exist.
   5. Real examples worth naming: the Gaussian copula in structured credit, where the model was fine and the correlation assumption was not. The 2012 JPMorgan CIO losses, where a spreadsheet error and a newly approved VaR model both featured. Long-Term Capital Management, where the model was right about relationships and wrong about liquidity and leverage.
   6. How you manage it: an inventory of every model with a tier, independent validation proportionate to that tier, ongoing performance monitoring, documented limitations, and an owner. And the control that matters most is the simplest, writing down what the model may not be used for.
   7. The limitation to volunteer: you can't eliminate model risk, only bound it. The mitigant with the best return is not more validation, it's a stated range of applicability and a human who understands the model sitting between it and a decision.

   Where candidates lose it

   Defining it as 'the model being wrong'. That's half of it, and the smaller half. The answer that lands names misuse of a correct model as the larger source, and gives a concrete case. If you can cite SR 11-7, do, because it signals you've worked near a validation function.

   Expect next

   • Give me an example of a correct model used wrongly.
   • How would you tier a model inventory?
   • Can you eliminate model risk?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

3. 049What's the difference between backtesting and benchmarking a model?Model risk and validationIntermediatetechnicalModel validationBank market risk

   Say this

   Backtesting compares the model to reality. Benchmarking compares it to another model. One tells you whether you're right, the other tells you whether you're different, and you need benchmarking precisely when reality doesn't give you enough observations to backtest.

   Then walk it

   1. Backtesting is the gold standard because the comparator is truth: forecast versus realised outcome. VaR exceptions against actual P&L, predicted default rates against observed defaults, predicted prepayment against actual.
   2. Its constraint is data. At 99% confidence you get about 2.5 exceptions a year, so a year of data can't distinguish a good model from a mediocre one. For a low-default portfolio, sovereigns or large corporates, you might have zero defaults in a decade, so backtesting is simply unavailable.
   3. Benchmarking fills that gap. Run a challenger model, a vendor model, or a simple closed-form approximation on the same portfolio and compare. Large unexplained divergence is a finding even if you can't say which one is right.
   4. It's also how you test parts of a model you can't observe. You can't observe a 20-year lifetime PD, but you can compare your curve to an agency cumulative default table or to CDS-implied hazard rates.
   5. The important limitation: benchmarking two models that share an assumption tells you nothing. If both assume a normal distribution, they'll agree and both be wrong. The benchmark has to be structurally different to be informative, and that's the part people get wrong.
   6. So they answer different questions. Backtesting: is the model calibrated? Benchmarking: is the model an outlier, and can I explain why? A full validation uses both plus sensitivity analysis, and leans on benchmarking exactly where data is thin.
   7. Practical example: for a low-default corporate portfolio, you'd benchmark the PD model against external ratings and market-implied PDs, use a binomial or Vasicek test for the little default data you have, and lean on the qualitative review. That combination is what a supervisor expects to see.

   Where candidates lose it

   Using the words interchangeably. And missing the key insight that benchmarking is only informative if the benchmark makes different assumptions. Two models with the same flawed assumption will agree beautifully, and a candidate who says that has thought about validation rather than memorised a checklist.

   Expect next

   • How would you validate a PD model for a portfolio with no defaults?
   • What makes a good benchmark model?
   • Your model and the benchmark differ by 40 percent. Now what?
4. 050Explain what a Kalman filter is.Model risk and validationHardtechnicalUBSRisk · London · 2022

   Say this

   It's a recursive estimator for a hidden state you can only observe with noise. Each period you predict the state forward with your model, then correct that prediction with the new observation, weighting the two by how much you trust each. Under linear-Gaussian assumptions it's the optimal estimator.

