It depends on your organization. It is much like vulnerability scans. Even though an audit or security firm may perform such tests annually, it does not mean that a company has no need to perform such tests more frequently.
Contact us if you would like to discuss your specific situation.