I don't think there's a standard answer for either question. Auditing requirements are either a business or legal requirement. If the business you're working with doesn't need auditing, there's no need to turn it on at all. Otherwise, you need to consult with the business side to understand their expectations. Publicly traded companies have to comply with some part of Sarbannes-Oxley for some of their data. While US health-care companies have to comply with HIPA for parts of their data. You may even be in a publicly traded health-care company where you have to comply with both. I'd go straight to the business and ask this question.