I remember trying to capture this using DDL triggers but never found a way of tracking role changes, yes you can catch new login/users but roles seemed more problematic