Development should include
deciding what types of access need to be monitored and why
justifying auditing methods
determining resources needed to audit events
documenting audit policy.