The three risk disciplines, and which one suits you

What each of the three risk disciplines does day to day, which skills transfer between them, and how the three lines of defence shape every risk job.

The short answer: Risk splits into three disciplines that share a vocabulary and very little else. Credit risk asks whether a borrower will repay, and the work is analytical and case-based with a portfolio view layered over it. Market risk asks how much a portfolio loses when prices move, and is quantitative, fast and tied to the trading day. Operational risk asks what breaks when a process, a system or a person fails, and is the broadest and least mathematical of the three. Skills transfer partially — the framework, the governance and the language are common — but the daily work is different enough that most people pick one within a couple of years and specialise from there.

Key points

Credit, market and operational risk share a governance framework and almost nothing about their day-to-day work.
Credit is case-based and analytical; market is quantitative and same-day; operational is process-wide and judgement-heavy.
The second line challenges the first — the job is to be independent, which makes it a different social position from a business role.
Model risk, climate risk and data roles are the fastest-growing adjacencies and take entrants from all three disciplines.

The three disciplines

What each risk discipline asks, and what the work looks like
Discipline	The question	Daily work
Credit risk	Will this borrower repay, and what if they do not?	Case assessment, limit setting, portfolio monitoring, provisioning input
Market risk	How much does the portfolio lose when prices move?	Limit monitoring, sensitivities, stress scenarios, same-day exception review
Operational risk	What breaks when a process, system or person fails?	Control assessment, incident review, scenario analysis, framework ownership

The rhythms differ as much as the content. Market risk is tied to the trading day and its deadlines are hard. Credit risk moves at the pace of transactions and periodic reviews. Operational risk works in longer cycles punctuated by incidents, which arrive without warning and reorder the week.

What independence actually means day to day

A second-line role sits outside the business it oversees, and that changes the social position of the job in ways nobody explains on day one. You are in the room, you are affected by the outcome, and you do not own the decision — you own the challenge to it.

Done badly this becomes either rubber-stamping or obstruction, and both are common. Done well it looks like being predictable: the business knows what you will object to, knows you will say so early rather than at the approval meeting, and knows that when you do object it is because something is genuinely wrong. That reputation is the whole asset, and it takes about two years to build and one bad call to spend.

The structure underneath this — first line, second line, third line — is set out in the divisions of a bank, and it is worth understanding before an interview because it is the frame the questions will assume.

Getting in, and what is actually tested

Risk interviews test three things, and only the first is what candidates prepare for.

Do you understand the mechanics? What drives a default, what a limit is for, why a control fails. Covered by the technical preparation approach — twenty concepts explained properly.
Can you hold a position under pressure? You will be asked what you would do if the business disagreed. The answer that scores describes escalating with evidence, not either caving or refusing.
Can you write? Risk work is written work — assessments, papers, findings. Some processes include a written exercise; all of them are reading your application as a sample.

The third one is consistently underrated. A risk professional who cannot make a written case that survives review has a ceiling regardless of technical ability, and interviewers know it — which is why the written stages in these processes are weighted more heavily than candidates expect.

The written work has a recognisable shape worth practising: the conclusion first, then the evidence for it, then what would change the conclusion. Risk papers are read by people who will not reach the end, so a document that builds to its finding buries the only part most readers will see. Leading with the answer is not a stylistic preference in this function; it is what makes a paper usable by a committee working through eleven of them.

The other thing worth knowing before entering is that risk work is cyclical in a way that is easy to misread from outside. Hiring expands after a regulatory change or an incident and flattens between them, and the functions that grow fastest are whichever ones the current cycle is about. That is an argument for building framework skills that transfer between disciplines rather than specialising narrowly in year one, because the discipline in demand when you enter is frequently not the one in demand five years later.

Frequently asked questions

Which risk discipline is easiest to enter without experience?

Credit risk and operational risk take more entrants from general backgrounds than market risk does, because they lean on structured judgement and process understanding rather than on quantitative methods. Market risk usually expects a numerate degree and comfort with statistics. Financial crime, which sits alongside these, is the single largest volume entry route into risk functions in most large banks.

Is second-line risk work adversarial?

Independent rather than adversarial, and the distinction is the whole craft of the job. The second line exists to challenge, and doing that well means being consistently reasonable so that a genuine objection carries weight. Someone who objects to everything is ignored; someone who objects to nothing has no function. Most of the skill is in choosing which battles matter.

Do I need a professional qualification?

Rarely to enter, sometimes to progress, and the useful ones are discipline-specific rather than general. What consistently matters more is being able to explain a risk clearly to someone who does not want to hear about it, and to write it down in a way that survives review. Certifications signal commitment; they do not substitute for that skill.