The sp_audit security option audits these security-relevant events:
Starting up or shutting down the server
Activating or deactivating a role
addcert
connect
create and drop login
dropcert
create, drop, alter, grant, and revoke role
kill
online database
set proxy
set session authorization
sp_configure
config_admin
attr_notify
ha_check_alive
ha_retrestrictionclass
ha_hacluster_verify
ssl_admin
set_password
ha_add_companion
ha_getversion
ha_getrcs
js_wakeup
ws_admin
valid_user
ha_remove_companion
ha_failback
ha_setrcs
unlock_admin_account
Issuing proc_role from within a system procedure
Regenerating the SSO passwords