I’m seeing teams let registers go stale; last week I found three vendors still tagged low risk despite two incidents this quarter. I’m leaning toward a 30-day review cadence with simple triggers like a new vendor, a scope change, or any incident, but I’d like to hear what cadence and mitigation thresholds you use to keep it disciplined without wasting cycles.