You're the admin of a large corporation's production computer system, with many users. How often should you review and audit your users rights?
Reviewing user rights should happen once a year. It is too lengthy of a process to do to often, but still needs to be done.