There is no single universal number, the right interval depends on a system's risk category and how much it tends to change. What matters more than picking a fixed number is having a documented rationale for whatever interval you choose, and a process for triggering a review outside that schedule when something changes.
A periodic review calendar is useful, but relying on it exclusively misses the point that risk does not wait for a scheduled date. A significant change, a near miss deviation, or a new regulatory expectation should be able to trigger a review outside the normal cadence, not wait for the next scheduled slot.
Whether the system is still being used as originally intended, whether accumulated small changes have added up to something that should have gone through formal change control but did not, and whether the original risk assessment still holds given how the system is actually used today.
A short walkthrough of how GxPForge keeps traceability current as your team works, instead of reconstructing it before a release.
Book a demo