As you rightly say, audit frequency & depth should be risk-based, so it would be silly to have a frequency set in stone. However the audits (by outsider(s), with no direct site responsibilities) should be supplemented by planned and unplanned monitoring (people with site responsibilities, checking that hazards are suitably identified, the agreed controls are in place and are effective in reducing risks). If your client wants to audit as well, I strongly recommend they don't start from scratch but either join in one of your audits (new, independent, competent eyes always add value) or at least start from where your audit and monitoring reports finish. Audits on top of other audits take up lots of peoples time and rarely add much value, whereas looking for gaps or poor closeout actions can be very helpful.