The answer should be that if you're able to show the auditor some type of hashing that logs changes to files which you're interested in seeing, the requirement is satisfied. That is the approach I have always seen in the past. If an auditor feels that a particular type of auditing is insufficient, they should be able to articulate to you what they'd find to be sufficient, and why the method you're using is faulty. Having worked on different types of compliance standards in the past, in my experience this can vary greatly from organization to organization, or even from different auditors within the same organization.
