Risk Management interview preparation

Questions

100

Traced to a firm

37

Firms

12

Updated

September 2026

Asked at

All firmsUBS14MSCI7BLBlackRock5FTFranklin Templeton3Oaktree Capital Management2Scotiabank2Jane Street1Moody's1Neuberger Berman1PIMCO1SSState Street1TSTruist Securities1

Topic

All topicsMarket risk and VaR14Tail risk and stress testing5Greeks and sensitivities5Credit risk11Counterparty risk and CVA6Operational risk5Model risk and validation6Regulatory capital7Liquidity risk and ALM6Statistics and quant foundations7Indian regulation7Risk governance and appetite4Markets and macro9Fit and career8

Level

AnyCoreIntermediateHard

Type

AnyTechnicalCaseBrainteaserMarket viewFit

1. 001What is risk?Market risk and VaRCorephone / first roundUBSRisk Management · Zurich · 2021

   Say this

   Risk is exposure to an uncertain outcome that you care about. Two ingredients: you don't know what will happen, and some of the outcomes hurt. If you don't know but every outcome is fine, that's just noise, not risk.

   Then walk it

   1. Separate risk from uncertainty. Risk is where you can put a distribution on outcomes, even a rough one. Knightian uncertainty is where you can't, and that's the harder problem for a risk function.
   2. Risk is two-sided in finance theory and one-sided in a risk seat. A portfolio manager cares about variance; my job is the left tail and whether the firm survives it.
   3. It's always relative to an objective. The same position is risky for a bank funding overnight and safe for a pension fund matching 20-year liabilities. No objective, no risk measure.
   4. In practice a bank decomposes it: market, credit, liquidity, operational, and then the ones that don't fit a formula, like conduct, model and strategic risk.
   5. And the honest limitation: every number I produce is a model of risk, not risk itself. The risks that actually kill firms are usually the ones nobody had a distribution for.

   Where candidates lose it

   Answering 'volatility' or 'standard deviation'. That's a measure of one kind of risk, not a definition, and a risk interviewer will read it as textbook recall. Lead with uncertainty plus harm, then say that the measure depends on whose objective you are protecting.

   Expect next

   • Is volatility risk?
   • What's the difference between risk and uncertainty?
   • Which risk would you say is the hardest to quantify?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

2. 002Describe what Value at Risk is.Market risk and VaRCoretechnicalUBSRisk Management · Zurich · 2021BLBlackRockRisk and Quantitative Analysis · New York · 2026

   Say this

   VaR is a loss threshold with a probability attached. A one-day 99% VaR of $10m means that on 99 days out of 100 you expect to lose less than $10m, so roughly two or three days a year you should lose more.

   Then walk it

   1. Three inputs, and you have to state all three: the horizon, the confidence level, and the portfolio. A VaR number without a horizon and a confidence level is meaningless.
   2. Mechanically it's a quantile of the profit and loss distribution. You build a distribution of possible one-day P&L and read off the first percentile.
   3. It's popular because it aggregates. One number covers equities, rates and FX on the same scale, which is what lets a board set a firmwide limit.
   4. The breach count is the test. At 99% over 250 trading days you expect about 2.5 exceptions. Zero exceptions is not a good model, it's a conservative one, and regulators treat both directions as a problem.
   5. The limitation I'd say without being asked: VaR tells you where the tail starts and nothing about how deep it goes. A $10m VaR is consistent with a $15m bad day and with a $500m one.

   Where candidates lose it

   Saying 'the maximum you can lose'. It is precisely not the maximum, and that phrase is the single fastest way to fail a market risk screen. Say 'the loss you exceed one percent of the time' and give the expected breach count.

   Expect next

   • So what is the maximum you can lose?
   • What does a 99% one-day VaR of $10m imply about breaches per year?
   • Would you rather a board saw VaR or expected shortfall?

   Reported by candidates at UBS (Risk Management, Zurich, 2021); BlackRock (Risk and Quantitative Analysis, New York, 2026). Source: Wall Street Oasis.

3. 003What are the methodologies to compute VaR?Market risk and VaRCoretechnicalUBSRisk Management · Zurich · 2021

   Say this

   Three: historical simulation, parametric or variance-covariance, and Monte Carlo. They differ in one thing only, where the distribution of returns comes from. Historical takes it from the past, parametric assumes it, Monte Carlo generates it.

