To audit all actions in which keycustodian_role is active, use:
sp_audit "all", "keycustodian_role", "all", "on"