What are common model risk management interview questions?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Expect three kinds: concepts (what a model is, what model risk is, effective challenge, the three lines of defence), technique (how you'd validate a credit or machine learning model, PSI, KS, AUC and Gini, backtesting, benchmarking) and judgement (what you'd do when a developer pushes back, or a model breaches its threshold). Regulation comes up too: E-23 in Canada, SR 26-2 in the US, SS1/23 in the UK.
Concept questions
| Question | A strong short answer |
|---|---|
| What is a model? | A method that turns input data into an estimate using assumptions, statistics or a learned method, which someone relies on. E-23 includes AI and machine learning, and vendor models count. |
| What is model risk? | The risk of loss or harm because a model is wrong or misused. Both halves matter: a sound model applied to the wrong portfolio is still model risk. |
| What is effective challenge? | Critical review by people who are objective, competent and have enough standing to make the developers change something. SR 11-7 coined the term; independence without competence or influence doesn't count. |
| What are the three lines of defence in MRM? | The first line builds, owns and uses models. The second line sets policy and challenges, usually through model validation. Internal audit, the third line, checks the system works. |
| Why do we tier models? | So the depth of review fits the risk. A capital model and a staffing spreadsheet can't get the same scrutiny, and the tier sets validation depth, cadence and who approves. |
| What goes in a model inventory? | Every model in use or recently retired, with an owner, purpose, tier, developer, reviewer, approver, dates and limits. E-23's Appendix 1 lists the fields. |
Interviewers use these to check you can explain the basics plainly. A one-sentence answer and a real example beat a recited definition. If you've worked on a model that was used beyond its intended portfolio, say so; it shows you understand misuse, not just error.
Technical questions
- How would you validate a credit scorecard? Walk through conceptual soundness (is the method right for the purpose and data?), data (quality, representativeness, the sample window), performance (discrimination with AUC or Gini, calibration of predicted against observed default rates), stability, sensitivity, and benchmarking against a simpler challenger. Close with how you'd report findings by severity.
- What is PSI and what do the thresholds mean? The population stability index compares a variable's or score's distribution today with the development sample. A common rule of thumb reads under 0.1 as stable, 0.1 to 0.25 as worth investigating and above 0.25 as a significant shift. Say they're conventions, not law.
- What's the relationship between Gini and AUC? Gini equals 2 × AUC − 1. An AUC of 0.5 is no better than chance.
- What does the KS statistic measure? The largest gap between the cumulative score distributions of goods and bads: how well the score separates them.
- How would you backtest a model? Compare predictions with what actually happened over a period the model didn't see, with a test that says whether the gap is larger than chance (a binomial test for default rates, traffic lights for value at risk).
- How is validating a machine learning model different? More attention to explainability, overfitting, data leakage, hyperparameter choices, fairness across groups and drift. For generative AI, add hallucination rates, prompt injection and output monitoring. See AI model validation.
- What would you check in a vendor model you can't see inside? The vendor's documentation and testing, your own outcomes analysis on your data, benchmarking, monitoring, and contract terms for access and change notices.
Judgement and behavioural questions
These decide most offers at the senior level, because the job is persuading people who don't report to you.
- A developer disagrees with your finding. What do you do? Re-check the evidence, discuss it on the substance, write down both views, and escalate through the governance route if it stays unresolved. Don't drop a finding to keep the peace, and don't treat severity as a negotiation.
- A business line wants a model in production before validation is done. Explain the risk, offer an exception with conditions and an end date approved by the right person, and record it. The answer is rarely a flat no.
- A monitoring threshold was breached. Walk me through it. Confirm it's real, assess the impact, tell the owner, decide on use limits or overlays, and track remediation to closure.
- How do you prioritise a validation backlog? By tier first, then by overdue date, open high-severity findings and upcoming changes.
Regulation questions to prepare for
In Canada, expect E-23: it was published in its final form on 11 September 2025 and takes effect on 1 May 2027, applies to every federally regulated bank and insurer, covers AI and machine learning, and is principles-based and proportional. Know its inventory, risk rating, independent review and approval expectations. See our E-23 guide.
For US roles, know that SR 26-2 replaced SR 11-7 on 17 April 2026. It's shorter and more risk-based, but keeps the core expectations on development, validation, monitoring, governance and vendor models, and interviewers still use SR 11-7's vocabulary. For UK roles, the PRA's SS1/23 and its five principles. For any role near AI, the NIST AI RMF and the EU AI Act come up often.
Questions worth asking them
- How many models are in the inventory, and how is it split by tier?
- Where does validation report, and can it block a model from going live?
- How are vendor and AI models handled today?
- What's the biggest open finding, and what's stopping it from closing?
- Where is the evidence of each approval kept?
The last one tells you a lot. If the answer is a shared drive and email, you'll spend part of the job rebuilding the record before each exam.
Related questions
What skills does a model risk analyst need?
Statistics and modelling, programming in Python, R or SAS, clear writing, knowledge of the regulation, and the confidence to challenge senior developers.
Is model validation a good career?
Demand has grown with machine learning and new rules such as E-23. Validation experience also leads into model development, risk management and AI governance roles.
What certifications help in model risk management?
The FRM and PRM are common. For AI-focused roles, the IAPP's AIGP is increasingly asked for. Experience validating real models usually counts for more than any certificate.
What is the difference between model validation and model risk management?
Validation is the independent review of individual models. Model risk management is the whole system around it: policy, inventory, rating, approval, monitoring and reporting.
Do I need to know E-23 for a model risk job in Canada?
For a role at a federally regulated bank or insurer, yes. Expect at least a question on what it covers, when it takes effect and how it treats AI.
Sources
- OSFI — Guideline E-23, Model Risk Management (2027)
- Federal Reserve — SR 26-2, Revised Guidance on Model Risk Management
- Federal Reserve — SR 11-7, Guidance on Model Risk Management (superseded)
- Bank of England PRA — SS1/23, Model risk management principles for banks
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.