Two of the most significant are that they are expensive to conduct and can strain staff because of the significant time required to perform. Therefore, organizations must be able to identify when and at what interval risk assessments should be performed. How does an organization determine when risk assessments should be performed