Tracking generic user sessions for audits

First let me thank you for your well written articles in the Professional Journal.

I have a long question which concerns using a Web Based front end to SAP, COM objects, and logging/tracking on the SAP backend. Do you know of any companies using an approach where the security/authorizations are enforced via the web front end and a generic session user/password is utilized by the COM object? We are experimenting with this approach and for reporting purposes, things seem to be OK. However, with BAPIs/RFCs that update data, we are unsure how to support logging/tracking on the SAP side required for audit purposes. We are proceeding with an approach that would perform this transaction logging on custom tables (our thought is to pass user information from the web in the call to the COM object and subsequently to the SAP function which would update the custom table). However, our concern is that standard SAP functionality formerly used for audit purposes, such as change documents, would become useless with such an approach. Has anyone else run into a similar problem and is there a way to use a generic login via a COM object yet still support user specific logging/tracking on the SAP side?

Thanks in advance for any help you can provide.