monitoring

How often should the risk register be updated?

Our risk register has 45 risks, last updated 3 months ago. The PM says 'we review risks at milestones.' Is that enough? What does PMBOK recommend?