Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 041Why does a central counterparty reduce risk, and what new risk does it create?Counterparty risk and CVAIntermediatetechnicalClearing and marginBank credit risk

   Say this

   A CCP replaces a web of bilateral exposures with a hub and spoke, so it multilaterally nets, standardises margin and mutualises losses. In exchange you've created a single point of failure and turned counterparty risk into liquidity risk for every member.

   Then walk it

   1. Multilateral netting is the big win. If A owes B, B owes C and C owes A, bilaterally there are three exposures; through a CCP there's almost nothing. G20 reform after 2008 pushed standardised OTC derivatives to clearing for exactly this reason.
   2. It also standardises: daily variation margin, initial margin on a model everyone can see, a default fund, and a documented waterfall. That removes the dispute and delay problem that made Lehman's unwinding so slow.
   3. The default waterfall in order: the defaulter's margin, the defaulter's default fund contribution, the CCP's own skin in the game, then the surviving members' default fund, then assessments or variation margin gains haircutting. Being able to recite that is what a clearing risk interviewer wants.
   4. New risk one, concentration. The CCP is systemically critical infrastructure. If it fails, everything fails, and it has no meaningful equity relative to the exposures it faces.
   5. New risk two, mutualisation. As a clearing member you are exposed to other members' defaults through the default fund. You've swapped a known bilateral counterparty for an unknown pool of them.
   6. New risk three, procyclical margin. Margin models raise requirements when volatility rises, so the CCP demands the most cash exactly when cash is scarcest. That's a liquidity amplifier, and it's what the 2020 and 2022 episodes were about.
   7. New risk four, the member-client link. If you clear for clients, you stand between them and the CCP, so you have to fund their margin calls intraday. The LME nickel episode in 2022 showed that a CCP can also change the rules under stress, which is a governance risk you can't model.
   8. So the honest summary: clearing has reduced credit risk and increased liquidity risk, and it has concentrated tail risk into a small number of institutions. Better on balance, not free.

   Where candidates lose it

   Listing the benefits and stopping at 'it's safer'. The interviewer wants the default waterfall and at least two created risks, with procyclical margin the most important. And you should say that clearing trades credit risk for liquidity risk rather than eliminating risk.

   Expect next

   • Walk me through the default waterfall.
   • How would you stress test your exposure to a CCP?
   • Is procyclical initial margin fixable?
2. 042What is operational risk, and what are the Basel event categories?Operational riskCorephone / first roundOperational riskGlobal capability centres

   Say this

   Basel defines it as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It explicitly includes legal risk and excludes strategic and reputational risk. Seven event categories, and the money is concentrated in two of them.

   Then walk it

   1. The seven Level 1 categories: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management.
   2. The distribution is extremely skewed. Clients, products and business practices is where the enormous losses sit, because that's mis-selling, market manipulation and conduct fines. Execution and process management is where the high-frequency, low-severity losses sit.
   3. That skew shapes the whole discipline. You need two lenses: a frequency lens for process errors, which you fix with controls and automation, and a severity lens for tail conduct events, which you manage through governance and culture rather than through controls.
   4. The measurement toolkit: internal loss data, external loss data for events you haven't had, scenario analysis for the tail, RCSAs for the forward-looking control view, and KRIs for early warning. Those five are the standard op risk framework and you should be able to name all five.
   5. Capital: Basel III's Standardised Measurement Approach replaced the old internal models. It's a Business Indicator Component scaled by a marginal coefficient, then multiplied by an Internal Loss Multiplier based on your ten-year average loss history. So your own losses now drive your capital, which is the incentive it was designed to create.
   6. The honest difficulty: operational risk loss data is sparse and non-stationary. Ten years of history contains very few tail events, and the risks that matter now, cyber and third-party concentration, barely appear in it. So scenario analysis carries weight that the maths can't support, and that's a judgement-heavy exercise.

   Where candidates lose it

   Reducing operational risk to fraud and system failure. The largest losses in banking history in this category are conduct and mis-selling, not rogue traders or outages. Naming 'clients, products and business practices' as the big-money bucket immediately shows you've looked at the loss data.

