No, it is not enough to conduct a risk assessment once a year. That would be sufficient to identify only the static risks, but dynamic risks require ongoing monitoring.