Risk Manager interview questions, with worked answers

How to use these questions

Answer each question with the logic first: what the risk is, how you would measure it, what the number misses and what you would do. Then add a case of your own, with the kind of portfolio or business and the decision that followed, without the firm's confidential figures.

What a risk manager is expected to know

• The framework: risk managementIdentify, measure, limit and report risks across a firm, and tie each to an owner and a control. from appetite and limits to the register, indicators and reports, with internal controlsControls with owners and tests, and a clear view of which risks they really reduce. behind it.
• Risk types: credit riskJudge whether borrowers will pay: ratings, default and loss estimates, limits and the provisions they drive., market riskMeasure what price, rate and currency moves do to positions, set limits and explain the numbers., liquidity and operational risk, and how they interact in a crisis.
• Rules: the capital and liquidity rules of the international Basel IIIThe international Basel framework for bank capital and liquidity, and how national rules apply it. framework as your country applies it, and regulatory reportingCapital, liquidity and risk reports to the supervisor, correct, reconciled and on time..
• Numbers: statisticsDistributions, correlation, regression and back-testing, and knowing what a model cannot tell you., ExcelFast analyses, limit trackers and model checks in workbooks a reviewer can follow., PythonScripts for data cleaning, risk calculations and models that others can rerun and check. or RStatistical models and their tests, where a team works in R rather than Python., and SQLPull positions, exposures and loss events from the firm's databases without waiting for IT. for the data.
• People: explaining a riskExplain a risk and its number to people who must decide, without jargon and without fear. to those who decide, and presentingPresent the risk report to the risk committee and the board: short, clear, with the decision asked for. to committees.

The tools are named in ads side by side and none is a must everywhere: Python, SAS, MATLAB and SQL for analysis and models, and risk systems such as Archer, MetricStream or ServiceNow for registers, incidents and controls, often next to Excel. What interviewers test is what you did with them.

Appetite, limits and the risk register

How would you set a risk appetite, and how does it turn into limits people work with?

What they check: that you can link the board's words to numbers on a desk.

Short answer: "The risk appetite is how much risk the firm is willing to take to reach its goals, agreed by the board. I start from capital, earnings and reputation the firm can afford to lose, turn that into measures for each main risk, and break them down into limits for business lines, desks or portfolios, with warning levels below each limit."

The full answer: A good appetite has a few clear measures, such as a capital ratio floor, a maximum loss under stress and limits on concentrations, plus statements for risks that are hard to measure, such as no tolerance for sanctions breaches. Limits need owners, daily or monthly monitoring and a defined path when one is breached.

A weak answer: "The appetite is whatever the business plan needs." Follow-up: "The plan asks for twice the property lending." Say what the appetite does with that.

How do you build a risk register that people use, and how do you rate the risks in it?

What they check: a method that is simple, owned and kept current.

Short answer: "A risk register lists each risk with its cause, effect, owner, controls and a rating of likelihood and impact, before and after controls. I build it in workshops with the business, keep the scales simple and the same across the firm, and review the top risks every quarter with their owners."

The full answer: Ratings should rest on evidence where it exists, such as losses, incidents and indicators, not only on opinion. Link each risk to the actions that reduce it and track them. A register with hundreds of vague entries helps no one; a short one with clear owners does.

A weak answer: "We copy last year's register and update the dates." Follow-up: "Every risk is rated medium." Explain how you would challenge that.

How do key risk indicators and the risk and control self-assessment work together?

What they check: the tools of operational risk and how they feed decisions.

Short answer: "In a risk and control self-assessment the business rates its own risks and how well its controls work, with the risk function challenging the result. Key risk indicators are measures that warn early, such as failed payments, staff turnover or overdue reviews. The assessment says where to look; the indicators show when things change between assessments."

The full answer: Each indicator needs a threshold and an owner who acts when it is crossed. Compare the self-assessment with losses and audit findings: a business that rates every control as strong while losses rise is a finding in itself.

A weak answer: "We track forty indicators and report them all every month." Follow-up: "Which three would you show the board?" Say how you would choose.

Credit, market and liquidity risk, stress and capital

How do you assess the credit risk of a borrower, and what goes into an expected credit loss?

What they check: the parts of a credit decision and of a provision.

Short answer: "I look at the borrower's ability and willingness to pay: cash flow, debt, industry, management and collateral, and give a rating. The expected credit loss multiplies the probability of default, the share of the loan lost if it defaults, called the loss given default, and the amount owed at default, weighted over possible economic scenarios."