   Expect next

   • Which category holds the biggest losses historically?
   • How is operational risk capital calculated now?
   • Where does cyber risk fit in that taxonomy?
3. 043What is an RCSA, and how would you actually run one?Operational riskIntermediatetechnicalOperational riskGlobal capability centres

   Say this

   A risk and control self-assessment is the business identifying its own risks, rating them before and after controls, and owning the gap. Run badly it's a spreadsheet nobody reads. Run well it's the only forward-looking view of operational risk you have.

   Then walk it

   1. Start from processes, not from a risk list. Map the end-to-end process, find the failure points, and derive risks from those. Starting from a generic taxonomy produces generic risks that nobody recognises as theirs.
   2. For each risk, rate inherent likelihood and impact, then identify the controls, test whether they actually work, and rate residual risk. The distinction between design effectiveness and operating effectiveness matters: a beautifully designed control that is performed late every month is not effective.
   3. Then compare residual risk to appetite. Anything above appetite needs an action with an owner and a date, or a formal risk acceptance signed at the right level. That is the actual output; the ratings are just how you get there.
   4. Who does it: the first line owns it, the second line facilitates and challenges. If risk management fills in the RCSA, the business hasn't assessed anything and you've built a document rather than a control.
   5. Where it fails, and I'd say this without prompting. Everything gets rated amber, because nobody wants to own a red. Ratings never change year to year. The workshop runs after a fine rather than before. And it never reconciles against actual loss events, so a process with twelve losses last year is rated low risk.
   6. So the tests I'd apply to an RCSA: does it reconcile to the loss database, does it reconcile to audit findings, has anything moved since last year, and can a process owner explain their own top risk without reading the sheet.
   7. Practical numbers: for a mid-sized operation, expect 15 to 40 risks per process area. Hundreds means it's a control inventory dressed up as a risk assessment, and nobody will use it.

   Where candidates lose it

   Describing the template instead of the process. Two things separate a real answer: saying the first line must own it with the second line challenging, and naming the amber-everywhere failure mode. And reconciling the RCSA against actual loss data is the check almost no candidate mentions.

   Expect next

   • Who should own the RCSA?
   • How do you stop everything being rated amber?
   • How does the RCSA connect to your loss data?
4. 044Design three key risk indicators for a payments operation, and tell me what makes a KRI good.Operational riskIntermediatetechnicalOperational riskGlobal capability centres

   Say this

   A good KRI is leading, measurable without manual effort, and has a threshold that triggers a specific action. For payments I'd use the unreconciled item count and ageing, the manual intervention rate on straight-through processing, and the failed or returned payment rate by corridor.

   Then walk it

   1. Unreconciled items over two days old, by value and count. It's leading, because loss events start as breaks nobody chased, and it's cheap to produce from the reconciliation system.
   2. Manual touch rate on payments that should be straight-through. Every manual touch is a keystroke error waiting to happen, so this is a direct proxy for the frequency of process losses. A rise from 2 to 6 percent is a red flag before any loss appears.
   3. Failed and returned payment rate, split by corridor and by cause. It picks up upstream data quality problems, sanctions-screening false positives and correspondent bank issues, each of which needs a different fix.
   4. What makes a KRI good: leading not lagging, objectively measurable from a system rather than from a survey, sensitive enough that it actually moves, owned by someone with the authority to act, and attached to an amber and red threshold with a pre-agreed response.
   5. What makes a bad one: loss count, which is lagging and tells you the failure already happened. Headcount, which is context rather than risk. Anything requiring a manual monthly collection, because it degrades into a copy-paste exercise.
   6. Thresholds should be calibrated off the historical distribution, not picked round. Amber at roughly the 90th percentile of the last two years, red at the 99th, then reviewed annually. And each threshold needs a named action, or breaching it changes nothing.
   7. The failure mode to name: KRI inflation. A dashboard with 120 indicators gets ignored. Eight to twelve real ones per business, reviewed monthly by someone who can act, beats a hundred reported to nobody.

   Where candidates lose it

   Proposing lagging indicators. Loss count, number of incidents and audit findings are all after the fact, and they are what most candidates offer. A KRI is supposed to give you time to act, so lead with something that moves before the loss, and attach a threshold and an action to each.

   Expect next

   • How would you calibrate the thresholds?
   • What do you do when a KRI turns red?
   • Give me a KRI for cyber risk.
5. 045Explain the three lines of defence.Operational riskCorephone / first roundOperational riskGlobal capability centres

   Say this

   First line is the business, which owns and manages the risk it takes. Second line is risk and compliance, which sets the framework, sets limits and independently challenges. Third line is internal audit, which gives the board assurance that the first two are working.

