Can anyone direct me to a list of regulations that require annual or periodic audits by regulation? I know BSA is one of them but are there any others?

ACH is required to be done annually. Mostly they are based on your risk assessment, but we have also done regular reviews on BSA, flood and bank security.

Security requires an annual report, as does IT. That doesn't necessarily mean an audit is required, but you have to know what to talk about somehow. So an audit doesn't hurt, but as in Security, there are other items to discuss.

I think this is much like training and policies. There are a few requirements that you must hit. But it is assumed you'll do so much more just out of necessity, risk, safety and soundness, common sense, etc.