How often should a risk assessment be reviewed and updated, and under what circumstances?

• A. Reviewed when changes occur, after incidents, with periodic intervals per policy; updated as new information becomes available.
• B. Reviewed only at project launch and never updated.
• C. Updated only when a major incident occurs.
• D. Updated strictly on an annual schedule regardless of changes.

Answer: (A)

A risk assessment should function as a living document, continually updated to reflect the current work environment. It must be reviewed and revised whenever changes occur, after incidents or near misses, and at regular intervals defined by policy or standards. This approach keeps the assessment aligned with new hazards, changes in processes or equipment, updated controls, and new information such as test results or regulatory requirements. Updates should also occur when information becomes available that could affect risk levels or how effectively controls reduce those risks, ensuring residual risk stays acceptable and controls remain fit for purpose. The other options miss essential triggers for revision—for example, refraining from updates after changes or incidents, or limiting reviews to an annual schedule—so they don’t maintain an accurate, current picture of risk.