Auditing should be conducted at least twice every year – exceptions should be made in case there are imminent security threats in network.