   Then walk it

   1. Two equations. A state equation for how the unobserved thing evolves, and a measurement equation linking the state to what you actually see, each with its own noise.
   2. Two steps per period. Predict: roll the state and its uncertainty forward. Update: compute the surprise, the difference between the observation and what you expected, and move your estimate toward it by the Kalman gain.
   3. The gain is the whole intuition. If measurement noise is large relative to state uncertainty, the gain is small and you mostly trust your model. If your state uncertainty is large, the gain is large and you mostly trust the new data. It's Bayesian updating with the arithmetic done for you.
   4. Where it's used in finance: extracting a time-varying beta or hedge ratio, estimating a stochastic volatility or unobserved factor, filtering a fair-value or pairs-trading spread, term structure models where the factors are latent, and nowcasting a macro variable from noisy high-frequency data.
   5. Why a risk function cares: it gives you an estimate that adapts without the jumpiness of a rolling window. A 60-day rolling beta lurches when an old observation drops out; a Kalman-filtered beta moves smoothly and quantifies its own uncertainty.
   6. The assumptions and their cost: linear dynamics and Gaussian noise. For non-linear problems you need the extended or unscented variants or a particle filter. And you have to specify the two noise covariances, which are rarely known, so in practice you estimate them by maximum likelihood and the result is sensitive to them.
   7. The limitation to volunteer: it's optimal given the model, and it has no way to tell you the state equation is wrong. Feed it a misspecified process and it will produce confident, smooth, wrong estimates, which is a particularly dangerous failure mode.

   Where candidates lose it

   Reciting matrix equations. Nobody wants the algebra; they want the predict-then-correct intuition, the gain as a trust weighting, and one concrete financial use. If you can't name a use case, the answer reads as memorised from a signal-processing course.

   Expect next

   • How would you use it to estimate a time-varying hedge ratio?
   • What happens if the noise covariances are misspecified?
   • How does it compare to a simple exponentially weighted estimate?

   Reported by candidates at UBS (Risk, London, 2022). Source: Wall Street Oasis.

5. 052How do you detect overfitting in a risk model?Model risk and validationIntermediatetechnicalModel validationBuy-side risk

   Say this

   The signature is a large gap between in-sample and out-of-sample performance, and for financial models specifically between in-sample and out-of-time. If accuracy collapses on data from a later period, you've fitted the era, not the relationship.

   Then walk it

   1. Standard test: hold out data, or cross-validate. But for time series you need forward-chaining rather than random k-fold, because random folds leak the future into the training set and make everything look good.
   2. The financial-specific test is out of time. Fit on 2015 to 2019, test on 2021 to 2023. Random splits from the same period share the same regime, so they flatter the model badly.
   3. Structural warning signs: parameter count relative to observations, coefficients with implausible signs or magnitudes, a variable that only works in one sub-period, and results that change materially when you drop a single year.
   4. For strategy or signal work, the killer is multiple-testing bias. If you tried 500 specifications, the best one will look great by construction. The deflated Sharpe ratio and the idea of testing on a truly held-out period exist precisely for that.
   5. Stability diagnostics: rolling-window coefficient estimates. A genuine relationship has coefficients that wobble; an overfitted one has coefficients that flip sign. And bootstrap the performance metric to see how wide the confidence interval actually is.
   6. The cultural control, which matters more than any statistic: limit how many times you look at the holdout. Every peek at the test set converts it into training data, and in practice that's how overfitting enters a model that passed every formal test.
   7. And the counterweight to state: underfitting is also a failure, and a heavily constrained model that misses real non-linearity costs money too. The judgement is whether added complexity buys performance that survives out of time.

   Where candidates lose it

   Naming cross-validation and stopping. For financial models, random cross-validation is itself a source of false confidence because of regime and look-ahead leakage. Out-of-time testing and multiple-testing bias are the two points that show you've done this on real data.

   Expect next

   • Why is random k-fold cross-validation dangerous for time series?
   • How would you account for having tried 200 specifications?
   • How would you tell overfitting apart from a regime change?
6. 053Give me Basel III in one minute.Regulatory capitalCorephone / first roundRegulatory reportingIndian bank risk and treasury

   Say this

   Basel III was the post-2008 response, and it did three things the earlier accords didn't: it raised the quality and quantity of capital, it added a leverage ratio as a non-risk-based backstop, and it introduced liquidity standards for the first time.

