Risk, Compliance & Audit
The second and third lines: measuring what the firm could lose, deciding what it is not permitted to do, and checking afterwards that the first two actually happened.
In every firm above: Not a kind of firm — a kind of seat. the whole map
The seats
three of them, each answering the same six questions so that they can be read against each other.
Next to it
The other group on the same side of the price.
What an interview asks here
Every question here is really asking the same thing: do you understand that this seat is judged on events that did not happen, and what that does to the job.
Try each one out loud before you open it. What is underneath is the shape of a complete answer, not a script — somebody who can produce those parts in their own words can also answer the four variations that follow, and somebody who has memorised a paragraph can answer one.
Q1What is the difference between the first, second and third line of defence?
What it is checking. The structural question, and the answer explains why the reporting lines are what they are.
A complete answer contains:
- The first line takes the risk and owns it: the desk, the lending officer, the operations team.
- The second line sets and monitors the constraints: risk management and compliance.
- The third line checks afterwards that the first two worked, and reports to the board rather than to management.
- The independence is structural — reporting line, budget and access — rather than a personal quality.
Read it properly: Internal audit · Risk management
Q2A risk measure says the daily loss should exceed a number on one day in a hundred. It happens four times in a month. What do you conclude?
What it is checking. Whether you can distinguish a model failure from bad luck, and whether you say so.
A complete answer contains:
- Four exceptions in a month is far outside what the model claims, so the first conclusion is that the model is wrong rather than the market unusual.
- The usual causes are a calibration window that contains no stress, correlations assumed stable, or a position the model does not see.
- Backtesting exists precisely to make this visible, and the exceptions are counted rather than debated.
- The response is to widen the measure or reduce the position, and to say which was chosen.
Read it properly: Risk measures · Volatility
Q3Which risk families are hardest to measure, and why does that matter?
What it is checking. The measurement bias that decides which failures firms actually have.
A complete answer contains:
- Market risk has a price history and therefore a number; credit has ratings and spreads.
- Liquidity and operational risk mostly do not: there is no clean distribution for 'we could not sell it' or 'somebody made an error'.
- So firms measure what is measurable, and the risks that decide outcomes are systematically the unmeasured ones.
- Across this site's own product profiles, operational risk decides more instruments than liquidity and funding combined.
Read it properly: Which risk decides · Liquidity
Q4How does counterparty exposure on a derivative differ from a loan?
What it is checking. A loan's exposure is known at the start; a derivative's is not.
A complete answer contains:
- A loan's exposure is the amount lent, and it amortises down.
- A derivative's exposure is what it would cost to replace, which is zero at inception and grows with the market that made it profitable.
- So the exposure is largest exactly when the trade has been most successful — and often when the counterparty is under most stress.
- Which is why it is collateralised daily rather than lent once.
Read it properly: If the other side fails · Margin and collateral
Q5A desk wants a limit raised in a strong year. How do you handle it?
What it is checking. The organisational half of the job, which is most of it.
A complete answer contains:
- Separate the two questions: has the risk changed, or has the appetite changed because the revenue did.
- A limit that moves because a book is profitable is not a limit; it is a ratchet, and it only ever moves one way.
- If it is raised, the reason and the new exposure both go in writing to whoever owns the appetite.
- A second line that cannot survive saying no in a good year has no function in a bad one.
Read it properly: Risk management · 1995
Q6What is a control, and how would you tell whether one is real?
What it is checking. The audit question, and it is about evidence rather than intention.
A complete answer contains:
- A control is a step that would catch or prevent the failure, performed by somebody with the standing to stop it.
- It is real if it leaves evidence: an approval, a reconciliation, a rejected item, a record of who did what.
- A documented control with no trace is untested, and an untested control usually turns out not to have been performed.
- Segregation of duties is the oldest one — whoever trades cannot be whoever confirms and records the trade.
Read it properly: Internal audit · Operations and settlement
Q7Why is 'the alert was closed' not the same as 'the alert was reviewed'?
What it is checking. Alert fatigue is the characteristic failure of a surveillance function, and it is a design problem.
A complete answer contains:
- A system that flags thousands of items a day guarantees that each is closed in seconds.
- Closure rates then measure throughput rather than judgement, and the real item is closed at the same speed as the noise.
- The fix is calibration and tiering, not more staff: fewer, better alerts beat more reviewers.
- And the measure of the function is what it found, not how much it processed.
Read it properly: Compliance and financial crime · 2020
Do these against a clock — one at a time, ninety seconds each, answer before you look.
Whose questions these are. Every question on this page was written for this publication. None is taken from anybody else’s question bank, and none is a claim about what any named firm asks — that is neither verifiable from here nor ours to assert. They are our own reading of which mechanism a question of this kind is testing. Information and education only.
Test yourself: five questions
Five quick questions on this part of the industry — checked entirely on your device, nothing stored or sent. Wrong answers come with explanations, and the seat pages above hold every answer. For education only.