The frequency of second-party audits is based on a risk assessment, by the audit competency that considers type of facility, inherent risk of facility, effectiveness of EHS systems, past EHS performance metrics at the site, and other external factors.