   Then walk it

   1. The first line's ownership is the part that's usually wrong in practice. The trader owns the market risk, the lending officer owns the credit decision, the operations head owns the process risk. If the business thinks risk management owns risk, the model has already failed.
   2. Second line has two jobs that sit in tension: it advises the business and it challenges the business. That's why independence matters, and why the CRO reports to the board risk committee and not just to the CEO.
   3. Third line is independent of both and reports to the audit committee. It does not run controls, it tests whether they exist and work. Audit sitting in management meetings designing controls destroys its own assurance value.
   4. The interesting judgement calls: where does a desk-embedded risk analyst sit? Where does model validation sit relative to model development? Where does finance sit? Getting those boundaries wrong is how conflicts creep in.
   5. The standard criticisms, worth volunteering. It creates a compliance mindset where the first line assumes the second line will catch things. Responsibilities blur in the middle. And it can become three layers of reporting rather than three layers of control.
   6. That's why the IIA updated it in 2020 into a 'three lines model' with less rigid boundaries and more emphasis on governance and alignment. Knowing the model has been revised, and why, is usually more than the interviewer expects.

   Where candidates lose it

   Reciting the three lines without saying the first line owns the risk. That single point is what the question is testing. And if you can name a real ambiguity, like where model validation sits, you show you've seen the model collide with an actual org chart.

   Expect next

   • Where does model validation sit?
   • What's the main criticism of the model?
   • Who does the CRO report to, and why does it matter?
6. 046A trader has breached his VaR limit three times this month, and each time got approval after the fact. What do you do?Operational riskHardsuperdayOperational riskBank market risk

   Say this

   Three retrospective approvals isn't a limit breach problem, it's a control failure. The limit has effectively been replaced by a negotiation. I'd document the pattern, escalate it as a governance issue rather than three separate incidents, and force a decision: either the limit is wrong or the behaviour is.

   Then walk it

   1. First establish the facts precisely: what the limit is, the size and duration of each breach, who approved each one, whether the approver had authority, and whether the approvals were documented at the time or reconstructed afterwards. That last detail changes the nature of the issue completely.
   2. Then separate the two possible root causes. Either the limit is miscalibrated for a legitimate business, in which case the fix is a properly approved limit increase through the right committee. Or the trader is running more risk than the firm sanctioned, in which case it's a discipline matter.
   3. The crucial reframing: three ad hoc approvals in a month means the limit is no longer a control. A pre-approved excess is a limit; a post-approved excess is an apology. Say that sentence in the interview, because it's the point of the question.
   4. Escalation route: my head of risk and the market risk committee, not a quiet conversation with the desk head who has been signing the approvals. The approver is part of what needs reviewing, so escalating to them alone is the mistake.
   5. Then the pattern question. Look for other symptoms: end-of-day position reductions that reverse the next morning, P&L volatility inconsistent with reported risk, stale or hard-to-verify marks on illiquid positions. Limit breaches with cooperative approvals are a classic precursor, and every large rogue trading loss has this shape in hindsight.
   6. Consequences and record. In a bank this is reportable to the risk committee, it should appear in the operational risk event log, and it belongs in the trader's performance file. If nothing happens, the next breach is certain.
   7. And the systemic fix: hard-coded pre-trade blocks rather than post-trade reporting, a rule that excesses need pre-approval at a level above the desk, and an automatic escalation after a second breach in a rolling period.

   Where candidates lose it

   Treating it as three separate breaches to be logged. It's one control failure, and the interviewer is testing whether you'll escalate past the person who authorised it. The other failure is going straight to a disciplinary framing without checking whether the limit is simply miscalibrated for a legitimate business.

   Expect next

   • What if the approver is the head of the desk and outranks your boss?
   • What other red flags would you look for?
   • How would you redesign the limit framework so this can't happen?
7. 047What is model risk?Model risk and validationIntermediatetechnicalUBSRisk Management · Zurich · 2021

   Say this

   Model risk is the risk of loss from using a model that's wrong, or from using a right model in the wrong place. Two sources, and the second is the bigger one in practice: fundamental errors in the model itself, and correct models applied outside the conditions they were built for.

