Set a control's frequency by how fast the risk changes, how bad a miss would be, and what you can sustain without skipping. Event-driven controls run on every occurrence, fast-changing risks get daily or weekly checks, and slow-changing ones can be quarterly or annual. Then write the number down and keep to it.
Why the number matters
A written frequency becomes the standard you are tested against. If you state quarterly and run it every four months, that is an exception. If you state monthly and can only keep up with quarterly, state quarterly. A modest frequency you meet every time beats an ambitious one you miss.
The three questions
- How quickly does the risk change? Access changes daily. A disaster recovery plan changes rarely.
- What is the impact of missing a change? A forgotten admin account for three months is worse than an outdated org chart.
- Can a machine do it? Automated checks can run daily at no extra effort. Manual ones cost people time.
A starting guide
| Frequency | Good fit | Example |
|---|---|---|
| Every event | Changes, deployments, access grants | Required review on each pull request |
| Daily | Fast-moving technical signals | Vulnerability scan of production images |
| Weekly | Review of signals and queues | Triage of new high severity findings |
| Monthly | Reconciliation and reporting | Dormant account report, backup success review |
| Quarterly | Human reviews of access and exceptions | Privileged access review, exception review |
| Annual | Slow changing and program level | Policy review, risk assessment, restore test of full disaster recovery |
These are common patterns, not requirements. Frameworks mostly leave the frequency to you. NIST account management, for example, asks for account review at an organization-defined frequency.
Matching evidence to frequency
More frequent controls produce more evidence, and auditors sample from it. For daily controls they will pick several dates. So automated evidence capture matters most for high frequency controls: nobody will remember what happened on a Tuesday in March.
Steps to set yours
- List each control with its current practice.
- Write the frequency in the narrative.
- Check last year's records against the stated frequency. Any misses?
- Adjust the stated frequency to match reality, or adjust reality.
- Build the schedule: calendar entries, scheduled tickets or CI jobs.
- Review misses monthly.
Signs a frequency is wrong
- You skip runs regularly because it is too much.
- The check always finds nothing, so it may be too frequent.
- Findings are always old, so it may be too rare.
Try it yourself
Click through it at your own pace, or open it full screen. See how continuous checks replace a quarterly snapshot with a running record.
Quick check
Is quarterly access review enough?
It is common, but frameworks leave the frequency to you. Choose by risk and be consistent.
Can I lower a frequency mid-period?
Yes with documented approval, but expect the auditor to test against both versions.
Safeguard compliance and evidence automation can run recurring checks and keep dated results. Try a free scan.
Sources
Last reviewed: 19 October 2026.