   Then walk it

   1. Capital quality: the focus moved to common equity Tier 1, real loss-absorbing equity. Minimum CET1 of 4.5 percent of RWAs, Tier 1 of 6, total capital of 8, plus a 2.5 percent capital conservation buffer, so a functioning bank runs at 7 percent CET1 minimum before any add-ons.
   2. Buffers on top: a countercyclical buffer of zero to 2.5 percent that supervisors raise in a boom, and a surcharge for global and domestic systemically important banks. Breaching the buffers doesn't close the bank, it restricts dividends and bonuses, which is the point.
   3. Leverage ratio: Tier 1 over total unweighted exposure, minimum 3 percent. It exists because risk weights were gamed before 2008 and banks ran 50-to-1 leverage with beautiful risk-based ratios.
   4. Liquidity, entirely new in Basel III. LCR requires 30 days of high quality liquid assets against stressed outflows. NSFR requires stable funding against illiquid assets over a year. Northern Rock was solvent, so capital rules alone were never going to be enough.
   5. Plus counterparty reforms: a CVA capital charge, higher standards for exposure modelling, and incentives to clear centrally.
   6. The Indian version: RBI applies CET1 of 5.5 percent rather than 4.5, plus a 2.5 percent conservation buffer, so minimum CRAR is 11.5 percent against Basel's 10.5. India has been consistently more conservative on the capital ratio and slower on some of the market risk pieces.
   7. The fair criticism to volunteer: complexity. The framework is thousands of pages, RWA calculations are barely comparable across banks, and that opacity is exactly what the leverage ratio and the Basel IV output floor were added to contain.

   Where candidates lose it

   Listing ratios without the three themes. What an interviewer wants is capital quality, a non-risk-based backstop, and liquidity standards. And know the Indian numbers if you're interviewing in India, because CRAR of 11.5 percent versus 10.5 is a detail that immediately places you.

   Expect next

   • Why add a leverage ratio if you already have risk weights?
   • What happens if a bank dips into its conservation buffer?
   • How does RBI's implementation differ?
7. 054What is CET1, and what qualifies as CET1 capital?Regulatory capitalCoretechnicalRegulatory reportingIndian bank risk and treasury

   Say this

   Common equity Tier 1 is the purest loss-absorbing capital: ordinary shares, share premium, retained earnings and disclosed reserves, minus a set of regulatory deductions. It's the numerator regulators actually care about, because it absorbs losses while the bank is still trading.

   Then walk it

   1. What's in it: paid-up ordinary share capital, share premium, retained earnings, accumulated other comprehensive income, and statutory reserves. Minority interests only in limited circumstances.
   2. The deductions are where the real work is: goodwill and other intangibles, deferred tax assets arising from losses, defined benefit pension surpluses, own shares held, significant investments in other financial institutions above thresholds, and the IRB shortfall of provisions against Basel expected loss.
   3. Why deductions matter so much: goodwill has no value in a liquidation, and a DTA from past losses is only worth something if you're profitable, which you aren't in the scenario the capital is for. So both get removed.
   4. The tiers above it: Additional Tier 1, which is perpetual and loss-absorbing through conversion or write-down, typically AT1 contingent convertibles that trigger when CET1 falls below 5.125 or 7 percent. Then Tier 2, mostly dated subordinated debt, which only absorbs loss in a gone-concern.
   5. That distinction between going-concern and gone-concern capital is the whole logic of the tiering, and it's the sentence that shows you understand it rather than having memorised a list.
   6. The 2023 reality check: Credit Suisse's AT1 was written down in full while shareholders received value in the UBS transaction. That inverted the expected hierarchy and repriced the whole AT1 market, and it's a live example of how gone-concern capital behaves under political pressure.
   7. Indian specifics: RBI requires CET1 of 5.5 percent, and Indian public sector banks have historically carried large DTAs and government recapitalisation bonds, so the deduction rules have a bigger effect on reported CET1 there than the headline ratio suggests.

