Interview questions for risk management: 14 questions about spotting, sizing and controlling risk before it lands
On this page
- Risk management, defined as something you can observe
- Ten behavioral questions, with red flags and probes
- Four situational questions
- A ten-minute pre-mortem exercise
- Risk management, judgment and decision making compared
- What strong and weak answers sound like
- A 1–4 anchored rating scale for risk management
- Common interviewer mistakes with risk management
- Questions people ask
Interview questions for risk management often get answered with a crisis story: something went wrong and the candidate fixed it. That is useful, but it is mostly evidence of response, not of risk management. Risk management happens earlier and is quieter: noticing what could go wrong before it does, judging which risks deserve attention, putting controls in place, giving each risk an owner and watching for early warning signs. The best evidence is often a problem that never happened. Below are fourteen questions, ten behavioral and four situational, each with what a strong answer contains, red flags and a follow-up probe, plus a short pre-mortem exercise, a comparison with neighboring competencies, illustrative sample answers, a 1–4 anchored scale and common mistakes.
Risk management is closest to interview questions for judgment, which cover sensing what matters in the moment and when to escalate. This page covers the deliberate, forward-looking practice of finding and controlling risks over time. For physical and workplace hazards specifically, see interview questions for safety mindset.
Risk management, defined as something you can observe
Definition: risk management is identifying what could prevent an objective from being met, assessing how likely and how harmful each risk is, choosing how to respond, and monitoring the risks and the responses over time. Listen for five behaviors:
- Identifying risks early. Asks "what could go wrong?" at the start of work, and includes risks outside their own area.
- Sizing them. Separates likelihood from impact and focuses on the few risks that matter most.
- Choosing a response. Knows the options: avoid the risk, reduce it, transfer it, or accept it knowingly. Picks one with a reason.
- Assigning ownership. Each significant risk has a named person watching it.
- Monitoring and communicating. Sets early warning signs, reviews risks as things change and tells decision makers in plain terms.
Ten behavioral questions, with red flags and probes
| Question | A strong answer contains | Red flags | Follow-up probe |
|---|---|---|---|
| 1. Tell me about a risk you spotted early that would have caused real damage if you had not acted. | How they spotted it, why they judged it serious, what control they put in place and how they knew it worked. | Only crisis stories, where the risk had already happened. | "What was the first sign?" |
| 2. Describe how you identify risks at the start of a project or new responsibility. | A repeatable habit, such as a pre-mortem, a checklist, or asking each stakeholder what worries them. | Deals with risks as they come. | "What did your last list include that others missed?" |
| 3. Tell me about a risk you decided to accept rather than fix. | Why fixing it cost more than living with it, who agreed and how it was recorded. | Never accepted a risk, or accepted one without telling anyone. | "What would have made you change your mind?" |
| 4. Describe a time you had too many risks to address. How did you prioritize? | Compared likelihood and impact, focused on the top few and was explicit about what they were not doing. | Tried to address everything equally. | "What was at the bottom of your list?" |
| 5. Tell me about a time you had to convince someone senior to take a risk seriously. | Explained it in their terms, such as cost, customers or deadlines, with a proportionate recommendation. | Alarm without a proposal, or gave up after one try. | "What made them listen?" |
| 6. Describe a risk that materialized despite your planning. | An honest account, how the plan helped or did not, and what they changed in how they assess risk. | Nothing could have been done, or no examples. | "What did you underestimate?" |
| 7. How have you kept track of risks over time? | A register, log or regular review with owners and status, and evidence it was used, not just created. | A list written once and never opened again. | "When did you last change an entry?" |
| 8. Tell me about a control you put in place to reduce a risk. | What it was, what it cost, what it protected against and whether it was checked. | Controls that added work without reducing the risk. | "How did you know it was working?" |
| 9. Describe a risk that sat outside your own area. What did you do? | Told the right owner, offered help and followed up. | "Not my problem." | "What happened next?" |
| 10. Tell me about a time someone said you were being too cautious. | Weighed their view, explained the risk or adjusted, and can say who turned out to be right. | Always right, or always backed down. | "Looking back, were you?" |
Questions 1 and 3 are the most revealing. Question 1 separates prevention from firefighting. Question 3 separates risk management from risk avoidance.
Four situational questions
-
"You are three weeks from launching a new system. One vendor is behind, one key person has resigned, and testing found a data issue. Which do you deal with first?"
Probes: How do you compare them? What would you tell the sponsor? -
"Your company relies on one supplier for a critical part. Nothing has gone wrong in years. What, if anything, would you do?"
Probes: What would a second supplier cost? How would you decide? -
"A senior leader wants to skip a planned review step to hit a deadline. What do you do?"
Probes: What risk does the step control? What could replace it? -
"You inherit a risk register with eighty items, all rated high. What do you do with it?"
Probes: How would you re-rate them? Who would you involve?