The full answer: Under IFRS 9, the international accounting standard, a loan's provision grows from twelve months of expected loss to the whole life of the loan when its credit risk rises significantly. Watch concentrations in one industry, region or group of borrowers, because defaults come together in a downturn.

A weak answer: "If the collateral covers the loan, the risk is zero." Follow-up: "The collateral is an office building in a falling market." Explain what changes.

How would you measure market risk with value at risk, and how would you explain its limits to a board member?

What they check: that you understand the measure and do not oversell it.

Short answer: "Value at risk is the loss a portfolio should not exceed over a given period with a given confidence, for example one day at ninety-nine in a hundred. To a board member I say: it tells you a bad normal day, not the worst day. That is why we add stress tests and expected shortfall, the average loss beyond that line."

The full answer: Value at risk depends on its history window and assumptions, and it missed the size of past crises. Back-testing compares it with real daily results; too many breaches mean the model needs work. Limits on sensitivities, such as a move in interest rates, sit next to it.

A weak answer: "Value at risk is the most we can lose." Follow-up: "The desk lost three times the value at risk yesterday." Say what you would look at first.

How do you watch liquidity risk, and what would you do if a funding source dried up?

What they check: the measures of liquidity and a plan for a bad day.

Short answer: "Liquidity risk is not having cash when it is due. I watch the cash flows by date, the buffer of assets that can be sold or pledged quickly, and the concentration of funding. Banks report liquidity ratios under the international Basel III rules. If a source dries up, the contingency funding plan sets who decides, which buffers are used first and how we talk to the market."

The full answer: Test the contingency plan before it is needed, with a scenario in which deposits leave quickly. Speed matters more today, because money moves in hours through mobile banking. Companies outside banking watch liquidity through the cash forecast with treasury.

A weak answer: "We have enough deposits, so liquidity is not a concern." Follow-up: "A tenth of deposits leave in two days." Walk through the first hours.

How do you design a stress test, and what do you do with the result?

What they check: a scenario that is severe but plausible, and a result that changes decisions.

Short answer: "A stress test asks what happens to capital, earnings and liquidity in a severe but plausible scenario, such as a deep recession with falling property prices and rising rates. I build the scenario with economists and the business, run it through the models, and take the result to management with actions, such as lower limits or more capital."

The full answer: Reverse stress tests start from the end: what would have to happen for the firm to fail? Supervisors run their own stress tests for large banks, with scenarios they set. A stress test nobody acts on is a cost, not a control.

A weak answer: "We use the supervisor's scenario and report the numbers." Follow-up: "The result shows the capital floor is breached in year two." Say what you propose.

How do capital rules shape a bank's risk work, from the international Basel framework to the national supervisor?

What they check: the link between risk, capital and the rules.

Short answer: "The international Basel framework sets how much capital a bank must hold against its credit, market and operational risks, and how much liquidity. Each country applies it through its own law and supervisor. Banks also run their own assessment of the capital they need, which covers risks the formulas miss, such as concentration or interest rates in the banking book."

The full answer: Risk-weighted assets turn exposures into a capital need, using either the standard weights or approved internal models. The final Basel III reforms, agreed internationally, limit how far internal models may lower capital. A risk manager explains how a new loan or product changes the capital ratio before it is approved.

A weak answer: "Capital is the finance department's job." Follow-up: "A large new loan uses a fifth of the free capital." Explain how you would assess it.

Operational risk, third parties, models and climate

How would you run operational risk: loss events, scenarios and controls?

What they check: a full cycle, from incidents to lessons.

Short answer: "I collect loss events and near misses with their cause, analyse patterns, and run scenario workshops for rare but severe events, such as a long system outage or a large fraud. The results feed the risk register, the controls that need work and the capital for operational risk."

The full answer: Loss data is only useful if people report it; make reporting easy and blame-free. In the EU, DORA, the EU's digital operational resilience rules for financial firms, adds duties for IT incidents and testing; other places have similar rules.

A weak answer: "Operational risk is what IT handles." Follow-up: "A payment went to the wrong account and was not recovered." Walk through the loss event.

How do you manage third-party and outsourcing risk?

What they check: that risk does not leave the firm with the work.

Short answer: "Before signing, I check the provider's soundness, security and how critical the service is; the contract gives rights to audit, data and exit. During the contract I watch service levels and incidents, and for critical services there is a plan to move or bring the work back."

The full answer: Concentration on a few cloud providers is a risk for whole markets, which supervisors watch. Keep a register of all outsourcing and other third-party arrangements, and review the critical ones every year.

