While cleartext storage of passwords is a bad thing, some kinds of "reversible obfuscation" (e.g. Base64 encoding, or ROT13 "encryption") are not much better, and should be detected as well.
The right way to audit the password storage and verification method is to look at the specification, i.e. the document that states what algorithm is used, and with what parameters. If that document exists, just read it. If that document does not exist, assume the worst; from an audit point of view, unspecified behaviour is as bad as weak behaviour.
Looking at the database is akin to reverse engineering: while it tends to work (you can indeed learn a lot of things through reverse engineering), it also indicates that the product designers are not collaborating with the auditors, and that will make the audit meaningless.
(In a hurry, as an auditor, you could make do with a copy of the source code, and see for yourself how the code processes passwords. Source code is not a good substitute for proper documentation, but it is still much better than inference from a cursory look at a database.)