I suppose it depends whether you are the responsible person, a competent advisor in the employ of the RP or an outside consultant brought in to advise.
Only the RP has a duty to review the risk assessment and should create his policy for managing this. The review procedure should be risk based, prioritised and reasonable, there should be a number of monitoring triggers set within the policy - to catch changes to the risk profile, persons at risk, processes or substance, near misses or fire incidents. there are no compulsory time frames for review, but a routine review based on risk over a cycle is appropriate. Why not plan say a 1, 2, 3 and 5 year cycle based on risk? Then as an audit you could put in some thematic reviews of the higher risk issues cutting across the risk based cycle- eg maintenance of fire alarms where you sample from high, medium and low risk premises just to keep them on their toes. All the enforcing authorities do this- HSE, Local Authorities, fire brigades.