The complexity of an audit may vary, as may the approach, depending on your needs.
Security is always a risk-cost trade off.
Only you can decide if you need an audit, and what kind of audit. A good way of making that determination is to ask how you would cope if you lost all your data, or if someone else had a copy of all of it, or was able to change it without your knowledge. If you already have a knowledgeable security team in place, you may still need an occasional validation of your security from a reputable independent party. If, on the other hand, you are not as confident of your security setup, or have mission critical data that simply cannot be lost or compromised, then a regular audit is a good idea. Web applications that inappropriately trust user data.