Periodic review must be part of the risk management strategies because risks from security threats create competitive disadvantage to organizations. It is a constant process for safeguards and controls to be devised and implemented, and not to be install-and-forget devices.