Auditing is recorded in History table 

if you use OOTB activity TrackSecurityChanges - system will store property name in PYLABEL column and values (original and change) values in PYMEMO column. From these columns you are able to get the details.

Just try with operator id table, you are able to understand 

Create declare trigger under class Data-Admin-Operator-ID , in the trigger call the activity TrackSecurityChanges.

Now open your operator id and change the position from profile tab.

validate entry in table pr_history_data

reference : https://community.pega.com/knowledgebase/articles/security/how-audit-field-level-changes-security-rule-and-data-instances

Hello,

Adding one more approach, it might help you.

1) Identify the history class of your work class and create the required properties and expose them.

 2)Pega invokes AddWorkHistory on each assignment completion & writes an entry into the history table. It has an extension point pyAddWorkHistoryDefaults to implement application-specific mapping to the history table. Specialize in your application ruleset and make the changes. PFA

 3) Now Pega starts storing all the value changes that happen to the configured fields. In our scenario, all the name changes will be recorded in the history table.

History tables will have a property pxHistoryForReference which will hold our case pzInsKey. This can be used to fetch/join the information whenever required.