Whenever I have come across the need for auditing then the preference by the business was against a home spun solution and for the deployment of a third party system as it was deemed easier to justify its selection on the basis that it was less open to subversion (original meaning, not the source control product). This could be argued either way and, I believe, totally dependent upon the auditing product selected.