See also
http://social.technet.microsoft.com/Forums/en-US/sqlsecurity/thread/1976cfab-966d-46ff-87e5-6d2925da3d27

> I'm not so sure about a timestamp column on every table. I'd certainly say most tables should have one (especially if the data is user entered - in that case then userID is a requirement also IMHO). Some reference tables just don't have that need IMO.
>
>Many organizations have rules/regulations that require timestamps on every table.
>
>You never know when it can help, even on the smallest of tables. A while back someone with admin rights modified a row (manually) in Management Studio, in a config table with about a dozen entries. Someone noticed that the spelling on a report for a discount promotion name was wrong. (About a year prior, I had convinced the DBA to put a trigger on every table to update the LastUser and LastUpdateDate.)
>
>So obviously we could see whodunnit it and when.
>
>Having a timestamp is like paying insurance premiums. ;)
>
>What I've always advocated (or actually built, it I was able to) is this:
>
> Either an identity PK or a GUID
>CreatedByID
>ModifiedByID
>CreatedDate
>ModifiedDate