DIAB (DBAinABox) from diabsqlsoftware.com has built in SOX tools to alert you if permissions have been altered. it does this without using a trace or inserting any objects on the sever / database being monitored. It is not a 100% solution to your question but it will keep SOX auditors happy and is inexpensive.