How often should risk assessments be reviewed?

I was thinking update as things happen then do an yearly review of them?

I would agree. A once a year review ensures that it does get done on a regular basis, but if something of signifance happened (e.g., new product launched, new geographic location serviced) I would do an interim update.

I do annually, new regs/products/hot topics get extra scrutiny.