A weak answer: "The provider is certified, so the risk is theirs." Follow-up: "The provider uses a subcontractor in another country." Say what you would ask.

How do you validate a model and manage model risk?

What they check: independence, testing and clear limits on use.

Short answer: "Model risk is the risk of losses or wrong decisions from a model that is wrong or misused. Validation is independent of the people who built it: it checks the data, the method, the code's results against a rebuild and how the model performs on new data. Every model is in an inventory, rated by importance, with known limits and a date for its next review."

The full answer: Models now include machine learning, which needs extra checks on explainability, bias and drift. A model may be used with restrictions while findings are fixed, but the restrictions must be written down and followed.

A weak answer: "The model performs well, so we do not need to understand it." Follow-up: "The model's results drift slowly over a year." Say how you would notice and act.

How do climate and environmental risks enter the risk framework?

What they check: that you treat climate as a driver of known risks, not a separate box.

Short answer: "Climate risk works through the risk types we already have: floods or heat damage collateral and borrowers, which is credit risk; a fast move to low-carbon energy changes the value of some industries, which is market and credit risk. I add climate scenarios to stress tests, look at concentrations in exposed sectors and regions, and report them."

The full answer: Data is the hard part: emissions and physical exposure of borrowers are often estimates. Supervisors in many places publish expectations for climate risk management, and they change; follow the ones of your country.

A weak answer: "Climate is for the sustainability team." Follow-up: "A tenth of the loan book is in one flood-prone region." Say what you would show the board.

The three lines, a breached limit, the board and the culture

How does the risk function fit the three lines model, and how do you stay independent?

What they check: clear roles and the courage to disagree.

Short answer: "In the three lines model the business owns its risks, the risk function and compliance set standards and challenge as the second line, and internal audit checks both as the third. I stay independent by reporting to the chief risk officer, not to the business head, and by being useful enough that the business asks me early."

The full answer: Independence does not mean distance: a risk manager who joins product discussions early prevents more than one who only reviews later. Agree with compliance and audit who covers what, so findings are not counted twice.

A weak answer: "Risk management approves what the business has decided." Follow-up: "Your bonus depends on the business line's results." Discuss the conflict.

A business head wants to exceed a limit for a large deal. What do you do?

What they check: that a limit means something, and that you can still help.

Short answer: "I look at the deal on its merits: what the limit protects against, how far it would be exceeded and for how long, and what could reduce it, such as collateral or selling a share to others. If an excess still makes sense, it goes through the defined approval with its reasons and an end date; if not, I say no and explain why in writing."

The full answer: Repeated excesses in one place mean the limit or the business plan is wrong, and both should be discussed openly. Never let an excess happen first and be approved later as a habit.

A weak answer: "The business knows its clients best, so I would agree." Follow-up: "The chief executive calls you about the deal." Explain what you say.

As head of risk, how do you report to the board and its risk committee?

What they check: a report that leads to decisions, not a data dump.

Short answer: "The report opens with the risk profile against the appetite, the top risks and their trend, breaches and what is being done, and the decisions the board must take. The details are in an annex. I meet the committee chair before each meeting, so there are no surprises."

The full answer: At senior risk manager level you write parts of this; as head of risk or chief risk officer you own it and answer the board's questions. Give a view, not only figures: "we are within appetite, but credit risk in one sector is rising and I recommend lower limits".

A weak answer: "I show all indicators so the board can draw its own conclusions." Follow-up: "A board member asks whether we are safe." Answer in two sentences.

How would you build a risk culture in which people raise problems early?

What they check: that you see culture as behaviour you can influence.

Short answer: "Risk culture is how people behave about risk when no one is checking. It grows when leaders talk about risk as part of decisions, when raising a problem is thanked and not punished, when pay does not reward hidden risk, and when the risk function is seen as a partner. I measure it with surveys, incident reporting and how often the business comes to us early."

The full answer: Stories teach more than policies: share near misses that were caught because someone spoke up. Watch for signs of a weak culture, such as many limit excesses, late incident reports or audit findings that stay open.

A weak answer: "Culture is HR's topic." Follow-up: "Incident reports fell sharply this year." Say whether that is good news.

Your CV for these questions

Each job on your CV invites the questions above: which risks, which methods, what the numbers showed and what was decided. Give those stories a line each, written so a head of risk wants to hear more:

Check your CV against a risk job you want with the free score; any area it finds thin is the one to rehearse first, with a real case told without confidential figures.