   Then walk it

   1. Historical simulation: take the last 250 or 500 days of factor moves, apply each one to today's portfolio, sort the P&L, read the percentile. No distributional assumption, and it keeps whatever fat tails and correlations actually happened.
   2. Parametric: assume returns are normal, estimate the covariance matrix, and VaR is just portfolio volatility times a z-score. At 99% that multiplier is 2.33, at 95% it's 1.645.
   3. Monte Carlo: specify a process for each risk factor, simulate tens of thousands of paths, revalue the portfolio on each one, read the percentile. The only one that handles path dependency and big non-linearity properly.
   4. The trade-off is the same triangle every time: parametric is fast and wrong in the tails, historical is honest but limited to one history, Monte Carlo is flexible but expensive and only as good as the process you assumed.
   5. In practice most banks run historical as the official number and parametric as a same-day sanity check, with Monte Carlo reserved for the exotic book. Running two and explaining the gap is itself a control.

   Where candidates lose it

   Listing the three names and stopping. The interviewer wants the axis they differ on and when you'd pick each. If you can't say which one you'd use for a portfolio of barrier options, you have named the methods without understanding them.

   Expect next

   • Which would you use for a book of barrier options, and why?
   • Which would you use if you had two years of data and 5,000 positions?
   • How would you reconcile two VaR numbers that differ by 30 percent?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

4. 004Walk me through historical simulation VaR and tell me what breaks it.Market risk and VaRIntermediatetechnicalUBSRisk Management · Zurich · 2021

   Say this

   You take a window of past daily factor moves, apply each one to today's positions, and sort the resulting P&L. The 99% one-day VaR is the loss at the second or third worst day out of 250. What breaks it is the window.

   Then walk it

   1. Step one is full revaluation, not a delta approximation, if you want it to be right for options. You reprice the book under each historical scenario.
   2. It assumes today's portfolio experienced yesterday's market. That's the point: you keep the real correlations and the real fat tails without assuming a distribution.
   3. The first failure is window length. A 250-day window drops the crisis as soon as it's a year old, so VaR falls exactly when complacency is building. Lengthen it and the model becomes slow to react to a new regime.
   4. The second failure is that every day gets equal weight. A move from fourteen months ago counts as much as yesterday's. Exponentially weighted or volatility-scaled historical simulation fixes that, at the cost of some transparency.
   5. The third is that your sample has no event you haven't lived through. If your factor never gapped, the model says it can't. That's why historical VaR has to sit next to stress testing, not replace it.
   6. One number to have ready: in March 2020, banks running 250-day windows saw VaR roughly double within a fortnight, purely because the new observations entered the sample. Procyclicality is not theoretical.

   Where candidates lose it

   Describing the mechanics cleanly and then having nothing to say about the window. The window choice is the whole model risk of historical simulation, and it is what the follow-up will be about. Name the procyclicality problem yourself.

   Expect next

   • How long a window would you choose and why?
   • How would you weight recent observations?
   • What does your VaR do the week after a crash, and is that useful?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

5. 006How does Monte Carlo VaR work, and when is it worth the extra cost?Market risk and VaRHardtechnicalUBSRisk Management · Zurich · 2021

   Say this

   You specify a stochastic process for each risk factor, simulate a large number of joint paths, revalue the portfolio on every path, and take the percentile of the simulated P&L. It's worth the cost when the payoff is non-linear or path dependent, and not otherwise.

   Then walk it

   1. The inputs are a process per factor, usually a drift and volatility, plus a dependence structure, usually a correlation matrix or a copula. Then you draw correlated shocks, typically via a Cholesky decomposition.
   2. Full revaluation is the expensive part, not the random numbers. If revaluing one exotic takes a second, ten thousand paths across a thousand trades is a real overnight compute problem.
   3. It's the only method that handles path dependency properly. A barrier option, a cliquet, a callable bond, a CVA number on a swap portfolio, all of those depend on the path and not just the endpoint.
   4. It also lets you choose the distribution. You can simulate from a t distribution, or use a copula to get tail dependence that a normal correlation matrix cannot produce.
   5. Its weakness is that it is only as good as the assumed process. Historical simulation is wrong in a way you can see; Monte Carlo is wrong in a way buried in a calibration file. That's why it needs the heaviest model validation of the three.
   6. So my rule: linear portfolio, don't bother, parametric or historical is fine. Options book, structured credit, or anything with optionality in the funding, Monte Carlo earns its keep.

   Where candidates lose it

   Describing it as 'generating random scenarios' without naming the two things you have to assume, the process and the dependence structure. That's where all the model risk lives, and naming it is what separates someone who has built one from someone who read about it.

   Expect next

   • How many paths do you need, and how would you know?
   • How would you introduce tail dependence into the simulation?
   • How would you validate a Monte Carlo VaR engine?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

6. 007Which assumption inside parametric VaR fails first, and what does that do to your number?Market risk and VaRHardsuperdayUBSRisk Management · Zurich · 2021

   Say this

   Normality fails first, and it makes VaR too small exactly when you need it. Real return distributions are leptokurtic, so the true 99th percentile sits further out than 2.33 sigma, and the deeper into the tail you go the worse the understatement gets.

