The other answers are correct; I don't disagree with them. I would like to add a couple of supplementary notes.
First, the frequency of updates depends on the size, complexity and velocity of the project, and on the priority your stakeholders give to risk management. Yes, risk management should be continuous, but if the project is not staffed for a full time risk manager, you're going to have to fit the updates in as time permits. Remember that the critical thing you want to do is to warn your stakeholders in time to productively intervene. If your work packages average a week long and you've got a dozen or more in progress at any time, then monthly updates will not permit timely intervention. If your work packages extend over multiple quarters and you've got only a few in progress, monthly may work.
Second, although I update my risk registry monthly, that's somewhat deceptive. The driver is that each risk has an urgency; I mark each risk with the date of next review. Some high level risks (high probability, high impact) don't vary by much. Some risks are dependent on political events that have very fixed deadlines and won't change till then. If you capture the urgency of the risk as the next date on which it could potentially change, then you can review the risk registry very quickly/economically.