Starting with SQL Server 2008, there are 3 native auditing solutions - Change Tracking, Change Data Capture, and SQL Server Audit, but only one tracks the user who made the changes
Change Tracking doesn’t answer the “who”, “when”, and “how” questions. In addition, if there were multiple changes on a specific row, only the last one is shown. The feature just indicates whether the row has been changed or not. It shows the ID of the row changed, and the specific column that is changed. What this feature doesn’t provide are the details about the change. You can match the change information to the database snapshot and the live database to find out more about the changes, but this requires additional coding and still doesn’t bring all the information that might be needed for auditing. It doesn't track the queries executed either. As for reading the data, there are no built-in reports, you must use change tracking functions
Setting the database to Bulk-Logging recovery model does not provide the information about the queries executed against the database. it will however provide the info about who did what. To keep the online database transaction log file from growing huge, create transaction log backups periodically
Change Data Tracking also doesn't track who made the change and what code was executed. The same as with the SQL Server Change Tracking feature, the change information in SQL Server Change Data Capture is available through table valued functions
While Change Tracking shows only what was changed and whether the change was an insert, update, or delete, Change Data Capture shows the values inserted, deleted or updated for the modified rows. For updates, it shows both old and new values of the updated row
SQL Server Audit is the only feature that captures the user name who made the change. It also captures execution of SELECT and EXECUTE statements. The audited info can be stored in 3 types of files - a *.sqladuit file, application and security log and you can use the fn_get_audit_file function, Log File Viewer utility in SQL Server Management Studio, and Windows Event Viewer to read them
Also, there are 3rd party auditing tools that provide also built-in reporting, such as ApexSQL Comply
Disclaimer: I work for ApexSQL as a Support Engineer