   Then walk it

   1. Assumption one, normality. Equity index daily returns have kurtosis well above three. At 99% the error is modest, maybe 10 to 20 percent; at 99.9% parametric VaR can be off by a factor.
   2. Assumption two, a stable covariance matrix. Correlations rise in a sell-off, so the diversification benefit the matrix gives you evaporates in the scenario the number is supposed to protect you from.
   3. Assumption three, linearity. Parametric VaR uses deltas, so it prices an option position as if it were stock. Short gamma looks harmless and short a straddle can even show negative risk.
   4. Assumption four, independent returns. Volatility clusters, so square-root-of-time scaling understates multi-day risk during a stress period.
   5. The order matters for the answer: normality is the one people name, but linearity is the one that produces catastrophically wrong numbers, because it can be wrong by a sign rather than a percentage.
   6. Fixes in ascending order of effort: a t distribution or Cornish-Fisher adjustment for the tail, EWMA covariance for the clustering, delta-gamma for mild convexity, and full revaluation once the book has real optionality.

   Where candidates lose it

   Saying 'it assumes normality' and stopping. Every candidate says that. The differentiator is naming the linearity assumption and explaining that for an options book parametric VaR can get the direction of risk wrong, not just the magnitude.

   Expect next

   • How would you adjust it for fat tails without going to full simulation?
   • What does delta-gamma VaR fix and what does it still miss?
   • Would you ever show a board a parametric number? When?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

7. 008What is expected shortfall?Market risk and VaRIntermediatetechnicalUBSRisk Management · Zurich · 2021

   Say this

   Expected shortfall is the average loss given that you have breached VaR. So a 97.5% ES is the mean of the worst 2.5 percent of outcomes, not the threshold at which they start. It answers the question VaR refuses to answer: how bad is bad?

   Then walk it

   1. Computationally it's trivial once you have the loss distribution. In historical simulation, sort the 250 daily P&Ls, take the worst six or seven, and average them. That's your 97.5% ES.
   2. It's also called conditional VaR or expected tail loss. Same thing, different textbooks.
   3. ES is always at least as large as VaR at the same confidence level, and the gap tells you how fat your tail is. Two books with identical VaR and very different ES are not equally risky, and that difference is the whole reason to compute it.
   4. Basel's FRTB replaced 99% VaR with 97.5% expected shortfall for trading book capital, which is why this question turns up in every bank market risk interview now. The confidence level dropped because ES at 97.5% is roughly calibrated to VaR at 99% for a normal distribution.
   5. The catch worth volunteering: ES is harder to backtest. VaR gives you a clean binary breach count you can test with a simple frequency test. ES asks you to test the average size of rare events, so you need far more data for the same statistical power.

   Where candidates lose it

   Defining it as 'the loss beyond VaR' without the word average or conditional. ES is an expectation, not a threshold and not a worst case. And if you can't say why Basel moved to 97.5% rather than keeping 99%, you have read the definition and not the reason.

   Expect next

   • Why did Basel choose 97.5% for ES rather than 99%?
   • How would you backtest an ES model?
   • Is ES always bigger than VaR?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

8. 009What are the advantages and disadvantages of expected shortfall compared with VaR?Market risk and VaRHardtechnicalUBSRisk Management · Zurich · 2021

   Say this

   ES wins on theory and loses on practice. It's coherent, it sees the whole tail, and it can't be gamed by moving risk past the threshold. But it's harder to backtest, less stable, and more sensitive to the handful of observations that drive it.

   Then walk it

   1. Advantage one, it's subadditive, so it's a coherent risk measure. Adding two books can never raise ES above the sum of their parts, which means you can allocate it down to desks and the numbers add up sensibly.
   2. Advantage two, it sees tail depth. VaR is blind beyond the quantile, so a desk can sell far out-of-the-money options and report the same VaR with vastly more real exposure. ES prices that in.
   3. Advantage three, it removes the incentive to optimise against the measure. Optimising a portfolio to minimise VaR tends to push loss into the tail; minimising ES doesn't reward that.
   4. Disadvantage one, backtesting. A VaR breach is binary and you can test the count with a Kupiec or traffic-light test. ES needs you to test conditional magnitudes, which needs far more observations, so supervisors still backtest VaR even under an ES capital regime.
   5. Disadvantage two, estimator noise. At 97.5% over 250 days, ES is the average of six observations. Change one bad day and the number jumps. It's less robust and less stable period to period, which makes limit management awkward.
   6. Disadvantage three, communication. Traders understand 'I lose more than this one day in a hundred'. 'The average of my worst six days' takes longer to land, and risk numbers nobody understands don't change behaviour.
   7. My summary line: ES is the better measure of risk and VaR is the better test of your model. Most banks now report both for exactly that reason.

