There are two primary reasons for this: to evaluate whether the previously selected security controls are still applicable and effective, and to evaluate the possible risk level changes in the business environment.