A TACCP (Threat Analysis and Critical Control Point) assessment should be done at least annually. It is important to know that if there are any changes to processes in the business or if a new threat emerges, a revised assessment will be needed.