   Where candidates lose it

   Giving only the coherence advantage. That's half the answer and the easy half. The interviewer is testing whether you know the practical cost, and the backtesting problem is the answer. Saying 'ES is strictly better' is the wrong answer, because if it were, Basel would have dropped VaR backtests too.

   Expect next

   • If ES is coherent and VaR is not, why do supervisors still backtest VaR?
   • How many observations would you want to estimate ES reliably?
   • Which would you set a desk limit on?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

9. 010Why is VaR not a coherent risk measure?Market risk and VaRHardsuperdayUBSRisk Management · Zurich · 2021

   Say this

   Because it fails subadditivity. The VaR of a combined portfolio can exceed the sum of the individual VaRs, which means diversification can appear to increase risk. Coherence needs four properties, and that's the one VaR breaks.

   Then walk it

   1. The four axioms are monotonicity, translation invariance, positive homogeneity and subadditivity. VaR satisfies the first three.
   2. The classic counterexample is two independent digital or deep out-of-the-money option positions. Each has a small probability of a large loss, say 0.6 percent. Individually, at 99% confidence, the loss sits beyond the quantile, so each has near-zero VaR.
   3. Put them together and the probability of at least one blowing up is now above one percent, so the combined VaR jumps to the full loss. Two positions with almost no VaR each combine into a large one. That's the violation.
   4. Why it matters operationally: if the measure isn't subadditive, you can't safely allocate a firm limit down to desks, because desk limits summing to the firm limit no longer bound the firm's risk. And a trader can reduce measured VaR by taking on tail risk.
   5. For elliptical distributions, including the normal, VaR is subadditive, which is why the problem never shows up in a textbook example. It shows up in real books with credit and optionality, which is exactly where it matters.
   6. ES is subadditive at every confidence level and for every distribution, which is the theoretical reason Basel moved to it.

   Where candidates lose it

   Naming subadditivity without being able to construct the counterexample. The interviewer will ask for an example, and 'two out-of-the-money digital options that each blow up 0.6 percent of the time' is the one that works. Also worth avoiding: claiming VaR is never subadditive. For normal distributions it is.

   Expect next

   • Give me a concrete two-position counterexample.
   • Is VaR subadditive under any conditions?
   • What practical problem does this create for limit setting?

   Reported by candidates at UBS (Risk Management, Zurich, 2021). Source: Wall Street Oasis.

10. 011How do you backtest a VaR model?Market risk and VaRIntermediatetechnicalBank market riskModel validation

    Say this

    Compare the daily VaR forecast to the actual next-day P&L and count the days the loss exceeded it. Then test whether that count and its timing are consistent with your confidence level. At 99% over 250 days, you expect about two or three exceptions.

    Then walk it

    1. First fix the P&L definition. You backtest against hypothetical P&L, which holds the portfolio static, not actual P&L, which includes intraday trading and fees. Otherwise you're testing the traders, not the model.
    2. Unconditional coverage: the Kupiec proportion-of-failures test. Is the exception count statistically consistent with one percent? With 250 days, you can't reject much below five exceptions, so the test has weak power. Say that.
    3. Conditional coverage: are exceptions independent, or do they cluster? Christoffersen's test looks at that. Clustering means the model is slow to react to volatility regimes, which is the classic symptom of a long unweighted historical window.
    4. Basel's traffic light is the version supervisors actually use: green up to four exceptions in 250 days, amber five to nine with a rising capital multiplier, red at ten or more, which triggers a multiplier of four and a model review.
    5. Then diagnostics beyond the count. Which desks and which risk factors produced the breaches, and how big were the breaches relative to VaR. Ten small breaches and two enormous ones are different failures needing different fixes.
    6. The limitation I'd raise: a single year at 99% simply doesn't contain enough tail events to prove a model right. Backtesting can reject a bad model and cannot confirm a good one. That's why it sits alongside benchmarking and stress testing.

    Where candidates lose it

    Counting breaches and stopping. Two things get missed almost every time: using hypothetical rather than actual P&L, and saying that the test has low statistical power over 250 days. Both show you understand what backtesting can and cannot prove.

    Expect next

    • What is the Basel traffic light approach?
    • Why hypothetical P&L and not actual?
    • Zero exceptions in a year. Is the model good?

Firm tags come from public, anonymous candidate reports on Wall Street Oasis: strong signal, not sworn testimony. Firms are named as the places a question was reported, not as partners of Fin Maverick. Answers are written for this page to show how to think out loud; they are not scripts to recite.