One simple auditting is to make sure they have the history being recorded (in /etc/bash.bashrc or /etc/profile so the user cannot easily disable it) and as part of the bash logout script copy that history to somewhere for safe keeping.