Trace is going to be your best option on 2005. You could also look into C2 or Common Criteria auditing (which both use Trace by the way) as those are already setup for you and are enabled with a simple server config. As I said, on 2005 your options are limited. I am not familiar with any third-party apps that can give you something to satisfy your auditors because it depends on what they want to see out of the audit. It's also worth mentioning that if you are one of the people the auditors need to account for with a custom auditing solution then you probably shouldn't be the only one involved in designing it 😉