A system that is high risk or new should be audited quarterly. Stable systems can be audited twice a year.