The institution shall conduct a review of its overall risk management process at least once a year .