   Where candidates lose it

   Listing what's included and skipping the deductions. The deductions are where CET1 differs from book equity, and goodwill plus DTA are the two that matter most. The answer that stands out explains going-concern versus gone-concern capital as the reason for the tiering.

   Expect next

   • Why is goodwill deducted?
   • What is an AT1 CoCo and when does it convert?
   • What did the Credit Suisse AT1 write-down change?
8. 055What are risk-weighted assets, and how are they computed?Regulatory capitalCoretechnicalRegulatory reportingBank credit risk

   Say this

   RWAs are the denominator of the capital ratio: exposures scaled by how risky they are. You compute them separately for credit, market and operational risk and add them up. A sovereign bond might carry a zero weight and an unsecured corporate loan 100 percent, so the same balance sheet size can imply very different capital.

   Then walk it

   1. Credit risk RWA, standardised approach: exposure times a prescribed weight by counterparty type and rating. Cash and most domestic sovereign zero, banks 20 to 100 depending on rating, residential mortgages 35 or lower under the revised rules, unrated corporates 100, and some specialised lending at 150.
   2. Credit risk RWA, internal ratings based: you feed your own PD, LGD and EAD into the Basel formula, which computes a 99.9 percent one-year unexpected loss and multiplies by 12.5. Same idea, but the weight is derived from your models rather than a table.
   3. Market risk RWA covers the trading book, now under FRTB with a sensitivities-based standardised approach or an internal models approach built on expected shortfall.
   4. Operational risk RWA under the standardised measurement approach: a Business Indicator Component from income and balance sheet size, scaled by an internal loss multiplier from your own ten-year loss history.
   5. Then the capital ratio is CET1 divided by total RWA. So there are two ways to improve it: raise capital or shrink RWA. RWA optimisation, shifting to lower-weighted assets, buying protection, improving collateral documentation, is a whole industry and a legitimate one within limits.
   6. The criticism: RWA density varies enormously across banks with similar books, largely because of IRB model differences. A European bank might run RWAs at 30 percent of total assets and a US bank at 60 for comparable risk. That comparability failure is why Basel IV added an output floor.
   7. Rough feel for scale: for a typical commercial bank, total RWA runs 50 to 70 percent of total assets, with credit risk 80 to 90 percent of the RWA total. Market risk is usually small unless there's a real trading book.

   Where candidates lose it

   Explaining the weights and never mentioning that banks can and do manage RWA down. An interviewer wants to hear both that RWA optimisation is a real activity and that its abuse is why the output floor exists. Also know the rough RWA-to-assets ratio, because it makes the number concrete.

   Expect next

   • How would a bank legitimately reduce its RWAs?
   • Why do RWA densities differ so much between banks?
   • What proportion of RWAs is credit risk for a typical bank?
9. 056Standardised versus internal ratings based approach. Which would you rather run?Regulatory capitalIntermediatetechnicalRegulatory reportingBank credit risk

   Say this

   IRB usually gives lower capital and better risk sensitivity, so a large bank wants it. But it costs a great deal to build, maintain and defend, and after the Basel IV output floor the capital saving is capped, so for many portfolios the honest answer is now standardised.

