An assessment is done before the processing starts, and it is not finished until it is signed. It cannot be signed while a section is empty, a risk has no measure or no score after it, the DPO's advice is not recorded, or a high risk remains and the ICO has not been consulted.
A signed assessment is reviewed by its date, and again whenever the nature, scope, context or purpose of the processing changes. A review starts a fresh draft from the signed one; the signed one stays as it was.