[From SQL Server Performance]
Once the Server Level audits described in Part 1 of the Security Audit series are complete, databases should be considered next. A number of steps can be taken to audit database level security.
The article continues at
http://www.sql-server-performance.com/articles/dba/security_audit_database_level_p1.aspx