   Then walk it

   1. Standardised: prescribed risk weights by exposure class and external rating. Cheap, comparable across banks, transparent, and completely insensitive to whether your borrowers are good or bad within a bucket. Every unrated corporate gets 100 percent whether it's excellent or nearly insolvent.
   2. Foundation IRB: you estimate PD, the supervisor sets LGD and EAD. Advanced IRB: you estimate all three. Both need supervisory approval, years of clean data, validated models and demonstrated use in actual credit decisions, the use test.
   3. The capital saving is real, often 20 to 40 percent lower RWA on a good-quality retail or mortgage book, because the prescribed weights are calibrated conservatively for the average bank.
   4. The costs: model development and validation teams, data infrastructure with long histories, annual supervisory review, and the risk that a supervisor imposes a multiplier or pulls approval, which produces a sudden capital hit. Several European banks have taken exactly that.
   5. Then Basel IV changes the calculus. The output floor requires total RWA to be at least 72.5 percent of what the standardised approach would give, phased in. Advanced IRB has been removed for exposures to large corporates and banks, and equity IRB is gone. So the saving is bounded and the cheapest portfolios to model no longer qualify.
   6. My answer: IRB where the portfolio is large, homogeneous, data-rich and where internal models genuinely discriminate, so retail mortgages and retail lending. Standardised for low-default wholesale portfolios where you were never going to estimate PD credibly anyway. Running IRB for its own sake is a large cost for capped benefit.
   7. The point worth making that goes beyond capital: the real value of IRB was never the capital saving, it was that building the models forces a bank to understand its own credit risk. Banks that adopted IRB seriously ended up with better credit decisions, and that survives the output floor.

   Where candidates lose it

   Answering 'IRB because it's lower capital'. Post-Basel IV that's only partly true, and a candidate who hasn't registered the output floor and the withdrawal of advanced IRB for large corporates is working from pre-2017 knowledge. Mention the use test too; supervisors care more about it than about the maths.

   Expect next

   • What is the use test?
   • Which portfolios can no longer use advanced IRB?
   • What happens if a supervisor withdraws IRB permission?
10. 057What is Basel IV, and what changed for market risk?Regulatory capitalHardsuperdayRegulatory reportingBank market risk

    Say this

    Basel IV, formally the finalisation of Basel III, is about comparability rather than more capital. The headline is the 72.5 percent output floor on internally modelled RWA. For market risk it's FRTB, which replaced VaR with expected shortfall and drew a much harder line between trading and banking book.

    Then walk it

    1. The output floor: total RWA can't fall below 72.5 percent of the standardised calculation, phased in over several years. It caps the benefit of internal models and restores comparability between banks, which was the central complaint after 2008.
    2. Credit risk: advanced IRB removed for large corporates and financial institutions, IRB removed for equities, input floors on PD and LGD, and a more granular standardised approach with real loan-to-value sensitivity on mortgages.
    3. Operational risk: internal models abolished entirely, replaced by the standardised measurement approach driven by business indicators and your own loss history.
    4. FRTB for market risk, and the four things that changed. Expected shortfall at 97.5 percent replaces 99 percent VaR, so tail depth is captured. Liquidity horizons vary by risk factor from 10 to 120 days, so illiquid risk costs more capital.
    5. Third, non-modellable risk factors. If a factor lacks enough real price observations, you can't model it and it attracts a stress-based add-on. That was a large and unwelcome surprise for exotic and emerging market desks.
    6. Fourth, the trading and banking book boundary became prescriptive with restrictions on reclassification, ending the pre-crisis practice of moving positions to whichever book carried less capital. And the internal models approval is now at desk level with P&L attribution tests, so one desk can fail and lose modelled treatment while others keep it.
    7. Implementation dates have slipped repeatedly and differ by jurisdiction, with the US, UK and EU all on different timelines and different versions, especially for FRTB internal models. That fragmentation is itself a live commercial issue for global banks.
    8. The fair criticism: the aggregate capital impact is modest but very unevenly distributed, falling hardest on European banks with big IRB books and on trading desks in illiquid products. And the complexity it adds runs against the original goal of simplicity.

    Where candidates lose it

    Treating Basel IV as just higher capital requirements. The theme is comparability and constraining internal models, not level. And for market risk you need FRTB's specifics: expected shortfall, liquidity horizons, non-modellable risk factors and the desk-level P&L attribution test. Naming only the first shows shallow reading.

    Expect next

    • Why did FRTB move to expected shortfall?
    • What is a non-modellable risk factor and what does it cost?
    • What happens when a desk fails P&L attribution?

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.