This practice is not recommended anymore, yet still found in many enterprises.
Frequent password changes don't protect against phishing.
And while a high frequency like monthly changes will probably result in even weaker passwords, also yearly changes will make people choose weak passwords.