Penetration Testing

I am curious whether other credit unions perform penetration testing every year.  Is this an actual requirement, or is it simply best practice?  This testing can be costly, and I am curious whether the penetration test can be performed every few years, rather than annually.  Any feedback on this topic would be helpful.   Thanks,                Scott Adams