When should Knowledge Based Authentication (KBA) / Out of Wallet (OOW) Challenge Questions be run?

KBA questions can either be triggered every time (aka "all users must answer KBA questions to be approved") or only in order to rectify fraud flags (aka "only if there are red flags ask KBA questions to get comfortable with an otherwise questionable user").