Is updating mandatory?

Answer:
I will only consider ISO 9001:2015 and ISO 14001:2015 in my answer.

ISO 9001:2015
About being mandatory to update external and internal issues – the last phrase of clause 4.1 and clause 9.3.2 b) consider the principle that changes in the context may occur and that the organization must consider them.

About being mandatory to update risk analysis – clause 6.1.1 say that organizations should consider external and internal issues when determining risks and opportunities. So, if external and internal issues are updated it is plausible to conclude that at least some risks and opportunities can appear/disappear or become more or less critical. Also, clauses 9.3.2 e) and 10.2.1 e ) can be seen as doors to consider the need to update risk analysis. Effective actions, for example, can change the priority of risks and opportunities, and nonconformities can make updating the risk register and risk classification necessary.

ISO 14001:2015
About being mandatory to update external and internal issues – clause 9.3 b) 1) consider the principle that changes in the context may occur and that the organization must consider them.

About being mandatory to update risk analysis – clause 6.1.1 say that organizations should consider environmental aspects, compliance obligations and external and internal issues when determining risks and opportunities. So, if external and internal issues are updated, and if environmental aspects and compliance obligations are updated it is plausible to conclude that at least some risks and opportunities can appear/disappear or become more or less critical. Also, clause 9.3 b) 4) can be seen as a door to consider the need to update risk analysis. Effective actions, for example, can change the priority of risks and opportunities.

About being mandatory to update environmental aspects – Clause 9.3 b) 3) considers the possibility of changes among environmental aspects.

Organizations are not separated from their context they are immersed in it. If the context changes, organizations should update their context analysis and evaluation. Management systems are in part tools to manage risks, opportunities and environmental aspects. An effective management system with their effective actions should, as a consequence, generate the need to update the determination and evaluation of risks, opportunities and aspects.

The following material will provide you information about clause applicability:
- ISO 9001 – How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- ISO 14001 - Environmental aspect identification and classification - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/