A risk management plan should be reviewed and updated regularly—at least annually—or whenever significant changes occur within the business or external environment.