IIA-CIA-PART2 Web TestEngine demo

The risk assessment must be performed at least quarterly.

The risk assessment must be performed at least annually.

The risk assessment must be performed at least once every five years, in alignment with the internal audit activity's quality assurance and improvement program.

There is no specific requirement; a risk assessment should be performed as needed to account for
changes in the business environment.