How often are risk assessments conducted according to the policy?
Risk assessments are conducted at least annually or whenever there are significant changes in the organization’s operations, systems, or regulations.