The organization reviews and updates the audited events [Assignment: organization-defined frequency].
Annually and based on situational awareness of threats, vulnerabilities
DoD RMF TAG
Over time, the events that organizations believe should be audited may change. Reviewing and updating the set of audited events periodically is necessary to ensure that the current set is still necessary and sufficient.
AU-2 (3) Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO.