A penetration test report represents the state of security at a given point in time. Networks and applications are constantly changing. New vulnerabilities are discovered every day, and the threat landscape changes rapidly. By the time you receive your penetration test report, it could already be out of date. There is no one-size-fits-all answer to how often a penetration test should be conducted, but you should plan for periodic penetration testing.
Organizations should assess their unique environment and their risk tolerance to determine pen testing frequency. An organization with a high rate of change in its network and applications should conduct more frequent penetration tests than an organization with a mostly static network. An organization with strong centralized system configurations can generally conduct penetration tests less frequently than an organization that lacks centralized control. An organization that is a higher-profile target should test its networks more often.
The PCI DSS requires penetration testing annually and upon significant change. Even for organizations that are not bound to the PCI DSS, we often see penetration testing performed at least on an annual basis.