I agree with reassessing things periodically, though I wouldn't say it should always be with an eye on reducing risk. Sometimes it's appropriate to take risks, though always in a measured with and with an understanding of the consequences. Of the things I see in our profession (IT) is that we're often so risk averse that the pace of change slows to a crawl, often with a very negative impact on the business.