That's the maximum, but depending on the environment and other risk factors, it could well be done on a much more frequent basis. For example, if there has been a significant change in operation of any railway company, it must do another risk assessment. In such a case, Transport Canada would be aware of the change in operation and would be looking at it.
On March 21st, 2016. See this statement in context.