OSHA doesn’t require an arc flash risk assessment. NFPA 70 does require one. However, OSHA doesn’t incorporate by reference 70E.
70E is a nationally recognized consensus standard and OSHA can cite under the General Duty Clause for failure to comply with it. NFPA 70E indicates a requirement for a review of the initial arc flash data at least every five years. NFPA 70E is a copyrighted industry standard.
70E, while not incorporated by reference, is commonly used to as a reference by OSHA when writing citations.