premise: Over time, policies and procedures may become inadequate because of changes in threats, changes in operations, or deterioration in the degree of compliance.
hypothesis: It's vital that a review of policies and procedures takes place every year.