What would I need to do to make sure my DB policies have to pass a security audit?
I applaud your effort, however the question asked is probably too vague. Different rules apply to different industries and furthermore, sometimes you have the opportunity to set your own rules, you just need to follow them.

I would suggest checking with someone as to what audit you are expected to pass, then finding the specific requirements.