Ralph I agree that risk management is a continuous process that needs to be looked at due to risks continuously changing. I think that the amount of time before a risk revisit should be directly related to the severity of the risk, a company might even want to add a section to their risk management to determine the time they believe before that risk might have altered or changed in some way. I do feel that risk management has to be implemented before the BC/DR plans can be drafted up as they are a reaction to you controls set in place failing to protect you from that particular risk.