When a company makes its auditing decision/frequency based on “risk factor”, you have to ask how it measures “risk”. BP Texas City had a major explosion in 1995 that killed 150 workers. Its own internal audits (before the explosion) showed that the company was basing risk on workers’ injuries. This is all public information from the BP Baker_panel_report about that incident. One of the causes of the explosive was lack of maintenance over many years. The problem was that even a poorly maintained equipment can keep on going for years until it breaks. So there were not a lot of injuries before the big explosion and that gave management a totally erroneous reading. They thought everything was fine and EHS budget was cut. The rest was history.
An environmental audit is analogous to a medical checkup. You want to find an ailment at its early stage before it becomes very costly to cure or incurable. So you should visit your doctor more often based on the number of ongoing health problems you have rather than how many times you were taken to the emergency room in an ambulance.