Security audits should be conducted regularly, at least annually, or whenever significant changes are made to your systems or infrastructure. More frequent audits may be necessary for high-risk environments or industries with stringent regulatory requirements.