How do you balance agile ways of working with strict regulatory requirements, for example in banking or healthcare?
What the interviewer wants to hear
- Identify regulations and compliance stakeholders early
- Turn regulatory rules into explicit, traceable requirements
- Lightweight but auditable documentation linked to stories and tests
- Include compliance in the Definition of Done
- Involve compliance in reviews regularly, not just at the end
- Keep decision logs and evidence
Model answer
I start by identifying which regulations apply and bringing compliance, risk and legal people in as stakeholders from the beginning, not at the end. I turn regulatory obligations into explicit, traceable requirements or acceptance criteria, linked to the clause they come from. Documentation stays light but auditable: stories, acceptance criteria, decision logs and test evidence are linked in Jira and Confluence, so an auditor can follow the trail from regulation to tested feature. I work with the team to add compliance checks to the Definition of Done, such as privacy review or audit logging. Compliance reviewers join sprint reviews regularly so issues surface early when they are cheap to fix. This shows that agile and regulation can work together: we still deliver in small steps, but every step leaves the evidence regulators need.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Business Analyst questions
- Two important stakeholders have opposite requirements for the same process. How do you resolve it?
- Users are resisting a new system you helped design. How would you handle this?
- How would you build a business case for a new system or process change?
- Just before go-live, you discover you missed an important requirement. What do you do?
- How do you know if a solution you analysed actually solved the business problem?
- You are leading analysis to replace a critical 20-year-old system that nobody fully understands. How do you approach it?
- How would you write requirements for a feature that uses AI, such as automatically classifying customer emails?
- Your company is buying an off-the-shelf ERP instead of building one. How does your analysis approach change?
- A senior stakeholder is convinced of the cause of a problem, but your data analysis points to a different cause. How do you handle it?