If you wish to duplicate an old Project, Risk Register will notify you whether the Project contains out-of-date risk assessments before you duplication is confirmed.
Unlike live projects, the status of the risk assessments in Projects where the End Date has passed is not visible on the project dashboard - so it will take a duplication request for you to be alerted.
The alert will give you the option to proceed with the duplication or to cancel.
If you go ahead with creating a duplicate, you can update the risk assessments in the Duplicate Project.