Sorry setting up a permanent trace on the server that outputs to file, Profiler or a tool like profiler will be required to capture all of those details as SELECTs are not logged nor are they otherwise auditable. I have seen serveral SOX requirements and am curious what your system is for that requires such a strenuoues auditing of action. As well you can audit all you like but it can only tell what they looked at, not neccessarily what they did with it. If your server's data is under SOX scrutiny then you need to make sure that application side is logging what is going on as well since you cannot actually see that.