Run quarterly as a health check. Work through the priority fixes first; they deliver most of the gains. Re-audit after fixing to confirm improvements.