   Then walk it

   1. The US Federal Reserve's SR 11-7 definition is the one to quote, because it splits it exactly that way: errors in design, and incorrect or inappropriate use.
   2. The error side includes bad theory, bad data, coding bugs and bad calibration. It's the side people think of and it's the side validation catches most easily.
   3. The misuse side is the one that hurts. A model calibrated on investment grade credit applied to high yield. A pricing model used for risk. A VaR model built for a linear book applied once options were added. Nothing is wrong with the model; the use is wrong.
   4. It compounds through the chain. Models feed models: a PD model feeds ECL, which feeds capital planning, which feeds the dividend decision. An error at the bottom is unrecognisable four steps up, which is why model inventories and dependency maps exist.
   5. Real examples worth naming: the Gaussian copula in structured credit, where the model was fine and the correlation assumption was not. The 2012 JPMorgan CIO losses, where a spreadsheet error and a newly approved VaR model both featured. Long-Term Capital Management, where the model was right about relationships and wrong about liquidity and leverage.
   6. How you manage it: an inventory of every model with a tier, independent validation proportionate to that tier, ongoing performance monitoring, documented limitations, and an owner. And the control that matters most is the simplest, writing down what the model may not be used for.
   7. The limitation to volunteer: you can't eliminate model risk, only bound it. The mitigant with the best return is not more validation, it's a stated range of applicability and a human who understands the model sitting between it and a decision.

   Where candidates lose it

   Defining it as 'the model being wrong'. That's half of it, and the smaller half. The answer that lands names misuse of a correct model as the larger source, and gives a concrete case. If you can cite SR 11-7, do, because it signals you've worked near a validation function.

   Expect next

   • Give me an example of a correct model used wrongly.
   • How would you tier a model inventory?
   • Can you eliminate model risk?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

8. 048How would you validate a model?Model risk and validationIntermediatetechnicalModel validationGlobal capability centres

   Say this

   Three pillars: conceptual soundness, outcomes analysis and ongoing monitoring. So does the theory make sense for this use, does it perform against reality, and will you know when it stops working. And it has to be done by someone independent of whoever built it.

   Then walk it

   1. Conceptual soundness first, and it's the part that gets skipped. Read the documentation, check the theory is appropriate for the intended use, check the assumptions are stated and reasonable, and review the data: source, quality, representativeness, and whether the development sample looks like today's population.
   2. Then replicate. Independently rebuild at least the core of it from the documentation. If you can't reproduce the results from the document, the documentation fails, and that's a finding in itself.
   3. Outcomes analysis: backtesting against realised outcomes, benchmarking against an alternative model or a simpler challenger, and sensitivity analysis to see which inputs the output actually depends on. Stress the inputs to the edge of plausibility and see if it breaks gracefully or catastrophically.
   4. Then the boundary work: what is this model not valid for. A validated model with no stated limitations is a hazard, because the next user will apply it to something new and assume it's approved.
   5. Ongoing monitoring: performance thresholds, population stability, and a revalidation cycle tiered by materiality. Tier 1 models annually, lower tiers less often, and any material change triggers a revalidation regardless of the cycle.
   6. Governance: findings rated by severity, owners and deadlines, and a model approval that can be conditional or refused. A validation function that has never refused an approval isn't independent, and that's the question I'd ask about any validation team I joined.
   7. Sizing it honestly: full validation of a Tier 1 pricing model is weeks of work for two people. Proportionality is the whole design problem, because validating everything to the same depth means validating nothing well.

   Where candidates lose it

   Going straight to backtesting. Backtesting is one third of it and it's the third that needs data you often don't have. Conceptual soundness and the explicit statement of limitations are what prevent the misuse that causes most model losses. And say the word independent, because organisational independence is the first thing a supervisor checks.

   Expect next

   • What would you do if you couldn't backtest because there was no data?
   • How do you validate a vendor model you can't see inside?
   • How would you tier models for validation intensity?
9. 049What's the difference between backtesting and benchmarking a model?Model risk and validationIntermediatetechnicalModel validationBank market risk

   Say this

   Backtesting compares the model to reality. Benchmarking compares it to another model. One tells you whether you're right, the other tells you whether you're different, and you need benchmarking precisely when reality doesn't give you enough observations to backtest.

