A newly assigned project has had significant conflict about status and compliance with international regulations. During a routine meeting the sponsor asks how often risks are reviewed. Which document should the project manager check first?

The Risk Management Plan is the correct answer because it details how risk management activities, including risk reviews, will be performed on the project. It defines the methodologies, roles and responsibilities, timing, and frequency of risk processes. The project manager should consult this plan first to understand the established procedures for risk review frequency. The Risk Register lists identified risks and their attributes, but not the process for reviewing them. The Issue Log tracks current problems, not future risk management processes. The Risk Report summarizes overall project risk exposure and key individual risks, but doesn't define the review frequency itself; it's an output of the risk management process.