It's vital that a review of policies and procedures takes place every year.
Over time, policies and procedures may become inadequate because of changes in threats, changes in operations, or deterioration in the degree of compliance.