Every few months, at least, you should review the risk register, and check:

• Progress on mitigation, and whether the mitigation is still relevant, or if more and/or different action is necessary;
• Whether any of the risks are past their ‘sell-by’ date, and can therefore be closed (that is, you can agree that they are no longer likely to happen), or have already happened, and should therefore be moved to the ‘Issues list’.

A risk is an event that might happen at some point. Once it happens, it is no longer a risk, but an issue, which also needs to be managed.