Together, they must complete this assessment once every 3 years. Alternatively, they must complete this assessment whenever there are changes to the risk factors within the organization that may ...