The frequency of audits is determined taking into account the risk category (based partly on the size of the site or the type of production activity), the performance evaluation (based partly on past audit results, for example) and riskmitigating measures (e.g. existing ISO certifications), and ranges from two to five years.