   Then walk it

   1. Backtesting is the gold standard because the comparator is truth: forecast versus realised outcome. VaR exceptions against actual P&L, predicted default rates against observed defaults, predicted prepayment against actual.
   2. Its constraint is data. At 99% confidence you get about 2.5 exceptions a year, so a year of data can't distinguish a good model from a mediocre one. For a low-default portfolio, sovereigns or large corporates, you might have zero defaults in a decade, so backtesting is simply unavailable.
   3. Benchmarking fills that gap. Run a challenger model, a vendor model, or a simple closed-form approximation on the same portfolio and compare. Large unexplained divergence is a finding even if you can't say which one is right.
   4. It's also how you test parts of a model you can't observe. You can't observe a 20-year lifetime PD, but you can compare your curve to an agency cumulative default table or to CDS-implied hazard rates.
   5. The important limitation: benchmarking two models that share an assumption tells you nothing. If both assume a normal distribution, they'll agree and both be wrong. The benchmark has to be structurally different to be informative, and that's the part people get wrong.
   6. So they answer different questions. Backtesting: is the model calibrated? Benchmarking: is the model an outlier, and can I explain why? A full validation uses both plus sensitivity analysis, and leans on benchmarking exactly where data is thin.
   7. Practical example: for a low-default corporate portfolio, you'd benchmark the PD model against external ratings and market-implied PDs, use a binomial or Vasicek test for the little default data you have, and lean on the qualitative review. That combination is what a supervisor expects to see.

   Where candidates lose it

   Using the words interchangeably. And missing the key insight that benchmarking is only informative if the benchmark makes different assumptions. Two models with the same flawed assumption will agree beautifully, and a candidate who says that has thought about validation rather than memorised a checklist.

   Expect next

   • How would you validate a PD model for a portfolio with no defaults?
   • What makes a good benchmark model?
   • Your model and the benchmark differ by 40 percent. Now what?
10. 050Explain what a Kalman filter is.Model risk and validationHardtechnicalUBSRisk · London · 2022

    Say this

    It's a recursive estimator for a hidden state you can only observe with noise. Each period you predict the state forward with your model, then correct that prediction with the new observation, weighting the two by how much you trust each. Under linear-Gaussian assumptions it's the optimal estimator.

    Then walk it

    1. Two equations. A state equation for how the unobserved thing evolves, and a measurement equation linking the state to what you actually see, each with its own noise.
    2. Two steps per period. Predict: roll the state and its uncertainty forward. Update: compute the surprise, the difference between the observation and what you expected, and move your estimate toward it by the Kalman gain.
    3. The gain is the whole intuition. If measurement noise is large relative to state uncertainty, the gain is small and you mostly trust your model. If your state uncertainty is large, the gain is large and you mostly trust the new data. It's Bayesian updating with the arithmetic done for you.
    4. Where it's used in finance: extracting a time-varying beta or hedge ratio, estimating a stochastic volatility or unobserved factor, filtering a fair-value or pairs-trading spread, term structure models where the factors are latent, and nowcasting a macro variable from noisy high-frequency data.
    5. Why a risk function cares: it gives you an estimate that adapts without the jumpiness of a rolling window. A 60-day rolling beta lurches when an old observation drops out; a Kalman-filtered beta moves smoothly and quantifies its own uncertainty.
    6. The assumptions and their cost: linear dynamics and Gaussian noise. For non-linear problems you need the extended or unscented variants or a particle filter. And you have to specify the two noise covariances, which are rarely known, so in practice you estimate them by maximum likelihood and the result is sensitive to them.
    7. The limitation to volunteer: it's optimal given the model, and it has no way to tell you the state equation is wrong. Feed it a misspecified process and it will produce confident, smooth, wrong estimates, which is a particularly dangerous failure mode.

    Where candidates lose it

    Reciting matrix equations. Nobody wants the algebra; they want the predict-then-correct intuition, the gain as a trust weighting, and one concrete financial use. If you can't name a use case, the answer reads as memorised from a signal-processing course.

    Expect next

    • How would you use it to estimate a time-varying hedge ratio?
    • What happens if the noise covariances are misspecified?
    • How does it compare to a simple exponentially weighted estimate?

    Reported by candidates at UBS (Risk, London, 2022). Source: Wall Street Oasis.

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.