Review on a schedule and when things change. Use a quarterly light review and an annual deep review. Trigger a review after an incident, a material product change, a new region, or a large vendor change.