While there may have been a limited amount of change internally, regulation requirements and legal standards evolve and change on a regular basis. You may also be surprised at how much change has occurred upon reviewing the details of your internal operations. Seemingly insignificant changes could very well necessitate a security policy update. Making an assumption is a risk. Performing a regular assessment mitigates that risk.