1. A collateral dashboard changes overnight and shows fewer margin calls. What would you do in the first 60 minutes?
Explain impact triage, SQL snapshots, lineage and job checks, recent-change review, publication controls, stakeholder communication, and evidence preservation.
In the first 60 minutes, I would follow five steps: Detect & Contain, Snapshot & Reconcile, Trace Cause, Decide & Communicate, and Preserve Evidence & Prevent Recurrence. I would first confirm the change, define the affected scope, and assess decision impact. If the data may be unreliable, I would pause or clearly flag publication. Then I would take reproducible SQL snapshots, compare row counts and control totals with the source and prior period, profile data quality, trace lineage, inspect overnight jobs and recent changes, communicate what is known and unknown, and preserve queries, logs, lineage, changes, findings, and recovery evidence in an audit trail.
My goal in the first hour is not to explain the drop immediately. It is to decide whether the dashboard can be trusted, protect people from using unreliable information, and collect enough evidence to locate the cause. I would use the same five-step flow as the diagram: Detect & Contain, Snapshot & Reconcile, Trace Cause, Decide & Communicate, and Preserve Evidence & Prevent Recurrence. I would compare the changed margin-call result with prior-period and source data at the same grain, preserve reproducible snapshots, trace the metric through lineage, review overnight jobs and recent changes, and communicate what is known and unknown. If reliability is uncertain, I would hold or clearly flag publication until validation supports release.
- What is the source of truth for margin calls, and what is the expected reporting grain—for example, by entity, portfolio, region, or another business key?
- What reporting time window, cutoff, and time zone should the dashboard represent, and is the prior-period comparison like-for-like?
- Are there established control totals, reconciliation rules, data-quality thresholds, or publication controls for this dashboard?
- Were any source feeds, transformation jobs, business rules, filters, mappings, schemas, or dashboard definitions changed recently?
- Which downstream users or decisions depend on this dashboard, and who owns the source, transformation, and reporting layers?
0–10 minutes — Detect & Contain. I would first reproduce the observation that the dashboard shows fewer margin calls than the prior reporting period. I would record the timestamp, reporting window, filters, data grain, affected entities or segments, and the exact dashboard state so the comparison can be repeated. I would determine whether the change is isolated or broad and whether it could affect risk, trading, reporting, or another downstream decision. If the data may be unreliable and the impact could be material, I would pause publication or clearly mark the dashboard as under validation rather than allowing an unverified result to be treated as fact.
At this stage I would separate observation from interpretation. The observation is only that the reported margin-call result changed. Possible explanations include a genuine business change, incomplete or late source data, a transformation defect, a schema or reference-data change, a filter change, or a reporting-layer problem. I would not claim any one cause yet.
10–20 minutes — Snapshot & Reconcile. I would take reproducible, read-only SQL snapshots of the relevant source, transformed, and reporting data using the same reporting window and grain. Reconciliation means comparing independently derived counts or control totals across the source-to-report path to find where they stop agreeing. I would compare row counts and appropriate control totals with the source system and the prior valid period while keeping the population, cutoff, filters, units, and aggregation rules consistent.
I would also perform focused data profiling. Completeness asks whether expected records or required values are missing. Accuracy asks whether reported values agree with the trusted source or an established control. Consistency asks whether equivalent data agrees across stages and systems. Validity asks whether values conform to permitted formats, ranges, categories, and business rules. Uniqueness asks whether records that should be unique are duplicated. Timeliness asks whether expected data arrived and was processed within the required reporting window. I would inspect nulls, duplicates, unexpected ranges or categories, schema drift, key uniqueness, and referential integrity where those checks are relevant to the affected metric.
I would not silently delete, overwrite, impute, or repair suspicious records. If invalid records must be isolated, I would quarantine or identify them with a reason so the exception remains auditable. Differences would be documented rather than hidden.
20–40 minutes — Trace Cause. Data lineage is the path from the source data through transformations to the final dashboard metric. I would trace the affected margin-call metric backward from the dashboard through the reporting dataset and transformation steps to the source. At each boundary I would compare row counts, keys, filters, aggregation behavior, and control totals. The first point where reconciliations diverge narrows the likely defect domain.
I would review overnight batch or transformation job status, run times, freshness indicators, logs, and upstream input availability. A successful job status alone would not prove that the data is correct; a job can complete successfully with incomplete input or changed logic. I would therefore validate both execution and data content.
