You know what you're definitely right about audit logging. It does seem like one of those "easy on the surface, will absolutely kill you in the details" sorts of things.