Generally, such statements were required from new users at the time access to information resources was first provided and from all users periodically, usually once a year.
Users were never asked for statements.