I would also review recent code, configuration, business-rule, schema, reference-data, mapping, filter, and deployment changes that could affect the metric. I would compare those changes with the first point of divergence found during lineage tracing. This avoids blaming the latest deployment merely because it is recent. The goal is to determine whether the issue originates in the source, a transformation, or the reporting layer, or whether the lower result is a validated real business change.
40–50 minutes — Decide & Communicate. If the data remains untrusted, I would keep the dashboard blocked, quarantined, or clearly flagged according to the available publication control. I would communicate a factual status update to risk, trading, reporting, and other relevant stakeholders: what changed, what scope is affected, whether the dashboard is safe to use, what has been checked, what remains uncertain, and the next action. I would not announce a root cause until the evidence supports it.
If validation shows that the change is real and the source-to-report path reconciles, I would release or continue publication with a clear explanation of the cause and any required backfill or restatement. The release decision should be no stronger than the evidence.
50–60 minutes — Preserve Evidence & Prevent Recurrence. I would preserve the SQL queries and snapshots, row-count and control-total comparisons, relevant job logs, lineage information, change records, timestamps, exception records, assumptions, known data limitations, decisions, and stakeholder communications. That creates an audit trail and allows another analyst to reproduce the investigation.
Finally, I would assign an owner for unresolved work and feed lessons learned into stronger data-quality controls, monitoring, reconciliation, schema-change detection, regression checks, and a safe-failure publication rule. This closes the prevention loop shown in the diagram: reconcile rather than assume, and protect decision making with timely, accurate, consistent, complete, and well-controlled reporting.
- Detect & Contain (0–10 minutes): confirm the dashboard change, capture timestamp, reporting window, filters, scope, grain, and current state; assess downstream decision impact; pause or clearly flag publication if data may be unreliable.
- Snapshot & Reconcile (10–20 minutes): take reproducible read-only SQL snapshots of source, transformed, and reporting data; reconcile row counts and appropriate control totals to the source and prior valid period; profile nulls, duplicates, ranges, unexpected categories, schema drift, keys, and referential integrity where relevant.
- Trace Cause (20–40 minutes): trace the metric through lineage from dashboard to source; identify the first stage where results diverge; check overnight job status, run times, freshness, logs, upstream availability, and recent code, configuration, schema, business-rule, mapping, reference-data, filter, or deployment changes; distinguish source, transformation, and reporting defects from a validated real business change.
- Decide & Communicate (40–50 minutes): maintain publication controls while data is untrusted; give stakeholders a factual update; release only when validation supports it and explain any backfill or restatement.
- Preserve Evidence & Prevent Recurrence (50–60 minutes): save queries, snapshots, comparisons, logs, lineage, change records, decisions, and communications; create an exception record and audit trail; assign ownership; add or update reconciliation, alerts, regression checks, and safe-failure controls.
The main cost is investigative breadth rather than algorithmic complexity. More source layers, transformations, portfolios, reporting periods, and control totals mean more comparisons and more data to scan. Starting with scope, row counts, control totals, lineage, and the first point of divergence keeps the investigation fast. There is also a speed-versus-assurance tradeoff: publishing quickly may reduce delay, but publishing unverified risk information can create a larger decision risk. The safer choice is to communicate early while keeping unreliable output controlled until the evidence is strong enough to release it.
The interviewer is testing whether I can respond to a potentially important reporting anomaly without jumping to conclusions. They want to see whether I can protect downstream decisions, preserve evidence, distinguish a real business change from a data defect, reconcile the dashboard to its source, trace lineage, communicate uncertainty, and leave an auditable path to prevention and recovery.
Common mistakes are assuming that fewer margin calls must be a real business improvement, comparing periods with different filters or cutoffs, checking only the dashboard instead of reconciling to the source, treating a successful job status as proof of correct data, changing records before preserving evidence, ignoring nulls or duplicate keys, blaming the most recent deployment without locating the first point of divergence, continuing normal publication while data is untrusted, communicating a suspected root cause as confirmed, and failing to save the queries, logs, assumptions, comparisons, and decisions needed for an audit trail.
Present the answer as the five timed stages shown in the diagram: Detect & Contain, Snapshot & Reconcile, Trace Cause, Decide & Communicate, and Preserve Evidence & Prevent Recurrence. Keep distinguishing what you observed from what you have actually proven.





