Need to create an audit record in our application whenever a user changes their password

This can be achieved using the Authentication API Webhooks extension. You can configure this to run on Success Change Password events only. You can setup a webhook on Webtask (or your own endpoint), which can handle the calls from Auth0 and do the additional logging.