The scenarios are invented. Accept any well-reasoned answer, and listen for whether the candidate separates likelihood from impact and proposes a proportionate response rather than a maximal one.
A ten-minute pre-mortem exercise
A pre-mortem asks people to imagine a plan has already failed and work out why. It is a quick way to see risk thinking in action. Give every candidate the same short, job-relevant plan, such as "We are moving our customer support team to a new ticketing system next month."
- Ask: "It is three months from now and this has gone badly. What went wrong?" Give three minutes.
- Ask the candidate to pick the two failures that are most likely or most damaging, and explain why.
- For each, ask what they would do now to prevent it, and what early sign would tell them it was happening.
- Ask which risk they would accept and why.
Score the range of risks identified, the quality of the prioritization and whether the controls and warning signs are practical. Do not score knowledge of formal risk vocabulary.
Risk management, judgment and decision making compared
| Risk management | Judgment | Decision making | |
|---|---|---|---|
| Main question | What could go wrong, and what are we doing about it? | What matters here, and should I act or escalate? | Which option do we choose, and why? |
| Timing | Before and throughout the work | In the moment | At a choice point |
| Typical output | Prioritized risks with owners, controls and warning signs | A proportionate call | A decision with its trade-offs |
| Typical failure | Unexamined risks, or controls on everything | Over- or under-reacting | Choosing without weighing options |
When the candidate's example centers on the choice itself, score it under decision making. Risk planning on projects also overlaps with project management skills.
What strong and weak answers sound like
Illustrative answers to question 1, written to show the difference in structure.
Weak: "Our main server went down during peak season and I stayed up all night getting it back. I coordinated everyone and we were back online by morning. I'm really good under pressure."
This is a response story. The risk had already happened, and there is no sign the candidate anticipated it or prevented a repeat.
Strong: "When I took over our event program, I listed what could stop the annual conference from happening. Most items were minor, but one stood out: the venue contract let them cancel with thirty days' notice, and we had no backup. The chance was low but the impact would have been severe. I got two other venues to hold provisional dates for a small fee and asked our legal team to renegotiate the clause at renewal. Four months later the venue did cancel because of building work. We moved within a week and kept the date. I now review contract exit clauses for every major supplier as standard."
The strong answer identifies the risk before it happened, separates likelihood from impact, chooses a proportionate control, sees it pay off and generalizes the lesson.
A 1–4 anchored rating scale for risk management
| Score | Anchor |
|---|---|
| 1 — No evidence | Reacts to problems as they happen. Cannot describe a risk they anticipated. No sense of likelihood versus impact. |
| 2 — Limited | Identifies obvious risks when prompted. Treats all risks alike. Controls are informal and rarely tracked. |
| 3 — Solid | Identifies risks early, prioritizes by likelihood and impact, chooses proportionate responses including accepting some, assigns owners and monitors them. |
| 4 — Strong | Everything at 3, plus spots risks beyond their own area, sets early warning signs, communicates risk clearly to decision makers and improves how the team handles risk. |
Common interviewer mistakes with risk management
- Rewarding heroics. A dramatic recovery can mean the risk was never managed. Ask what the candidate did before it happened.
- Rewarding caution for its own sake. Candidates who would control every risk can slow everything down. Ask which risks they chose to accept.
- Scoring vocabulary. Terms like "risk appetite" and "residual risk" are easy to learn. Ask for the risk, the response and the result in their own example.
- Ignoring communication. A risk nobody else knows about is barely managed. Ask who they told and how.
- Writing "risk-aware" in the notes. Record the behavior: "spotted venue cancellation clause; held backup venues; venue cancelled, moved in a week, kept the date."
Questions people ask
What is the difference between risk management and judgment?
Judgment is the in-the-moment sense of what matters, how serious a situation is and whether to act or escalate. Risk management is a deliberate, ongoing practice: identifying what could go wrong before it happens, estimating how likely and how damaging each risk is, choosing controls, assigning owners and tracking the risks over time. Good judgment helps in risk management, but someone can make sound calls in a crisis and still never prepare for the next one.
Is this page for hiring risk managers specifically?
It is written for any role that owns outcomes that can go wrong: project and program managers, operations leads, finance, IT, product, compliance and people managers. For dedicated risk roles, add technical questions about the frameworks, regulations and tools your organization uses, and use these questions to test whether the candidate applies risk thinking in practice.
Is a risk-averse candidate a strong risk manager?
Not necessarily. Avoiding every risk often means avoiding the opportunity too, or pushing risk somewhere less visible. Strong risk managers are comfortable accepting some risks deliberately, as long as the decision is conscious, proportionate and recorded, and they can explain which risks they chose to live with and why.
How do I assess risk management for a junior role?
Narrow the scope. Ask about risks in the candidate's own work: a deadline, a piece of equipment, a customer commitment or a school or volunteer project. Look for the same behaviors on a smaller scale: thinking ahead about what could go wrong, doing something about the most serious items and telling someone early.