A company is required to perform a risk assessment on an annual basis. Which of the following types of risk assessments does this requirement describe?

The correct answer is Recurring. A recurring risk assessment is performed at regular, predetermined intervals, such as annually, quarterly, or monthly. This ensures that an organization consistently monitors and addresses its risk posture over time. Continuous risk assessments involve ongoing, real-time monitoring and analysis of risks, which is more frequent and dynamic than an annual assessment. Ad hoc assessments are performed as needed, typically in response to a specific event or change, rather than on a fixed schedule. One-time assessments are single, isolated events and do not involve repeated evaluations.