... "drop in" replacement for the mysql_query call. From there, a simple search/replace on the codebase.
The auditor will capture "who did what" and "when". It is also smart enough to fully parse the raw MySQL query and compare updates to existing rows. Only actual changes are recorded in the audit log (database table) regardless of the SQL.
Finally, a simple web viewer for reviewing and managing the audit trail. Job done. :-)