Audits should be carried out at least once a year, with more regular reviews for high-risk areas or significant changes in operations. Regular audits maintain continuing security and find potential fraud concerns.