This totally depends upon your nature of business or service, if your core business is in a technology based environment, two audits per year would be sufficient, if not, a security audit once in two years would be sufficient.